check-build-deploy.yml

on:
  workflow_call:
    inputs:
      package:
        required: true
        type: string
      package_cap:
        required: true
        type: string
    secrets:
      PROD_CLOUD_SSH_URI:
        required: true
      PROD_CLOUD_SSH_HOST:
        required: true
      PROD_CLOUD_SSH_PORT:
        required: true
      PROD_CLOUD_SSH_KEY:
        required: true
      PROD_CLOUD_PROJECT_ROOT:
        required: true
      PROD_ASSETS_REPO_PAT:
      PROD_HOME_PM2_CONF_ENV:
      PROD_ADMIN_PM2_CONF_ENV:

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: 9
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
          check-latest: true
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Install dependencies
        run: pnpm install
      - name: Run ESLint
        run: 'pnpm run lint:${{ inputs.package }}'
      - name: Check types
        # vue-tsc always runs at the workspace root
        run: pnpm run typecheck

  build:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Checkout assets
        uses: actions/checkout@v4
        with:
          repository: ThrRip/mzg.fan-assets
          token: ${{ secrets.PROD_ASSETS_REPO_PAT }}
          path: mzg.fan-assets
      - name: Copy the assets out
        run: cp -r mzg.fan-assets/* .
      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: 9
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
          check-latest: true
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml
      - name: Setup utilities
        run: |
          sudo apt-get update
          sudo apt-get -y install zstd
      - name: Install dependencies
        run: pnpm -F ${{ inputs.package }} install
      - name: Build standalone server
        run: 'pnpm run build:${{ inputs.package }}'
      - name: Replace environment variables
        run: |
          [ -z "${{ secrets[format('PROD_{0}_PM2_CONF_ENV', inputs.package_cap)] }}" ] || (
            temp=$(mktemp)
            echo "${{ secrets[format('PROD_{0}_PM2_CONF_ENV', inputs.package_cap)] }}" |
              awk '
                /env: {/,/}/ {
                  if (/env: {/ || /}/) print;
                  while((getline < "/dev/stdin") > 0) print;
                  next
                }
                { print }
              ' packages/${{ inputs.package }}/ecosystem.config.js > "$temp"
            cp --no-preserve=all "$temp" packages/${{ inputs.package }}/ecosystem.config.js
            rm -f "$temp"
          )
      - name: Package the build
        run: |
          cd packages/${{ inputs.package }}
          tar -cvf build.tar .output ecosystem.config.js
          zstd -11 -T0 build.tar
      - name: Store the build as an artifact
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ github.ref_name }}_${{ inputs.package }}-${{ github.sha }}
          path: packages/${{ inputs.package }}/build.tar.zst
          compression-level: 0

  deploy-prod:
    name: Deploy to production
    if: github.repository == 'ThrRip/mzg.fan' && github.ref == 'refs/heads/main'
    needs: [check, build]
    concurrency: deploy-prod-${{ github.ref }}-${{ inputs.package }}
    runs-on: ubuntu-latest
    env:
      MASKING_PROD_CLOUD_SSH_HOST: ${{ secrets.PROD_CLOUD_SSH_HOST }}
    steps:
      - name: Setup utilities
        run: |
          sudo apt-get update
          sudo apt-get -y install rsync
      - name: Retrieve the build
        uses: actions/download-artifact@v4
        with:
          name: build-${{ github.ref_name }}_${{ inputs.package }}-${{ github.sha }}
      - name: Retrieve the SSH key
        run: |
          mkdir ~/.ssh
          chmod 700 ~/.ssh
          echo "${{ secrets.PROD_CLOUD_SSH_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
      - name: Upload the build
        run: |
          rsync -ahP \
            -e "ssh -i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -p ${{ secrets.PROD_CLOUD_SSH_PORT }}" \
            build.tar.zst \
            ${{ secrets.PROD_CLOUD_SSH_URI }}:"${{ secrets.PROD_CLOUD_PROJECT_ROOT }}/${{ inputs.package }}"
      - name: Replace the last build
        run: |
          ssh \
            -i ~/.ssh/id_ed25519 \
            -o StrictHostKeyChecking=no \
            -p ${{ secrets.PROD_CLOUD_SSH_PORT }} \
            ${{ secrets.PROD_CLOUD_SSH_URI }} <<END
          set -e
          cd "${{ secrets.PROD_CLOUD_PROJECT_ROOT }}/${{ inputs.package }}"
          pm2 delete mzg.fan-${{ inputs.package }}
          rm -fr .output ecosystem.config.js
          zstd -d build.tar.zst
          tar -xvf build.tar
          rm -f build.tar.zst build.tar
          pm2 start ecosystem.config.js
          pm2 save
          END