deploy.yml

name: Deploy to Homelab

on:
  push:
    branches: [ "master", "org" ]
  # Run the lint gate on PRs too, so code is validated BEFORE it merges
  # (branch protection requires a PR but had no status check to enforce).
  # Build/deploy stay push-only — see the `if:` guards on those jobs.
  pull_request:
    branches: [ "master", "org" ]

env:
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # ------------------------------------------------------------------
  # ЭТАП 1: ПРОВЕРКА КОДА (CI)
  # ------------------------------------------------------------------
  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install flake8
          # Если есть зависимости, нужные для линтинга, можно их поставить,
          # но для flake8 обычно достаточно самого кода.

      - name: Lint with flake8
        run: |
          # stop the build if there are Python syntax errors or undefined names
          flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
          # exit-zero treats all errors as warnings.
          flake8 . --count --exit-zero --max-complexity=10 --max-line-length=120 --statistics

  # ------------------------------------------------------------------
  # ЭТАП 2: СБОРКА И ПУШ ОБРАЗА (CD - Build)
  # ------------------------------------------------------------------
  build-and-push:
    needs: lint
    # Never build/push from a pull_request event — only on push to a deploy
    # branch. On PRs this job (and deploy below) is skipped; lint still runs.
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      # Immutable content digest of the pushed image. Deploy pins to this
      # (not the mutable :latest tag) so a retagged image cannot be pulled.
      digest: ${{ steps.build.outputs.digest }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=latest
            type=sha

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  # ------------------------------------------------------------------
  # ЭТАП 3: ДЕПЛОЙ НА HOMELAB (CD - Deploy)
  # ------------------------------------------------------------------
  deploy:
    needs: build-and-push
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - name: Connect to Tailscale
        uses: tailscale/github-action@v2
        with:
          authkey: ${{ secrets.TAILSCALE_AUTHKEY }}

      - name: Execute remote ssh commands using key
        uses: appleboy/ssh-action@master
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.SSH_USERNAME }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          timeout: 30m
          command_timeout: 30m
          script: |
            REPO_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
            # Pin to the immutable content digest built by this run, not the
            # mutable :latest tag. A retagged/poisoned :latest cannot be pulled.
            IMAGE_URL="ghcr.io/$REPO_LOWER@${{ needs.build-and-push.outputs.digest }}"

            echo "Deploying $IMAGE_URL..."

            echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin

            docker pull $IMAGE_URL

            docker stop netwho || true
            docker rm netwho || true

            docker run -d \
              --name netwho \
              --restart unless-stopped \
              --env-file /opt/apps/netwho_bot/.env \
              $IMAGE_URL

            docker image prune -f