mathew/.gitea/workflows/deploy.yml

name: Build and Deploy

on:
  push:
    branches: [master]
  workflow_dispatch:

jobs:
  # One file, two lifecycles. The app pair (frontend + backend) moves with
  # most commits; the lean image carries Mathlib and is heavy to build and
  # push, so its job runs only when lean/** actually changed. This step reads
  # the pushed diff and opens the gates for the jobs below.
  changes:
    runs-on: docker

    outputs:
      app: ${{ steps.filter.outputs.app }}
      lean: ${{ steps.filter.outputs.lean }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: What changed?
        id: filter
        env:
          BEFORE: ${{ github.event.before }}
          AFTER: ${{ github.event.after }}
        run: |
          # Manual runs, first pushes or rewritten history carry no usable
          # "before" commit — rebuild everything rather than guess.
          if [ -z "${BEFORE}" ] || [ -z "${BEFORE//0/}" ] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
            echo "app=yes" >> "$GITHUB_OUTPUT"
            echo "lean=yes" >> "$GITHUB_OUTPUT"
            echo "app=yes lean=yes (no usable before-commit)"
            exit 0
          fi
          changed=$(git diff --name-only "$BEFORE" "$AFTER")
          lean=no
          app=no
          if [ -n "$changed" ]; then
            if echo "$changed" | grep -q '^lean/'; then lean=yes; fi
            if echo "$changed" | grep -qvx 'lean/.*'; then app=yes; fi
          fi
          echo "app=$app" >> "$GITHUB_OUTPUT"
          echo "lean=$lean" >> "$GITHUB_OUTPUT"
          echo "app=$app lean=$lean"

  # The wiki app itself — its deploy step never touches the lean service.
  deploy:
    runs-on: docker
    needs: changes
    if: needs.changes.outputs.app == 'yes'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install SSH client
        run: |
          apt-get update -y && apt-get install -y openssh-client

      - name: Setup SSH inside container
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

          # Add the container host to known_hosts
          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts

      - name: Log in to registry
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin

      - name: Build frontend
        run: |
          docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-frontend:latest ./frontend
          docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-frontend:latest

      - name: Build backend
        run: |
          docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-backend:latest ./backend
          docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-backend:latest

      - name: Copy files
        run: |
          scp docker-compose.yml deploy@${{ secrets.DEPLOY_HOST }}:/var/www/app/
          scp nginx.conf deploy@${{ secrets.DEPLOY_HOST }}:/var/www/app/nginx.conf

      # Scoped to the services this job owns: never pulls/builds lean from
      # here (that would need the lean tag or lean/ sources on the host).
      # deploy-lean.yml owns the lean service's pull and up.
      - name: Deploy
        run: |
          ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
            echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
            cd /var/www/app/
            docker compose pull nginx frontend backend
            docker compose up -d frontend backend nginx
          EOF

  # The Lean editor (lean4web): multi-stage, heavy by nature (it fetches
  # Mathlib); expect a long build and a multi-GB push. Pin upstream with:
  #   docker build --build-arg LEAN4WEB_REF=v0.2.2 ...
  deploy-lean:
    runs-on: docker
    needs: changes
    if: needs.changes.outputs.lean == 'yes'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install SSH client
        run: |
          apt-get update -y && apt-get install -y openssh-client

      - name: Setup SSH inside container
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

          # Add the container host to known_hosts
          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts

      - name: Log in to registry
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin

      - name: Build lean editor server
        run: |
          docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest ./lean
          docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest

      - name: Deploy
        run: |
          ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
            echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
            cd /var/www/app/
            docker compose pull lean
            docker compose up -d lean
          EOF