deploy.yml

name: Production Pipeline

on:
  push:
    branches: [wagwan, production]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ secrets.AWS_REGION }}

      - id: ecr-login
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push API image
        run: |
          docker build -t ${{ steps.ecr-login.outputs.registry }}/locsafe-api:${{ github.sha }} \
                       -t ${{ steps.ecr-login.outputs.registry }}/locsafe-api:latest ./api
          docker push ${{ steps.ecr-login.outputs.registry }}/locsafe-api --all-tags

      - name: Deploy to EC2
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USER }}
          key: ${{ secrets.EC2_SSH_KEY }}
          port: ${{ secrets.EC2_PORT }}
          script: |
            cd /home/ubuntu/locsafe
            git pull origin ${{ github.ref_name }}
            
            # Build frontend
            npm ci && npm run build
            
            # Update env and deploy
            echo "${{ secrets.ENV_FILE }}" > ./api/.env
            
            aws ecr get-login-password --region ${{ secrets.AWS_REGION }} | \
              docker login --username AWS --password-stdin ${{ steps.ecr-login.outputs.registry }}
            
            docker compose -f docker-compose.prod.yml pull
            docker compose -f docker-compose.prod.yml up -d --remove-orphans
            
            # Health check
            sleep 15
            curl -f http://localhost:8080/api/v1/health || exit 1