vibe-code-stack-for-ceos/.github/workflows/deploy.yml at main · NoahDuongMaster/vibe-code-stack-for-ceos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: Deploy

# A single environment-aware job prevents staging/production drift. Deploys
# remain gated on the exact commit that passed the CI workflow.
on:
  workflow_run:
    workflows: ["CI"]
    types: [completed]
    branches: [main, develop]

permissions:
  contents: read
  # id-token: write # Re-enable together with FULL_STACK_DEPLOY_ENABLED.

concurrency:
  group: deploy-${{ github.event.workflow_run.head_branch }}
  cancel-in-progress: ${{ github.event.workflow_run.head_branch != 'main' }}

jobs:
  deploy:
    name: Deploy (${{ github.event.workflow_run.head_branch == 'main' && 'production' || 'staging' }})
    if: >
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.head_repository.full_name == github.repository &&
      (github.event.workflow_run.head_branch == 'main' ||
      github.event.workflow_run.head_branch == 'develop')
    runs-on: ubuntu-latest
    environment:
      name: ${{ github.event.workflow_run.head_branch == 'main' && 'production' || 'staging' }}
    timeout-minutes: 60
    env:
      # Landing is the only active deployment. Full-stack orchestration remains
      # available as a guarded composite action for later re-enablement.
      FULL_STACK_DEPLOY_ENABLED: 'false'
      DEPLOY_ENVIRONMENT: ${{ github.event.workflow_run.head_branch == 'main' && 'production' || 'staging' }}
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
    steps:
      - name: Checkout deployed commit
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: Setup toolchain
        uses: ./.github/actions/setup-toolchain

      - name: Deploy landing only
        if: env.FULL_STACK_DEPLOY_ENABLED != 'true'
        uses: ./.github/actions/deploy-landing
        with:
          environment: ${{ env.DEPLOY_ENVIRONMENT }}
          public-site-url: ${{ vars.PUBLIC_SITE_URL }}
          public-sentry-dsn: ${{ vars.PUBLIC_SENTRY_DSN }}

      - name: Deploy full stack
        if: env.FULL_STACK_DEPLOY_ENABLED == 'true'
        uses: ./.github/actions/deploy-full-stack
        with:
          environment: ${{ env.DEPLOY_ENVIRONMENT }}
          commit-sha: ${{ github.event.workflow_run.head_sha }}
          admin-pages-project: ${{ github.event.workflow_run.head_branch == 'main' && 'ai-first-admin' || 'ai-first-admin-staging' }}
          public-site-url: ${{ vars.PUBLIC_SITE_URL }}
          public-sentry-dsn: ${{ vars.PUBLIC_SENTRY_DSN }}
        env:
          NEXT_PUBLIC_PROJECT_NAME: ${{ vars.NEXT_PUBLIC_PROJECT_NAME }}
          NEXT_PUBLIC_API_ENDPOINT: ${{ vars.NEXT_PUBLIC_API_ENDPOINT }}
          NEXT_PUBLIC_BASE_URL: ${{ vars.NEXT_PUBLIC_BASE_URL }}
          ADMIN_PUBLIC_URL: ${{ vars.ADMIN_PUBLIC_URL }}
          PUBLIC_API_URL: ${{ vars.PUBLIC_API_URL }}
          PUBLIC_SENTRY_DSN: ${{ vars.PUBLIC_SENTRY_DSN }}
          SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
          DEMO_AUTH_EMAIL: ${{ secrets.DEMO_AUTH_EMAIL }}
          DEMO_AUTH_PASSWORD: ${{ secrets.DEMO_AUTH_PASSWORD }}
          GATEWAY_CORS_ORIGINS: ${{ vars.GATEWAY_CORS_ORIGINS }}
          AWS_REGION: ${{ vars.AWS_REGION }}
          AWS_RPC_DEPLOY_ROLE_ARN: ${{ vars.AWS_RPC_DEPLOY_ROLE_ARN }}
          TF_STATE_BUCKET: ${{ vars.TF_STATE_BUCKET }}
          TF_STATE_KMS_KEY_ARN: ${{ vars.TF_STATE_KMS_KEY_ARN }}
          ADMIN_AUTH_EMAIL: ${{ secrets.ADMIN_AUTH_EMAIL }}
          ADMIN_AUTH_PASSWORD: ${{ secrets.ADMIN_AUTH_PASSWORD }}
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
          COINGECKO_API_KEY: ${{ secrets.COINGECKO_API_KEY }}
          ADMIN_RPC_SENTRY_DSN: ${{ secrets.ADMIN_RPC_SENTRY_DSN }}
          TRADING_RPC_SENTRY_DSN: ${{ secrets.TRADING_RPC_SENTRY_DSN }}
          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
          POSTGRES_REPLICATION_PASSWORD: ${{ secrets.POSTGRES_REPLICATION_PASSWORD }}
          R2_PITR_BUCKET: ${{ vars.R2_PITR_BUCKET }}
          R2_PITR_ACCESS_KEY_ID: ${{ secrets.R2_PITR_ACCESS_KEY_ID }}
          R2_PITR_SECRET_ACCESS_KEY: ${{ secrets.R2_PITR_SECRET_ACCESS_KEY }}
          R2_ARCHIVE_BUCKET: ${{ vars.R2_ARCHIVE_BUCKET }}
          R2_ARCHIVE_ACCESS_KEY_ID: ${{ secrets.R2_ARCHIVE_ACCESS_KEY_ID }}
          R2_ARCHIVE_SECRET_ACCESS_KEY: ${{ secrets.R2_ARCHIVE_SECRET_ACCESS_KEY }}
          PGBACKREST_CIPHER_PASSPHRASE: ${{ secrets.PGBACKREST_CIPHER_PASSPHRASE }}
          POSTGRES_ARCHIVE_AGE_RECIPIENT: ${{ vars.POSTGRES_ARCHIVE_AGE_RECIPIENT }}
          POSTGRES_BACKUP_AGE_IDENTITY: ${{ secrets.POSTGRES_BACKUP_AGE_IDENTITY }}
          NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
          SENTRY_ORG: ${{ vars.SENTRY_ORG }}
          SENTRY_PROJECT: ${{ vars.SENTRY_PROJECT }}
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}