cd.yml

# ==============================================================================
# CD — Build, Push & Deploy to Cloud Run (Production)
# Pipeline: CI Check → Build → Deploy Production → Smoke Test → Notify
# Rollback: automatic if production smoke test fails.
# Requires secrets: GCP_PROJECT_ID, GCP_SA_KEY, GCS_BUCKET, API_KEY
# ==============================================================================

name: CD

on:
  push:
    branches: [main]
    paths-ignore:
      - '*.md'
      - '**/*.md'
      - '**/*.gif'
      - '**/*.mp4'
      - '**/*.png'
      - '**/*.jpg'
      - '**/*.jpeg'
      - '**/*.svg'
      - '**/*.pptx'
      - '**/*.docx'
      - '**/*.pdf'
      - '**/*.txt'
      - 'docs/**'
      - 'images/**'
      - 'LICENSE'

  workflow_dispatch:
    inputs:
      image_tag:
        description: "Image tag to deploy (commit SHA or 'latest' to build fresh)"
        required: false
        default: "latest"
      memory:
        description: "Cloud Run memory allocation"
        required: false
        default: "1Gi"
        type: choice
        options:
          - 512Mi
          - 1Gi
          - 2Gi

concurrency:
  group: cd-${{ github.ref }}
  cancel-in-progress: false

env:
  REGION: europe-west1
  SERVICE: ai-product-detector
  REGISTRY: europe-west1-docker.pkg.dev
  IMAGE: europe-west1-docker.pkg.dev/ai-product-detector-487013/ai-product-detector/api

jobs:
  # --------------------------------------------------------------------------
  # Wait for CI to pass (on push events)
  # --------------------------------------------------------------------------
  ci-check:
    name: Wait for CI
    runs-on: ubuntu-latest
    if: github.event_name == 'push'

    permissions:
      checks: read

    steps:
      - name: Check if CI workflow was triggered
        id: ci-exists
        run: |
          # Wait a bit for CI to register
          sleep 10
          # Check if CI workflow run exists for this commit
          CI_RUN=$(gh run list --workflow=ci.yml --commit=${{ github.sha }} --limit=1 --json status --jq '.[0].status // empty' 2>/dev/null || echo "")
          if [ -z "$CI_RUN" ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
            echo "CI was not triggered (docs-only change) — skipping wait"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
            echo "CI is running — will wait for it"
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Wait for CI workflow
        if: steps.ci-exists.outputs.skip != 'true'
        uses: lewagon/wait-on-check-action@v1.5.0
        with:
          ref: ${{ github.sha }}
          running-workflow-name: "Wait for CI"
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          check-regexp: "^Lint, Type Check & Tests"
          wait-interval: 15
          allowed-conclusions: success,skipped

  # --------------------------------------------------------------------------
  # Build & Push Docker Image
  # --------------------------------------------------------------------------
  build:
    name: Build & Push Docker Image
    runs-on: ubuntu-latest
    needs: [ci-check]
    if: always() && (needs.ci-check.result == 'success' || github.event_name == 'workflow_dispatch')

    permissions:
      contents: read
      id-token: write

    outputs:
      image_tag: ${{ steps.tag.outputs.tag }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Configure Docker for Artifact Registry
        run: gcloud auth configure-docker ${{ env.REGISTRY }} --quiet

      - name: Fetch model checkpoint
        run: |
          LOCAL_MODEL="models/checkpoints/best_model.pt"
          GCS_MODEL="gs://${{ secrets.GCS_BUCKET }}/models/best_model.pt"
          mkdir -p models/checkpoints

          if gsutil ls "${GCS_MODEL}" > /dev/null 2>&1; then
            echo "Found model on GCS. Downloading..."
            gsutil cp "${GCS_MODEL}" "${LOCAL_MODEL}"
            echo "Downloaded from GCS."
          fi

          if [ ! -f "${LOCAL_MODEL}" ]; then
            echo "No model on GCS. Trying DVC pull..."
            pip install dvc[gs] -q
            dvc pull models/checkpoints/best_model.pt.dvc -f || true
          fi

          if [ -f "${LOCAL_MODEL}" ]; then
            SIZE=$(stat -c%s "${LOCAL_MODEL}")
            echo "Model ready: ${LOCAL_MODEL} (${SIZE} bytes)"
          else
            echo "ERROR: No model checkpoint available!"
            exit 1
          fi

