deploy.yml

name: Build & Deploy to EC2

on:
  push:
    branches: [ main ]

env:
  DOCKER_IMAGE: kimwooju/repit-api-server
  KEEP_TAGS: 5

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to DockerHub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Set short SHA
        run: echo "SHORT_SHA=${GITHUB_SHA::7}" >> $GITHUB_ENV

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.DOCKER_IMAGE }}:latest
            ${{ env.DOCKER_IMAGE }}:${{ env.SHORT_SHA }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Cleanup old DockerHub tags
        run: |
          TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
            -H "Content-Type: application/json" \
            -d "{\"username\":\"${{ secrets.DOCKERHUB_USERNAME }}\",\"password\":\"${{ secrets.DOCKERHUB_TOKEN }}\"}" \
            | jq -r .token)

          ALL_TAGS=$(curl -s -H "Authorization: JWT ${TOKEN}" \
            "https://hub.docker.com/v2/repositories/${{ env.DOCKER_IMAGE }}/tags/?page_size=100&ordering=-last_updated" \
            | jq -r '.results[].name')

          HASH_TAGS=$(echo "$ALL_TAGS" | grep -E '^[0-9a-f]{7}$' || true)
          DELETE_TAGS=$(echo "$HASH_TAGS" | tail -n +$(( KEEP_TAGS + 1 )))

          for TAG in $DELETE_TAGS; do
            echo "Deleting tag: $TAG"
            curl -s -X DELETE \
              -H "Authorization: JWT ${TOKEN}" \
              "https://hub.docker.com/v2/repositories/${{ env.DOCKER_IMAGE }}/tags/${TAG}/"
          done

      - name: Deploy to EC2 (Blue/Green)
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USERNAME }}
          key: ${{ secrets.EC2_SSH_KEY }}
          script: |
            chmod +x ~/deploy.sh
            bash ~/deploy.sh