deploy-aws.yml

name: Deploy to AWS ECS (Main + Exam + Admin)

on:
  push:
    branches: [ main ]
  workflow_dispatch: # Allow manual trigger

env:
  AWS_REGION: us-east-2
  ECR_REPOSITORY_MAIN: pythonide-backend
  ECR_REPOSITORY_EXAM: pythonide-exam
  ECR_REPOSITORY_ADMIN: pythonide-admin
  ECS_CLUSTER: pythonide-cluster
  # Main IDE service
  ECS_SERVICE_MAIN: pythonide-service
  # Exam IDE service
  ECS_SERVICE_EXAM: pythonide-exam-task-service
  # Admin Panel service
  ECS_SERVICE_ADMIN: pythonide-admin-service
  ECS_TASK_DEFINITION: .github/ecs-task-definition.json
  ECS_TASK_DEFINITION_ADMIN: .github/ecs-task-definition-admin.json

jobs:
  deploy:
    name: Deploy to Main + Exam + Admin
    runs-on: ubuntu-latest

    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ env.AWS_REGION }}

    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v2

    # ==================== MAIN + EXAM IDE BUILD ====================
    - name: Build, tag, and push Main IDE image
      id: build-image
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        IMAGE_TAG: ${{ github.sha }}
      run: |
        # Build Docker image for linux/amd64 platform
        docker build --platform linux/amd64 -t $ECR_REGISTRY/$ECR_REPOSITORY_MAIN:$IMAGE_TAG .
        docker build --platform linux/amd64 -t $ECR_REGISTRY/$ECR_REPOSITORY_MAIN:latest .

        # Push to Main IDE repository (pythonide-backend)
        docker push $ECR_REGISTRY/$ECR_REPOSITORY_MAIN:$IMAGE_TAG
        docker push $ECR_REGISTRY/$ECR_REPOSITORY_MAIN:latest

        # Tag and push to Exam IDE repository (pythonide-exam)
        docker tag $ECR_REGISTRY/$ECR_REPOSITORY_MAIN:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY_EXAM:$IMAGE_TAG
        docker tag $ECR_REGISTRY/$ECR_REPOSITORY_MAIN:latest $ECR_REGISTRY/$ECR_REPOSITORY_EXAM:latest
        docker push $ECR_REGISTRY/$ECR_REPOSITORY_EXAM:$IMAGE_TAG
        docker push $ECR_REGISTRY/$ECR_REPOSITORY_EXAM:latest

        echo "image=$ECR_REGISTRY/$ECR_REPOSITORY_MAIN:$IMAGE_TAG" >> $GITHUB_OUTPUT

    # ==================== ADMIN PANEL BUILD ====================
    - name: Ensure Admin ECR Repository Exists
      run: |
        aws ecr describe-repositories --repository-names $ECR_REPOSITORY_ADMIN --region $AWS_REGION 2>/dev/null || \
        aws ecr create-repository --repository-name $ECR_REPOSITORY_ADMIN --region $AWS_REGION
        echo "Admin ECR repository ready"

    - name: Build, tag, and push Admin Panel image
      id: build-admin-image
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        IMAGE_TAG: ${{ github.sha }}
      run: |
        # Build Admin Docker image using Dockerfile.admin
        docker build --platform linux/amd64 -f Dockerfile.admin -t $ECR_REGISTRY/$ECR_REPOSITORY_ADMIN:$IMAGE_TAG .
        docker tag $ECR_REGISTRY/$ECR_REPOSITORY_ADMIN:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY_ADMIN:latest

        # Push to Admin ECR repository
        docker push $ECR_REGISTRY/$ECR_REPOSITORY_ADMIN:$IMAGE_TAG
        docker push $ECR_REGISTRY/$ECR_REPOSITORY_ADMIN:latest

        echo "admin_image=$ECR_REGISTRY/$ECR_REPOSITORY_ADMIN:$IMAGE_TAG" >> $GITHUB_OUTPUT

    # ==================== MAIN IDE DEPLOYMENT ====================
    - name: Fill in the new image ID in Main ECS task definition
      id: task-def
      uses: aws-actions/amazon-ecs-render-task-definition@v1
      with:
        task-definition: ${{ env.ECS_TASK_DEFINITION }}
        container-name: pythonide-backend
        image: ${{ steps.build-image.outputs.image }}

    - name: Deploy to Main IDE (pythonide-service)
      uses: aws-actions/amazon-ecs-deploy-task-definition@v1
      with:
        task-definition: ${{ steps.task-def.outputs.task-definition }}
        service: ${{ env.ECS_SERVICE_MAIN }}
        cluster: ${{ env.ECS_CLUSTER }}
        wait-for-service-stability: true

    - name: Ensure Auto-Scaling Configuration (Main IDE)
      run: |
        echo "Verifying auto-scaling for Main IDE..."

