WealthySmart/.github/workflows/deploy.yml

name: Deploy to VPS

on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: self-hosted

    steps:
      - uses: actions/checkout@v4

      - name: Backend tests
        run: |
          cd backend
          python3 -m venv /tmp/test-venv
          /tmp/test-venv/bin/pip install --quiet -r requirements.txt -r requirements-dev.txt -c constraints.txt
          /tmp/test-venv/bin/python -m pytest tests/ -q

      - name: Frontend typecheck + API type drift gate
        run: |
          cd backend
          DATABASE_URL='sqlite://' SECRET_KEY='ci-only-0123456789abcdef0123456789abcdef0123456789abcdef' \
            ADMIN_USERNAME=ci ADMIN_PASSWORD=ci-not-admin OPENAI_API_KEY=dummy \
            /tmp/test-venv/bin/python -c "import json; from app.main import app; json.dump(app.openapi(), open('../frontend/openapi.json','w'), indent=1, sort_keys=True)"
          cd ../frontend
          corepack enable
          pnpm install --frozen-lockfile
          pnpm exec openapi-typescript openapi.json -o src/lib/api-types.gen.ts
          git diff --exit-code src/lib/api-types.gen.ts
          pnpm typecheck

  deploy:
    runs-on: self-hosted
    needs: test

    steps:
      - uses: actions/checkout@v4

      - name: Write .env.prod
        run: |
          cat > .env.prod <<'ENVEOF'
          POSTGRES_USER=${{ secrets.POSTGRES_USER }}
          POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}
          POSTGRES_DB=${{ secrets.POSTGRES_DB }}
          SECRET_KEY=${{ secrets.SECRET_KEY }}
          ADMIN_USERNAME=${{ secrets.ADMIN_USERNAME }}
          ADMIN_PASSWORD=${{ secrets.ADMIN_PASSWORD }}
          LETSENCRYPT_EMAIL=${{ secrets.LETSENCRYPT_EMAIL }}
          VAPID_PRIVATE_KEY=${{ secrets.VAPID_PRIVATE_KEY }}
          VAPID_PUBLIC_KEY=${{ secrets.VAPID_PUBLIC_KEY }}
          OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
          AGENT_MODEL=gpt-5.6-luna
          ENVEOF
          sed -i 's/^[[:space:]]*//' .env.prod

      - name: Build and deploy
        run: |
          docker compose -f docker-compose.prod.yml --env-file .env.prod build
          docker compose -f docker-compose.prod.yml --env-file .env.prod up -d --remove-orphans

      - name: Wait for health
        run: |
          echo "Waiting for backend..."
          for i in $(seq 1 30); do
            if docker inspect wealthysmart-backend-prod --format '{{.State.Health.Status}}' 2>/dev/null | grep -q healthy; then
              echo "Backend is healthy"
              break
            fi
            sleep 2
          done

      - name: Prune old images
        run: docker image prune -f

      - name: Cleanup
        if: always()
        run: rm -f .env.prod