ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10.33.0

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm lint

      # Workspace packages are dist-resolved; build them before typecheck/test.
      - run: pnpm -r build

      - run: pnpm -r typecheck

      - run: pnpm -r test

  # Build amd64 images on the runner (fast, has RAM) and push to GHCR.
  publish:
    needs: build
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # image: refs default to ghcr.io/knoworganization/*. Build all, push all.
      - run: docker compose build
      - run: docker compose push

  # Box pulls the freshly pushed images — no build on the 1GB host.
  deploy:
    needs: publish
    runs-on: ubuntu-latest
    concurrency:
      group: deploy-oracle
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4

      - name: Write SSH key
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "${{ secrets.ORACLE_SSH_KEY }}" > ~/.ssh/oracle.key
          chmod 600 ~/.ssh/oracle.key
          ssh-keyscan -H "${{ secrets.ORACLE_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null

      # Ship compose config (not source — images are baked), then pull + up.
      - name: Sync compose files
        run: |
          SSH="ssh -i ~/.ssh/oracle.key"
          $SSH ubuntu@${{ secrets.ORACLE_HOST }} 'mkdir -p ~/anywarecode/infra'
          rsync -az -e "$SSH" docker-compose.yml ubuntu@${{ secrets.ORACLE_HOST }}:~/anywarecode/
          rsync -az -e "$SSH" infra/caddy.yml infra/Caddyfile ubuntu@${{ secrets.ORACLE_HOST }}:~/anywarecode/infra/

      - name: Pull + restart
        run: |
          ssh -i ~/.ssh/oracle.key ubuntu@${{ secrets.ORACLE_HOST }} '
            cd ~/anywarecode &&
            sudo docker compose -f docker-compose.yml -f infra/caddy.yml pull &&
            sudo docker compose -f docker-compose.yml -f infra/caddy.yml up -d &&
            sudo docker image prune -f'