        SCALING_TARGET=$(aws application-autoscaling describe-scalable-targets \
          --service-namespace ecs \
          --resource-ids "service/${{ env.ECS_CLUSTER }}/${{ env.ECS_SERVICE_MAIN }}" \
          --region ${{ env.AWS_REGION }} \
          --query 'ScalableTargets[0].ResourceId' \
          --output text 2>/dev/null) || SCALING_TARGET="None"

        if [ "$SCALING_TARGET" = "None" ] || [ "$SCALING_TARGET" = "" ]; then
          echo "Setting up auto-scaling for Main IDE..."

          aws application-autoscaling register-scalable-target \
            --service-namespace ecs \
            --resource-id "service/${{ env.ECS_CLUSTER }}/${{ env.ECS_SERVICE_MAIN }}" \
            --scalable-dimension ecs:service:DesiredCount \
            --min-capacity 2 \
            --max-capacity 6 \
            --region ${{ env.AWS_REGION }}

          aws application-autoscaling put-scaling-policy \
            --policy-name "pythonide-main-cpu-scaling-policy" \
            --service-namespace ecs \
            --resource-id "service/${{ env.ECS_CLUSTER }}/${{ env.ECS_SERVICE_MAIN }}" \
            --scalable-dimension ecs:service:DesiredCount \
            --policy-type TargetTrackingScaling \
            --target-tracking-scaling-policy-configuration '{
                "TargetValue": 45.0,
                "PredefinedMetricSpecification": {
                    "PredefinedMetricType": "ECSServiceAverageCPUUtilization"
                },
                "ScaleOutCooldown": 300,
                "ScaleInCooldown": 300
            }' \
            --region ${{ env.AWS_REGION }}

          echo "Main IDE auto-scaling configured"
        else
          echo "Main IDE auto-scaling already configured"
        fi

    # ==================== EXAM IDE DEPLOYMENT ====================
    - name: Deploy to Exam IDE (pythonide-exam-task-service)
      run: |
        echo "Deploying to Exam IDE..."
        aws ecs update-service \
          --cluster ${{ env.ECS_CLUSTER }} \
          --service ${{ env.ECS_SERVICE_EXAM }} \
          --force-new-deployment \
          --region ${{ env.AWS_REGION }}

        echo "Waiting for Exam IDE deployment to stabilize..."
        aws ecs wait services-stable \
          --cluster ${{ env.ECS_CLUSTER }} \
          --services ${{ env.ECS_SERVICE_EXAM }} \
          --region ${{ env.AWS_REGION }}

        echo "Exam IDE deployment complete"

    - name: Ensure Auto-Scaling Configuration (Exam IDE)
      run: |
        echo "Verifying auto-scaling for Exam IDE..."

        SCALING_TARGET=$(aws application-autoscaling describe-scalable-targets \
          --service-namespace ecs \
          --resource-ids "service/${{ env.ECS_CLUSTER }}/${{ env.ECS_SERVICE_EXAM }}" \
          --region ${{ env.AWS_REGION }} \
          --query 'ScalableTargets[0].ResourceId' \
          --output text 2>/dev/null) || SCALING_TARGET="None"

        if [ "$SCALING_TARGET" = "None" ] || [ "$SCALING_TARGET" = "" ]; then
          echo "Setting up auto-scaling for Exam IDE..."

          aws application-autoscaling register-scalable-target \
            --service-namespace ecs \
            --resource-id "service/${{ env.ECS_CLUSTER }}/${{ env.ECS_SERVICE_EXAM }}" \
            --scalable-dimension ecs:service:DesiredCount \
            --min-capacity 1 \
            --max-capacity 4 \
            --region ${{ env.AWS_REGION }}

          aws application-autoscaling put-scaling-policy \
            --policy-name "pythonide-exam-cpu-scaling-policy" \
            --service-namespace ecs \
            --resource-id "service/${{ env.ECS_CLUSTER }}/${{ env.ECS_SERVICE_EXAM }}" \
            --scalable-dimension ecs:service:DesiredCount \
            --policy-type TargetTrackingScaling \
            --target-tracking-scaling-policy-configuration '{
                "TargetValue": 45.0,
                "PredefinedMetricSpecification": {
                    "PredefinedMetricType": "ECSServiceAverageCPUUtilization"
                },
                "ScaleOutCooldown": 300,
                "ScaleInCooldown": 300
            }' \
            --region ${{ env.AWS_REGION }}

          echo "Exam IDE auto-scaling configured"
        else
          echo "Exam IDE auto-scaling already configured"
        fi

    # ==================== ADMIN PANEL DEPLOYMENT ====================
    - name: Setup Admin Panel Infrastructure
      id: admin-infra
      run: |
        echo "Setting up Admin Panel infrastructure..."

