deploy.yml

# ============================================================
# EDSTRATUM LABS — UNIFIED DEPLOY TEMPLATE
# ============================================================
# This workflow supports TWO deployment targets.
# Agents provisioning new projects MUST replace every
# occurrence of REPO-NAME with the actual repository name.
#
# HOSTING TARGETS:
#   - Cloudflare Pages:  Auto-builds on push to main via the
#     CF Pages Git integration. No workflow step required.
#     The CF Pages project must be connected to this repo in
#     the Cloudflare dashboard.
#
#   - Schubert (self-hosted):  Runs deploy-local (LAN runner)
#     or deploy-remote (Tailscale OAuth fallback).
#
# REQUIRED SECRETS (set via provision-repo.sh or playbook):
#   TS_OAUTH_CLIENT_ID   — Tailscale OAuth client ID
#   TS_OAUTH_SECRET      — Tailscale OAuth secret
#   SCHUBERT_SSH_KEY     — Base64-encoded SSH private key
# ============================================================

name: Deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      force_remote:
        description: 'Force remote deploy via Tailscale OAuth (use if self-hosted runner is offline)'
        required: false
        default: 'false'
        type: boolean

# Prevents run pile-up when the self-hosted runner is offline.
# New pushes cancel any queued or in-progress run for the same branch.
concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ── PRIMARY PATH ────────────────────────────────────────────
  # Runs directly on Schubert via the self-hosted runner.
  # No Tailscale, no SSH — LAN-native, fastest path.
  deploy-local:
    name: Deploy (self-hosted · LAN)
    runs-on: [self-hosted, schubert-local]
    if: ${{ github.event.inputs.force_remote != 'true' }}
    timeout-minutes: 10
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run deploy script
        run: |
          set -e
          cd /opt/REPO-NAME
          if [ -f .env ]; then
            cp .env /tmp/REPO-NAME.env.backup
          fi
          git pull origin main
          if [ -f /tmp/REPO-NAME.env.backup ]; then
            mv /tmp/REPO-NAME.env.backup .env
            chmod 600 .env
          fi
          sudo bash scripts/deploy.sh

  # ── FALLBACK PATH ───────────────────────────────────────────
  # Runs on a GitHub-hosted runner and connects to Schubert
  # over Tailscale OAuth. Use when the self-hosted runner is
  # offline (trigger via workflow_dispatch → force_remote: true).
  deploy-remote:
    name: Deploy (remote · Tailscale OAuth fallback)
    runs-on: ubuntu-latest
    if: ${{ github.event.inputs.force_remote == 'true' }}
    steps:
      - name: Validate required secrets
        run: |
          missing=""
          if [ -z "${{ secrets.TS_OAUTH_CLIENT_ID }}" ]; then
            missing="$missing TS_OAUTH_CLIENT_ID"
          fi
          if [ -z "${{ secrets.TS_OAUTH_SECRET }}" ]; then
            missing="$missing TS_OAUTH_SECRET"
          fi
          if [ -z "${{ secrets.SCHUBERT_SSH_KEY }}" ]; then
            missing="$missing SCHUBERT_SSH_KEY"
          fi
          if [ -n "$missing" ]; then
            echo "ERROR: Missing required secrets:$missing"
            exit 1
          fi
          echo "All required secrets present."

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Connect to Tailscale (OAuth · non-expiring)
        uses: tailscale/github-action@v3
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:ci
          args: --accept-routes

      - name: Write SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SCHUBERT_SSH_KEY }}" | base64 -d > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keygen -l -f ~/.ssh/deploy_key && echo "KEY VALID"

      - name: Deploy to Schubert (single SSH session)
        run: |
          ssh -i ~/.ssh/deploy_key \
            -o StrictHostKeyChecking=no \
            -o ConnectTimeout=30 \
            z121532@100.86.47.6 \
            'set -e
            cd /opt/REPO-NAME
            if [ -f .env ]; then cp .env /tmp/REPO-NAME.env.backup; fi
            git pull origin main
            if [ -f /tmp/REPO-NAME.env.backup ]; then mv /tmp/REPO-NAME.env.backup .env && chmod 600 .env; fi
            sudo bash scripts/deploy.sh'