docker-deploy.yml

# =============================================================
# API-Watch — Docker Build, Push & Deploy to Azure
#
# Flow: Test → Build Docker Image → Push to GHCR → Deploy to
#       Azure App Service for Containers → Health Check
#
# Prerequisites (GitHub repo settings):
#   Secrets:
#     - AZURE_CREDENTIALS    (az ad sp create-for-rbac output)
#     - JWT_SECRET_KEY        (openssl rand -hex 32)
#   Variables (required for Azure deploy):
#     - AZURE_WEBAPP_NAME     (your Azure App Service name)
#     - AZURE_RESOURCE_GROUP  (your Azure resource group name)
# =============================================================

name: Docker Build & Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository_owner }}/api-watch
  AZURE_WEBAPP_NAME: ${{ vars.AZURE_WEBAPP_NAME }}
  AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}

permissions:
  contents: read
  packages: write

jobs:
  # ── Job 1: Test ──────────────────────────────────────────────
  test:
    name: Run Tests
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python 3.11
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - name: Install Python dependencies
        run: pip install -r requirements.txt

      - name: Run backend tests
        env:
          TESTING: "true"
        run: pytest tests/ -v --tb=short

      - name: Set up Node.js 22
        uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: frontend/package-lock.json

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm ci

      - name: Run frontend tests
        working-directory: frontend
        run: npm test

  # ── Job 2: Build & Push Docker Image ─────────────────────────
  build:
    name: Build & Push Image
    runs-on: ubuntu-latest
    needs: test
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ github.sha }}
            type=raw,value=latest

      - name: Build and push Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          build-args: |
            VITE_API_URL=

  # ── Job 3: Deploy to Azure ──────────────────────────────────
  deploy:
    name: Deploy to Azure
    runs-on: ubuntu-latest
    needs: build
    environment: production

    steps:
      - name: Azure Login
        uses: azure/login@v2
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Configure Azure App Service for Container
        run: |
          # Set container image (GHCR package is public — no credentials needed)
          az webapp config container set \
            --name ${{ env.AZURE_WEBAPP_NAME }} \
            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
            --container-image-name ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
            --container-registry-url https://${{ env.REGISTRY }}

          # Set application settings
          az webapp config appsettings set \
            --name ${{ env.AZURE_WEBAPP_NAME }} \
            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
            --settings \
              WEBSITES_PORT=8000 \
              JWT_SECRET_KEY="${{ secrets.JWT_SECRET_KEY }}" \
              CORS_ALLOWED_ORIGINS="https://${{ env.AZURE_WEBAPP_NAME }}.azurewebsites.net" \
              LOG_LEVEL=INFO \
              ENVIRONMENT=production \
              GUNICORN_WORKERS=1

      - name: Restart App Service
        run: |
          az webapp restart \
            --name ${{ env.AZURE_WEBAPP_NAME }} \
            --resource-group ${{ env.AZURE_RESOURCE_GROUP }}

      - name: Wait for deployment to stabilize
        run: sleep 30

      - name: Health check
        run: |
          URL="https://${{ env.AZURE_WEBAPP_NAME }}.azurewebsites.net/health"
          echo "Checking $URL ..."

          for i in 1 2 3 4 5 6; do
            HTTP_CODE=$(curl -s -o /tmp/health.json -w "%{http_code}" "$URL" 2>/dev/null || echo "000")
            if [ "$HTTP_CODE" = "200" ]; then
              echo "✅ Health check passed!"
              cat /tmp/health.json | python3 -m json.tool 2>/dev/null || cat /tmp/health.json
              exit 0
            fi
            echo "Attempt $i: HTTP $HTTP_CODE — retrying in 15s..."
            sleep 15
          done

          echo "❌ Health check failed after 6 attempts"
          # Dump container logs for debugging
          timeout 15 az webapp log tail \
            --name ${{ env.AZURE_WEBAPP_NAME }} \
            --resource-group ${{ env.AZURE_RESOURCE_GROUP }} \
            2>&1 | tail -50 || true
          exit 1

      - name: Azure Logout
        if: always()
        run: az logout