        # Create CloudWatch log group if not exists
        aws logs create-log-group --log-group-name /ecs/pythonide-admin --region $AWS_REGION 2>/dev/null || echo "Log group exists"

        # Get VPC, Subnets and Security Group from existing main service (ensures same VPC as ALB)
        NETWORK_CONFIG=$(aws ecs describe-services --cluster $ECS_CLUSTER --services $ECS_SERVICE_MAIN \
          --query 'services[0].networkConfiguration.awsvpcConfiguration' --output json --region $AWS_REGION)

        SUBNETS=$(echo $NETWORK_CONFIG | jq -r '.subnets | join(",")')
        SECURITY_GROUP=$(echo $NETWORK_CONFIG | jq -r '.securityGroups[0]')

        # Get VPC from the ALB (ensures target group is in same VPC)
        ALB_ARN=$(aws elbv2 describe-load-balancers --names pythonide-alb \
          --query 'LoadBalancers[0].LoadBalancerArn' --output text --region $AWS_REGION 2>/dev/null) || ALB_ARN=""

        if [ -z "$ALB_ARN" ] || [ "$ALB_ARN" = "None" ]; then
          ALB_ARN=$(aws elbv2 describe-load-balancers \
            --query 'LoadBalancers[?contains(LoadBalancerName, `pythonide`)].LoadBalancerArn' --output text --region $AWS_REGION | head -1)
        fi

        VPC_ID=$(aws elbv2 describe-load-balancers --load-balancer-arns $ALB_ARN \
          --query 'LoadBalancers[0].VpcId' --output text --region $AWS_REGION)

        echo "VPC: $VPC_ID"
        echo "Subnets: $SUBNETS"
        echo "Security Group: $SECURITY_GROUP"
        echo "ALB ARN: $ALB_ARN"

        echo "vpc_id=$VPC_ID" >> $GITHUB_OUTPUT
        echo "subnets=$SUBNETS" >> $GITHUB_OUTPUT
        echo "security_group=$SECURITY_GROUP" >> $GITHUB_OUTPUT
        echo "alb_arn=$ALB_ARN" >> $GITHUB_OUTPUT

    - name: Create Admin Target Group
      id: admin-tg
      run: |
        # Check if target group exists
        TG_ARN=$(aws elbv2 describe-target-groups --names pythonide-admin-tg \
          --query 'TargetGroups[0].TargetGroupArn' --output text --region $AWS_REGION 2>/dev/null) || TG_ARN=""

        if [ -z "$TG_ARN" ] || [ "$TG_ARN" = "None" ]; then
          echo "Creating Admin target group..."
          TG_ARN=$(aws elbv2 create-target-group \
            --name pythonide-admin-tg \
            --protocol HTTP \
            --port 8080 \
            --vpc-id ${{ steps.admin-infra.outputs.vpc_id }} \
            --target-type ip \
            --health-check-path /health \
            --health-check-interval-seconds 30 \
            --health-check-timeout-seconds 5 \
            --healthy-threshold-count 2 \
            --unhealthy-threshold-count 3 \
            --query 'TargetGroups[0].TargetGroupArn' \
            --output text \
            --region $AWS_REGION)
          echo "Created target group: $TG_ARN"
        else
          echo "Target group exists: $TG_ARN"
        fi

        echo "tg_arn=$TG_ARN" >> $GITHUB_OUTPUT

    - name: Create Admin ALB Listener Rule
      run: |
        # Get HTTPS listener ARN
        LISTENER_ARN=$(aws elbv2 describe-listeners \
          --load-balancer-arn ${{ steps.admin-infra.outputs.alb_arn }} \
          --query 'Listeners[?Port==`443`].ListenerArn' --output text --region $AWS_REGION 2>/dev/null)

        if [ -z "$LISTENER_ARN" ] || [ "$LISTENER_ARN" = "None" ]; then
          # Try HTTP listener
          LISTENER_ARN=$(aws elbv2 describe-listeners \
            --load-balancer-arn ${{ steps.admin-infra.outputs.alb_arn }} \
            --query 'Listeners[?Port==`80`].ListenerArn' --output text --region $AWS_REGION)
        fi

        echo "Listener ARN: $LISTENER_ARN"

