cd-main.yml

name: CD on main (spring+python → prod, prune)

on:
  push:
    branches: [ main ]
  workflow_dispatch: {}

permissions:
  id-token: write
  contents: read

jobs:
  build_and_push:
    runs-on: ubuntu-latest
    env:
      AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
      AWS_REGION:     ${{ secrets.AWS_REGION }}
      SPRING_REPO:    spring
      PY_REPO:        python
      ENV_TAG:        prod-latest
      KEEP_N:         "5"
      EXTRA_PROTECT:  ""
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 21
        uses: actions/setup-java@v3
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Set up Python (for optional python build)
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume:    ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region:        ${{ secrets.AWS_REGION }}
          role-session-name: snacknews-cd

      - name: Who am I?
        run: aws sts get-caller-identity

      - uses: aws-actions/amazon-ecr-login@v2

      # ---------------- 스프링 JAR 빌드(필수) ----------------
      - name: Build Spring JAR
        run: |
          chmod +x ./gradlew
          ./gradlew clean bootJar -x test

      - name: Show Spring build artifacts
        run: ls -la build/libs || true

      # ---------------- 파이썬 빌드(선택적) ----------------
      - name: Build Python package if applicable
        run: |
          if [ -f python-nlp-service/pyproject.toml ] || [ -f python-nlp-service/setup.py ]; then
            python -m pip install --upgrade pip setuptools wheel build
            (cd python-nlp-service && python -m build) || true
            ls -la python-nlp-service/dist || true
          else
            echo "No python build file found, skipping python packaging step"
          fi

      # ---------------- Docker 이미지 빌드 ----------------
      - name: Build spring image
        run: |
          URI=${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${SPRING_REPO}
          docker build -f src/Dockerfile -t ${URI}:${{ github.sha }} -t ${URI}:${ENV_TAG} .

      - name: Build python image
        run: |
          URI=${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${PY_REPO}
          docker build -t ${URI}:${{ github.sha }} -t ${URI}:${ENV_TAG} ./python-nlp-service

      - name: Push spring
        run: |
          URI=${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${SPRING_REPO}
          docker push ${URI}:${{ github.sha }}
          docker push ${URI}:${ENV_TAG}

      - name: Push python
        run: |
          URI=${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${PY_REPO}
          docker push ${URI}:${{ github.sha }}
          docker push ${URI}:${ENV_TAG}

      - name: Install jq
        run: sudo apt-get update && sudo apt-get install -y jq

  deploy:
    runs-on: ubuntu-latest
    needs: build_and_push
    env:
      REMOTE_DIR: /home/ubuntu/Back-end
      ENV_TAG:    prod-latest
    steps:
      - name: SSH & deploy (prod)
        uses: appleboy/ssh-action@v1
        with:
          host:     ${{ secrets.SSH_HOST_STG }}
          username: ${{ secrets.SSH_USER }}
          key:      ${{ secrets.SSH_PRIVATE_KEY }}
          script_stop: true
          script: |
            set -e
            cd "${{ env.REMOTE_DIR }}"
            AWS_REGION="${{ secrets.AWS_REGION }}"
            AWS_ACCOUNT_ID="${{ secrets.AWS_ACCOUNT_ID }}"
            TAG="${{ env.ENV_TAG }}"

            if ! command -v aws >/dev/null 2>&1; then
              sudo apt update && sudo apt install -y unzip curl
              ARCH=$(uname -m)
              if [ "$ARCH" = "x86_64" ]; then URL="https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip"; else URL="https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip"; fi
              curl -fsSL "$URL" -o awscliv2.zip
              unzip -q awscliv2.zip
              sudo ./aws/install
            fi

            aws ecr get-login-password --region "$AWS_REGION" \
              | docker login --username AWS --password-stdin "$AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com"

            touch .deploy.env
            grep -q '^AWS_ACCOUNT_ID=' .deploy.env || echo "AWS_ACCOUNT_ID=$AWS_ACCOUNT_ID" >> .deploy.env
            grep -q '^AWS_REGION='     .deploy.env || echo "AWS_REGION=$AWS_REGION"         >> .deploy.env
            if grep -q '^IMAGE_TAG=' .deploy.env; then sed -i "s/^IMAGE_TAG=.*/IMAGE_TAG=$TAG/" .deploy.env; else echo "IMAGE_TAG=$TAG" >> .deploy.env; fi
            if grep -q '^PYTHON_IMAGE_TAG=' .deploy.env; then sed -i "s/^PYTHON_IMAGE_TAG=.*/PYTHON_IMAGE_TAG=$TAG/" .deploy.env; else echo "PYTHON_IMAGE_TAG=$TAG" >> .deploy.env; fi

            docker compose --env-file .deploy.env pull
            docker compose --env-file .deploy.env up -d --no-deps --force-recreate spring python
            docker image prune -f