deploy-pages.yml

name: Deploy Pages

on:
  # Deploy immediately when main is updated.
  push:
    branches:
      - main
  # Re-deploy whenever any service build finishes (on any branch).
  workflow_run:
    workflows: ["Spring API", "Python Help Service", "Python Recipe Service", "Web Client"]
    types: [completed]
  # Clean up coverage store when a PR is closed.
  pull_request:
    types: [closed]
  # Manual trigger to force-refresh all coverage for main.
  workflow_dispatch:

concurrency:
  group: pages
  cancel-in-progress: false

permissions:
  contents: write  # push to coverage-data store branch
  pages: write
  id-token: write
  actions: read    # download artifacts from other workflow runs

jobs:
  # ── Remove a closed PR's coverage from the store ───────────────────────────
  cleanup:
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: coverage-data
          path: store
        continue-on-error: true

      - name: Remove branch from store
        run: |
          [ -d store ] || exit 0
          KEY="${{ github.event.pull_request.head.ref }}"
          KEY="${KEY//\//-}"
          rm -rf "store/coverage/$KEY"
          cd store
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .
          git diff --staged --quiet || \
            git commit -m "Remove coverage: $KEY (PR #${{ github.event.pull_request.number }} closed)"
          git push origin coverage-data

  # ── Update coverage store and redeploy Pages ───────────────────────────────
  deploy:
    if: >
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'push' ||
      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/checkout@v4

      # ── Identify what triggered this run ─────────────────────────────────────
      - name: Set context
        run: |
          if [ "${{ github.event_name }}" = "workflow_run" ]; then
            BRANCH="${{ github.event.workflow_run.head_branch }}"
            echo "COVERAGE_KEY=${BRANCH//\//-}" >> $GITHUB_ENV
            case "${{ github.event.workflow_run.name }}" in
              "Spring API")             echo "ARTIFACT=spring-api-coverage"  && echo "SERVICE=spring-api" ;;
              "Python Help Service")    echo "ARTIFACT=help-service-coverage" && echo "SERVICE=py-help" ;;
              "Python Recipe Service")  echo "ARTIFACT=recipe-service-coverage" && echo "SERVICE=py-recipe" ;;
              "Web Client")             echo "ARTIFACT=web-client-coverage"   && echo "SERVICE=web-client" ;;
            esac >> $GITHUB_ENV
          else
            echo "COVERAGE_KEY=main" >> $GITHUB_ENV
          fi

      # ── Check out (or initialise) the coverage-data store branch ─────────────
      - uses: actions/checkout@v4
        id: checkout-store
        with:
          ref: coverage-data
          path: store
          fetch-depth: 1
        continue-on-error: true

      - name: Init store branch
        if: steps.checkout-store.outcome == 'failure'
        run: |
          mkdir store && cd store
          git init
          git remote add origin https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git
          git checkout -b coverage-data
          mkdir -p coverage
          git -c user.name="github-actions[bot]" -c user.email="github-actions[bot]@users.noreply.github.com" \
            commit --allow-empty -m "Initialize coverage store"

      # ── Download coverage ─────────────────────────────────────────────────────
      # workflow_run: download the one service that just built, from that exact run.
      - name: Download service coverage
        if: github.event_name == 'workflow_run'
        uses: dawidd6/action-download-artifact@v6
        with:
          run_id: ${{ github.event.workflow_run.id }}
          name: ${{ env.ARTIFACT }}
          path: store/coverage/${{ env.COVERAGE_KEY }}/${{ env.SERVICE }}
          if_no_artifact_found: ignore

      # push/workflow_dispatch: pull latest coverage for all services on main.
      - name: Download Spring API coverage
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        uses: dawidd6/action-download-artifact@v6
        with:
          workflow: build-spring-api.yml
          branch: main
          name: spring-api-coverage
          path: store/coverage/main/spring-api
          if_no_artifact_found: ignore

      - name: Download Help Service coverage
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        uses: dawidd6/action-download-artifact@v6
        with:
          workflow: build-help-service.yml
          branch: main
          name: help-service-coverage
          path: store/coverage/main/py-help
          if_no_artifact_found: ignore

      - name: Download Recipe Service coverage
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        uses: dawidd6/action-download-artifact@v6
        with:
          workflow: build-recipe-service.yml
          branch: main
          name: recipe-service-coverage
          path: store/coverage/main/py-recipe
          if_no_artifact_found: ignore

      - name: Download Web Client coverage
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        uses: dawidd6/action-download-artifact@v6
        with:
          workflow: build-client.yml
          branch: main
          name: web-client-coverage
          path: store/coverage/main/web-client
          if_no_artifact_found: ignore

      # ── Persist updated coverage to the store ────────────────────────────────
      - name: Commit to store
        run: |
          cd store
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .
          git diff --staged --quiet && echo "No coverage changes" && exit 0
          git commit -m "Update coverage: ${{ env.COVERAGE_KEY || 'main (rebuild)' }}"
          # Rebase in case another branch committed while we were running.
          REMOTE="https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git"
          git pull --rebase "$REMOTE" coverage-data 2>/dev/null || true
          git push "$REMOTE" HEAD:coverage-data

      # ── Assemble Pages site ───────────────────────────────────────────────────
      - name: Assemble site
        run: |
          mkdir -p site
          [ -d store/coverage ] && cp -r store/coverage/. site/

          # API docs
          npx --yes @redocly/cli@2.34.0 build-docs api/openapi.yaml --output site/api/index.html

          # Per-branch index (links to each service subfolder)
          for branch_dir in site/*/; do
            [ -d "$branch_dir" ] || continue
            branch=$(basename "$branch_dir")
            [ "$branch" = "api" ] && continue
            {
              printf '<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">'
              printf '<title>Coverage: %s</title>' "$branch"
              echo '<style>body{font-family:sans-serif;max-width:600px;margin:4rem auto}a{color:#0969da}ul{line-height:2}</style>'
              echo '</head><body>'
              printf '<h1>Coverage: %s</h1><p><a href="../">← All</a></p><ul>' "$branch"
              for svc_dir in "$branch_dir"*/; do
                [ -d "$svc_dir" ] || continue
                svc=$(basename "$svc_dir")
                printf '<li><a href="%s/">%s</a></li>' "$svc" "$svc"
              done
              echo '</ul></body></html>'
            } > "$branch_dir/index.html"
          done

          # Top-level index
          {
            echo '<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8">'
            echo '<title>Team DevSecOps</title>'
            echo '<style>body{font-family:sans-serif;max-width:600px;margin:4rem auto}a{color:#0969da}ul{line-height:2}h2{margin-top:2rem}</style>'
            echo '</head><body><h1>Team DevSecOps</h1>'
            echo '<h2>API</h2><ul><li><a href="api/">API Documentation</a></li></ul>'
            echo '<h2>Coverage</h2><ul>'
            for branch_dir in site/*/; do
              [ -d "$branch_dir" ] || continue
              branch=$(basename "$branch_dir")
              [ "$branch" = "api" ] && continue
              printf '<li><a href="%s/">%s</a></li>\n' "$branch" "$branch"
            done
            echo '</ul></body></html>'
          } > site/index.html

      # ── Deploy ────────────────────────────────────────────────────────────────
      - uses: actions/configure-pages@v5

      - uses: actions/upload-pages-artifact@v4
        with:
          path: site

      - id: deployment
        uses: actions/deploy-pages@v4