        # Check if rule already exists for admin subdomain
        EXISTING_RULE=$(aws elbv2 describe-rules --listener-arn $LISTENER_ARN \
          --query "Rules[?Conditions[?Values[?contains(@, 'admin.pythonide')]]]" --output text --region $AWS_REGION 2>/dev/null) || EXISTING_RULE=""

        if [ -z "$EXISTING_RULE" ]; then
          echo "Creating ALB listener rule for admin.pythonide-classroom.tech..."

          # Get highest priority and add 1
          MAX_PRIORITY=$(aws elbv2 describe-rules --listener-arn $LISTENER_ARN \
            --query 'max(Rules[?Priority!=`default`].Priority)' --output text --region $AWS_REGION)

          if [ "$MAX_PRIORITY" = "None" ] || [ -z "$MAX_PRIORITY" ]; then
            NEW_PRIORITY=10
          else
            NEW_PRIORITY=$((MAX_PRIORITY + 10))
          fi

          aws elbv2 create-rule \
            --listener-arn $LISTENER_ARN \
            --priority $NEW_PRIORITY \
            --conditions '[{"Field":"host-header","Values":["admin.pythonide-classroom.tech"]}]' \
            --actions '[{"Type":"forward","TargetGroupArn":"${{ steps.admin-tg.outputs.tg_arn }}"}]' \
            --region $AWS_REGION

          echo "Created ALB rule with priority $NEW_PRIORITY"
        else
          echo "ALB rule for admin subdomain already exists"
        fi

    - name: Fill in Admin ECS task definition
      id: admin-task-def
      uses: aws-actions/amazon-ecs-render-task-definition@v1
      with:
        task-definition: ${{ env.ECS_TASK_DEFINITION_ADMIN }}
        container-name: pythonide-admin
        image: ${{ steps.build-admin-image.outputs.admin_image }}

    - name: Deploy Admin Panel ECS Service
      run: |
        # Check if service exists and is active
        SERVICE_INFO=$(aws ecs describe-services --cluster $ECS_CLUSTER --services $ECS_SERVICE_ADMIN \
          --query 'services[0].{status:status,runningCount:runningCount}' --output json --region $AWS_REGION 2>/dev/null) || SERVICE_INFO="{}"

        SERVICE_STATUS=$(echo $SERVICE_INFO | jq -r '.status // "MISSING"')

        # Register task definition first
        TASK_DEF_ARN=$(aws ecs register-task-definition \
          --cli-input-json file://${{ steps.admin-task-def.outputs.task-definition }} \
          --query 'taskDefinition.taskDefinitionArn' --output text --region $AWS_REGION)

        echo "Registered task definition: $TASK_DEF_ARN"

        if [ "$SERVICE_STATUS" = "ACTIVE" ]; then
          echo "Updating existing Admin service..."
          aws ecs update-service \
            --cluster $ECS_CLUSTER \
            --service $ECS_SERVICE_ADMIN \
            --task-definition $TASK_DEF_ARN \
            --force-new-deployment \
            --region $AWS_REGION
        else
          echo "Creating new Admin ECS service..."

          # Parse subnets into proper format
          SUBNET_LIST="${{ steps.admin-infra.outputs.subnets }}"

          aws ecs create-service \
            --cluster $ECS_CLUSTER \
            --service-name $ECS_SERVICE_ADMIN \
            --task-definition $TASK_DEF_ARN \
            --desired-count 1 \
            --launch-type FARGATE \
            --network-configuration "awsvpcConfiguration={subnets=[$SUBNET_LIST],securityGroups=[${{ steps.admin-infra.outputs.security_group }}],assignPublicIp=ENABLED}" \
            --load-balancers "targetGroupArn=${{ steps.admin-tg.outputs.tg_arn }},containerName=pythonide-admin,containerPort=8080" \
            --region $AWS_REGION
        fi

        echo "Waiting for Admin service to stabilize..."
        aws ecs wait services-stable \
          --cluster $ECS_CLUSTER \
          --services $ECS_SERVICE_ADMIN \
          --region $AWS_REGION

        echo "Admin Panel deployment complete"