      - name: Determine image tag
        id: tag
        run: |
          if [ "${{ github.event.inputs.image_tag }}" != "" ] && [ "${{ github.event.inputs.image_tag }}" != "latest" ]; then
            TAG="${{ github.event.inputs.image_tag }}"
            echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
            echo "skip_build=true" >> "$GITHUB_OUTPUT"
          else
            TAG="${{ github.sha }}"
            echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
            echo "skip_build=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Set up Docker Buildx
        if: steps.tag.outputs.skip_build == 'false'
        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        if: steps.tag.outputs.skip_build == 'false'
        run: |
          docker build -f docker/Dockerfile \
            -t ${{ env.IMAGE }}:${{ steps.tag.outputs.tag }} \
            -t ${{ env.IMAGE }}:latest .
          docker push ${{ env.IMAGE }}:${{ steps.tag.outputs.tag }}
          docker push ${{ env.IMAGE }}:latest

      - name: Build summary
        run: |
          echo "### Docker Image" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Image:** \`${{ env.IMAGE }}:${{ steps.tag.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"

  # --------------------------------------------------------------------------
  # Deploy to Production
  # --------------------------------------------------------------------------
  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [build]
    if: always() && needs.build.result == 'success'

    permissions:
      contents: read
      id-token: write

    environment:
      name: production
      url: ${{ steps.url.outputs.url }}

    outputs:
      url: ${{ steps.url.outputs.url }}
      previous_revision: ${{ steps.pre-deploy.outputs.previous_revision }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Capture current production revision
        id: pre-deploy
        run: |
          PREV=$(gcloud run services describe ${{ env.SERVICE }} \
            --region=${{ env.REGION }} \
            --format='value(status.latestReadyRevisionName)' 2>/dev/null || echo "none")
          echo "previous_revision=${PREV}" >> "$GITHUB_OUTPUT"
          echo "Current production revision: ${PREV}"

      - name: Deploy to Cloud Run (Production)
        run: |
          MEMORY="${{ github.event.inputs.memory || '1Gi' }}"
          gcloud run deploy ${{ env.SERVICE }} \
            --image=${{ format('{0}:{1}', env.IMAGE, needs.build.outputs.image_tag) }} \
            --region=${{ env.REGION }} \
            --port=8080 \
            --memory="${MEMORY}" \
            --allow-unauthenticated \
            --set-env-vars="REQUIRE_AUTH=false,ENVIRONMENT=production" \
            --quiet

      - name: Get production URL
        id: url
        run: |
          URL=$(gcloud run services describe ${{ env.SERVICE }} \
            --region=${{ env.REGION }} \
            --format='value(status.url)')
          echo "url=${URL}" >> "$GITHUB_OUTPUT"

      - name: Production deployment summary
        run: |
          echo "### Deployed to Production" >> "$GITHUB_STEP_SUMMARY"
          echo "- **URL:** ${{ steps.url.outputs.url }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Image:** \`${{ needs.build.outputs.image_tag }}\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Region:** ${{ env.REGION }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Previous revision:** \`${{ steps.pre-deploy.outputs.previous_revision }}\`" >> "$GITHUB_STEP_SUMMARY"

  # --------------------------------------------------------------------------
  # Smoke Test Production (with automatic rollback on failure)
  # --------------------------------------------------------------------------
  smoke-test-production:
    name: Smoke Test (Production)
    runs-on: ubuntu-latest
    needs: [deploy-production]

    outputs:
      status: ${{ steps.smoke.outputs.status }}

    steps:
      - name: Run production smoke tests
        id: smoke
        run: |
          URL="${{ needs.deploy-production.outputs.url }}"
          echo "Running smoke tests against production: ${URL}"

          echo "Waiting 20s for service to stabilize..."
          sleep 20

          FAILED=0

          echo "--- Test 1: Health endpoint ---"
          STATUS=$(curl -s -o /tmp/health -w "%{http_code}" "${URL}/health" --max-time 60)
          if [ "$STATUS" = "200" ]; then
            echo "Health check passed (HTTP ${STATUS})"
          else
            echo "Health check failed (HTTP ${STATUS})"
            cat /tmp/health
            FAILED=1
          fi

          echo "--- Test 2: Docs endpoint ---"
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${URL}/docs" --max-time 30)
          if [ "$STATUS" = "200" ]; then
            echo "Docs endpoint passed (HTTP ${STATUS})"
          else
            echo "Docs endpoint failed (HTTP ${STATUS})"
            FAILED=1
          fi

          echo "--- Test 3: Predict endpoint responsiveness ---"
          STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST "${URL}/predict" --max-time 30)
          if [ "$STATUS" -lt 500 ]; then
            echo "Predict endpoint responsive (HTTP ${STATUS})"
          else
            echo "Predict endpoint server error (HTTP ${STATUS})"
            FAILED=1
          fi

