deploy.yaml

name: Build & Deploy to Civo K3s

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }}

jobs:
  # ── Build all Docker images in parallel ────────────────────────────────────
  build-core:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    strategy:
      matrix:
        binary:
          - tracker-core
          - stats-consumer
          - webhook-consumer
          - sse-gateway
          - risingwave-consumer
          - r2-archiver
          - event-filter
    steps:
      - uses: actions/checkout@v4

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/Dockerfile.core
          build-args: BINARY=${{ matrix.binary }}
          push: true
          tags: |
            ${{ env.IMAGE_PREFIX }}/${{ matrix.binary }}:latest
            ${{ env.IMAGE_PREFIX }}/${{ matrix.binary }}:${{ github.sha }}
          cache-from: type=gha,scope=${{ matrix.binary }}
          cache-to: type=gha,mode=max,scope=${{ matrix.binary }}

  build-polars-query:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/Dockerfile.polars-query
          push: true
          tags: |
            ${{ env.IMAGE_PREFIX }}/polars-query:latest
            ${{ env.IMAGE_PREFIX }}/polars-query:${{ github.sha }}
          cache-from: type=gha,scope=polars-query
          cache-to: type=gha,mode=max,scope=polars-query

  build-polars-lite:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/Dockerfile.polars-lite
          push: true
          tags: |
            ${{ env.IMAGE_PREFIX }}/polars-lite:latest
            ${{ env.IMAGE_PREFIX }}/polars-lite:${{ github.sha }}
          cache-from: type=gha,scope=polars-lite
          cache-to: type=gha,mode=max,scope=polars-lite

  build-ai-query:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/setup-buildx-action@v3

      - uses: docker/build-push-action@v5
        with:
          context: .
          file: docker/Dockerfile.ai-query
          push: true
          tags: |
            ${{ env.IMAGE_PREFIX }}/ai-query:latest
            ${{ env.IMAGE_PREFIX }}/ai-query:${{ github.sha }}
          cache-from: type=gha,scope=ai-query
          cache-to: type=gha,mode=max,scope=ai-query

  # ── Deploy to Civo K3s ────────────────────────────────────────────────────
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    needs:
      - build-core
      - build-polars-query
      - build-polars-lite
      - build-ai-query
    steps:
      - uses: actions/checkout@v4

      - name: Install kubectl
        uses: azure/setup-kubectl@v3

      - name: Set kubeconfig
        run: |
          mkdir -p $HOME/.kube
          echo "${{ secrets.CIVO_KUBECONFIG }}" | base64 -d > $HOME/.kube/config

      - name: Create/update ghcr.io pull secret
        run: |
          kubectl -n tracker delete secret ghcr-pull-secret --ignore-not-found
          kubectl -n tracker create secret docker-registry ghcr-pull-secret \
            --docker-server=ghcr.io \
            --docker-username=${{ github.actor }} \
            --docker-password=${{ secrets.GHCR_PAT }}

      - name: Create/update tracker-secrets
        run: |
          kubectl -n tracker delete secret tracker-secrets --ignore-not-found
          kubectl -n tracker create secret generic tracker-secrets \
            --from-literal=HMAC_SECRET="${{ secrets.HMAC_SECRET }}" \
            --from-literal=PLATFORM_API_KEY="${{ secrets.PLATFORM_API_KEY }}" \
            --from-literal=ADMIN_API_KEY="${{ secrets.ADMIN_API_KEY }}" \
            --from-literal=TURSO_URL="${{ secrets.TURSO_URL }}" \
            --from-literal=TURSO_AUTH_TOKEN="${{ secrets.TURSO_AUTH_TOKEN }}" \
            --from-literal=RISINGWAVE_URL="${{ secrets.RISINGWAVE_URL }}" \
            --from-literal=R2_ENDPOINT="${{ secrets.R2_ENDPOINT }}" \
            --from-literal=R2_ACCESS_KEY_ID="${{ secrets.R2_ACCESS_KEY_ID }}" \
            --from-literal=R2_SECRET_ACCESS_KEY="${{ secrets.R2_SECRET_ACCESS_KEY }}" \
            --from-literal=LANCEDB_API_KEY="${{ secrets.LANCEDB_API_KEY }}" \
            --from-literal=SLM_API_KEY="${{ secrets.SLM_API_KEY }}"

      - name: Update image tags in manifests
        run: |
          cd k8s
          # Pin only our ghcr.io images to current commit SHA (leave iggyrs/iggy:latest alone)
          sed -i "s|ghcr.io/inventhq/\([^:]*\):latest|ghcr.io/inventhq/\1:${{ github.sha }}|g" *.yaml

      - name: Apply manifests
        run: |
          kubectl apply -k k8s/
          kubectl apply -f k8s/cert-manager.yaml
          kubectl apply -f k8s/ingress.yaml

      - name: Wait for rollout
        run: |
          kubectl -n tracker rollout status deployment/tracker-core --timeout=300s
          kubectl -n tracker rollout status deployment/sse-gateway --timeout=300s
          kubectl -n tracker rollout status deployment/event-filter --timeout=300s
          kubectl -n tracker rollout status deployment/stats-consumer --timeout=300s
          kubectl -n tracker rollout status deployment/webhook-consumer --timeout=300s
          kubectl -n tracker rollout status deployment/risingwave-consumer --timeout=300s
          kubectl -n tracker rollout status deployment/r2-archiver --timeout=300s
          kubectl -n tracker rollout status deployment/polars-query --timeout=300s
          kubectl -n tracker rollout status deployment/polars-lite --timeout=300s
          kubectl -n tracker rollout status deployment/ai-query --timeout=300s
          kubectl -n tracker rollout status statefulset/iggy --timeout=300s

      - name: Verify health
        run: |
          # Give services a moment to stabilize
          sleep 10
          kubectl -n tracker get pods
          kubectl -n tracker get svc