    - name: Configure Route 53 DNS for Admin
      continue-on-error: true
      run: |
        # Get the ALB DNS name
        ALB_DNS=$(aws elbv2 describe-load-balancers \
          --load-balancer-arns ${{ steps.admin-infra.outputs.alb_arn }} \
          --query 'LoadBalancers[0].DNSName' --output text --region $AWS_REGION)

        echo "ALB DNS: $ALB_DNS"
        echo ""
        echo "=============================================="
        echo "MANUAL DNS SETUP REQUIRED"
        echo "=============================================="
        echo "Add a CNAME record in your DNS provider:"
        echo "  Name:  admin"
        echo "  Type:  CNAME"
        echo "  Value: $ALB_DNS"
        echo "=============================================="
        echo ""

        # Try Route 53 if available
        HOSTED_ZONE_ID=$(aws route53 list-hosted-zones-by-name \
          --dns-name "pythonide-classroom.tech" \
          --query 'HostedZones[?Name==`pythonide-classroom.tech.`].Id' --output text 2>/dev/null | sed 's/\/hostedzone\///' | head -1) || HOSTED_ZONE_ID=""

        if [ -n "$HOSTED_ZONE_ID" ] && [ "$HOSTED_ZONE_ID" != "None" ]; then
          echo "Found Route 53 hosted zone: $HOSTED_ZONE_ID"

          ALB_ZONE_ID=$(aws elbv2 describe-load-balancers \
            --load-balancer-arns ${{ steps.admin-infra.outputs.alb_arn }} \
            --query 'LoadBalancers[0].CanonicalHostedZoneId' --output text --region $AWS_REGION)

          aws route53 change-resource-record-sets \
            --hosted-zone-id $HOSTED_ZONE_ID \
            --change-batch '{
              "Changes": [{
                "Action": "UPSERT",
                "ResourceRecordSet": {
                  "Name": "admin.pythonide-classroom.tech",
                  "Type": "A",
                  "AliasTarget": {
                    "HostedZoneId": "'"$ALB_ZONE_ID"'",
                    "DNSName": "'"$ALB_DNS"'",
                    "EvaluateTargetHealth": true
                  }
                }
              }]
            }' && echo "Route 53 DNS record created successfully"
        else
          echo "Route 53 hosted zone not found - manual DNS setup required"
        fi

    # ==================== VERIFICATION ====================
    - name: Verify All Deployments
      run: |
        echo "Verifying deployments..."
        echo ""

        echo "MAIN IDE Status:"
        aws ecs describe-services \
          --cluster ${{ env.ECS_CLUSTER }} \
          --services ${{ env.ECS_SERVICE_MAIN }} \
          --region ${{ env.AWS_REGION }} \
          --query 'services[0].{Service:serviceName,Status:status,Running:runningCount,Desired:desiredCount}' \
          --output table

        echo ""
        echo "EXAM IDE Status:"
        aws ecs describe-services \
          --cluster ${{ env.ECS_CLUSTER }} \
          --services ${{ env.ECS_SERVICE_EXAM }} \
          --region ${{ env.AWS_REGION }} \
          --query 'services[0].{Service:serviceName,Status:status,Running:runningCount,Desired:desiredCount}' \
          --output table

        echo ""
        echo "ADMIN PANEL Status:"
        aws ecs describe-services \
          --cluster ${{ env.ECS_CLUSTER }} \
          --services ${{ env.ECS_SERVICE_ADMIN }} \
          --region ${{ env.AWS_REGION }} \
          --query 'services[0].{Service:serviceName,Status:status,Running:runningCount,Desired:desiredCount}' \
          --output table

    - name: Post-Deployment Summary
      run: |
        echo ""
        echo "DEPLOYMENT SUMMARY"
        echo "=================="
        echo "Docker images built and pushed to ECR"
        echo "  - Main IDE (pythonide-backend)"
        echo "  - Exam IDE (pythonide-exam)"
        echo "  - Admin Panel (pythonide-admin)"
        echo ""
        echo "ECS Services deployed:"
        echo "  - Main IDE (pythonide-service)"
        echo "  - Exam IDE (pythonide-exam-task-service)"
        echo "  - Admin Panel (pythonide-admin-service)"
        echo ""
        echo "Services:"
        echo "  Main IDE:    https://pythonide-classroom.tech"
        echo "  Exam IDE:    https://exam.pythonide-classroom.tech"
        echo "  Admin Panel: https://admin.pythonide-classroom.tech"
        echo ""
        echo "All services now running commit: ${{ github.sha }}"