          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "### Production Smoke Tests" >> "$GITHUB_STEP_SUMMARY"
          if [ "$FAILED" -eq 0 ]; then
            echo "status=success" >> "$GITHUB_OUTPUT"
            echo "All smoke tests passed" >> "$GITHUB_STEP_SUMMARY"
            echo "- **URL:** ${URL}" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "status=failure" >> "$GITHUB_OUTPUT"
            echo "Production smoke tests failed - triggering rollback" >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

  # --------------------------------------------------------------------------
  # Automatic Rollback (if production smoke test fails)
  # --------------------------------------------------------------------------
  rollback:
    name: Rollback Production
    runs-on: ubuntu-latest
    needs: [deploy-production, smoke-test-production]
    if: failure() && needs.smoke-test-production.result == 'failure'

    steps:
      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Rollback to previous revision
        run: |
          PREV_REVISION="${{ needs.deploy-production.outputs.previous_revision }}"

          if [ "${PREV_REVISION}" = "none" ] || [ -z "${PREV_REVISION}" ]; then
            echo "No previous revision to rollback to"
            echo "### Rollback Skipped" >> "$GITHUB_STEP_SUMMARY"
            echo "No previous revision available for rollback." >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi

          echo "Rolling back to revision: ${PREV_REVISION}"
          gcloud run services update-traffic ${{ env.SERVICE }} \
            --region=${{ env.REGION }} \
            --to-revisions="${PREV_REVISION}=100" \
            --quiet

          echo "### Rollback Executed" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Rolled back to:** \`${PREV_REVISION}\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Reason:** Production smoke test failed" >> "$GITHUB_STEP_SUMMARY"

      - name: Verify rollback
        run: |
          sleep 10
          URL=$(gcloud run services describe ${{ env.SERVICE }} \
            --region=${{ env.REGION }} \
            --format='value(status.url)')

          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${URL}/health" --max-time 30)
          if [ "$STATUS" = "200" ]; then
            echo "Rollback verified - service is healthy"
            echo "- **Post-rollback health:** Healthy" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "Service still unhealthy after rollback (HTTP ${STATUS})"
            echo "- **Post-rollback health:** Still unhealthy (HTTP ${STATUS})" >> "$GITHUB_STEP_SUMMARY"
          fi

  # --------------------------------------------------------------------------
  # Notify
  # --------------------------------------------------------------------------
  notify:
    name: Deployment Notification
    runs-on: ubuntu-latest
    needs: [build, deploy-production, smoke-test-production]
    if: always()

    steps:
      - name: Deployment result summary
        run: |
          echo "### Deployment Pipeline Summary" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Stage | Result |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Build | ${{ needs.build.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Deploy Production | ${{ needs.deploy-production.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Smoke Test Prod | ${{ needs.smoke-test-production.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"

          if [ "${{ needs.smoke-test-production.result }}" = "success" ]; then
            echo "> **Deployment successful!**" >> "$GITHUB_STEP_SUMMARY"
            echo "> URL: ${{ needs.deploy-production.outputs.url }}" >> "$GITHUB_STEP_SUMMARY"
          elif [ "${{ needs.smoke-test-production.result }}" = "failure" ]; then
            echo "> **Deployment failed - automatic rollback triggered**" >> "$GITHUB_STEP_SUMMARY"
          else
            echo "> **Deployment status: ${{ needs.smoke-test-production.result }}**" >> "$GITHUB_STEP_SUMMARY"
          fi

          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "**Commit:** \`${{ github.sha }}\`" >> "$GITHUB_STEP_SUMMARY"
          echo "**Triggered by:** ${{ github.actor }}" >> "$GITHUB_STEP_SUMMARY"
          echo "**Image tag:** \`${{ needs.build.outputs.image_tag }}\`" >> "$GITHUB_STEP_SUMMARY"