release.yml

name: Release Deployment
on:
  push:
    tags:
      - "v*"

permissions:
  contents: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  check-ci:
    name: Check CI
    uses: ./.github/workflows/ci.yml

  fly-deploy:
    name: Deploy fly app
    runs-on: ubuntu-latest
    needs: check-ci
    concurrency: deploy-group
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      # https://github.com/superfly/flyctl-actions
      # https://github.com/marketplace/actions/github-action-for-flyctl
      - name: Setup flyctl
        uses: superfly/flyctl-actions/setup-flyctl@master

      - name: Deploy app
        run: flyctl deploy --remote-only --build-arg GIT_COMMIT_ID=$(git log -1 --format="%H") --build-arg GIT_COMMIT_TIME=$(git log -1 --format="%ct")
        env:
          # https://github.com/superfly/flyctl-actions?tab=readme-ov-file#secrets
          # https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/#speed-run-your-way-to-continuous-deployment
          # gen cmd: fly tokens create deploy -x 999999h
          # set in Github Settings -> Secrets -> Actions -> Repository secrets
          # https://github.com/cao7113/hello-api-elixir/settings/secrets/actions
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

  push-images:
    name: Push Docker image to Docker Hub and Github Packages
    runs-on: ubuntu-latest
    needs: check-ci
    permissions:
      packages: write
      contents: read
      attestations: write
      id-token: write
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4
      - name: Set env
        run: |
          export GIT_COMMIT_TIME=$(git log -1 --format="%ct")

      # https://github.com/docker/login-action
      - name: Log in to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # https://github.com/docker/metadata-action
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            cao7113/hello-api-elixir
            ghcr.io/${{ github.repository }}

      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # https://github.com/docker/build-push-action?tab=readme-ov-file#customizing
          # GIT_COMMIT_TIME=$(git log -1 --format="%ct")
          build-args: |
            GIT_COMMIT_ID=${{ github.sha }} 
            GIT_COMMIT_TIME=${{ env.GIT_COMMIT_TIME }}

      # https://docs.github.com/en/actions/publishing-packages/publishing-docker-images#publishing-images-to-docker-hub
      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@v1
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true

  release-tar:
    # strategy:
    #   matrix:
    #     # erlef/setup-beam only supports Ubuntu and Windows at this time
    #     os: [ubuntu-latest]
    #     otp: [27.x]
    #     elixir: [1.17.x]
    name: Publish mix release tar
    runs-on: ubuntu-latest
    needs: check-ci
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Elixir
        uses: erlef/setup-beam@v1
        with:
          version-file: .tool-versions
          version-type: strict

      - name: Restore dependencies cache
        uses: actions/cache@v4
        with:
          path: deps
          key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.lock') }}
          restore-keys: ${{ runner.os }}-mix-

      - name: Install dependencies
        run: mix deps.get --only prod

      - name: Make mix release
        run: |
          export GIT_COMMIT_ID=${{ github.sha }}
          # export GIT_COMMIT_ID=$(git log -1 --format="%H")
          export GIT_COMMIT_TIME=$(git log -1 --format="%ct")
          MIX_ENV=prod RELEASE_TAR=1 mix release

      # https://github.com/softprops/action-gh-release
      - name: Make Github release
        uses: softprops/action-gh-release@v2
        if: startsWith(github.ref, 'refs/tags/')
        # todo: add runner.os & runner.arch info in final tar filename
        with:
          files: _build/prod/*.tar.gz

  # ssh-deploy:
  #   name: Deoloy to remote server by ssh
  #   runs-on: ubuntu-latest
  #   needs: release-tar
  #   steps:
  #     # https://github.com/appleboy/ssh-action
  #     # https://docs.github.com/en/actions/learn-github-actions/contexts#github-context
  #     - name: executing remote ssh commands
  #       uses: appleboy/ssh-action@v0.1.8
  #       with:
  #         host: ${{ secrets.REMOTE_HOST }}
  #         username: ${{ secrets.REMOTE_USERNAME }}
  #         key: ${{ secrets.REMOTE_PRIVKEY }}
  #         port: 22
  #         script: |
  #           vsn=${{ github.ref_name }}
  #           git_repo=${{ github.repository }}

  #           app_root=~/hello-api-elixir
  #           script_path=${app_root}/deploy.sh

  #           mkdir -p $app_root
  #           script_url="https://raw.githubusercontent.com/${git_repo}/main/run/deploy.sh"
  #           if [ ! -e $script_path ]; then
  #             wget -q -O $script_path $script_url
  #             chmod +x $script_path
  #             echo "Setup deploy-script into ${script_path} from ${script_url}"
  #           else
  #             echo "Use existed deploy-script: ${script_path}, manually delete it when need update"
  #           fi

  #           $script_path $vsn bin/hello_api ${git_repo} 3