deploy.yml

name: Deploy

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to'
        required: true
        default: 'production'
        type: choice
        options:
          - production
          - staging

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  REGISTRY: ghcr.io
  IMAGE_PREFIX: ${{ github.repository }}

jobs:
  # hashFiles() is NOT valid in a job-level `if:` (only step-level) — using it there
  # made GitHub reject the whole workflow ("workflow file issue"). Detect package
  # presence once here and gate the backend jobs on this output instead.
  detect-packages:
    name: Detect packages
    runs-on: ubuntu-latest
    outputs:
      has_packages: ${{ steps.check.outputs.has_packages }}
    steps:
      - name: Checkout code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Check for packages/*
        id: check
        run: |
          if [ -f packages/shared/package.json ]; then
            echo "has_packages=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_packages=false" >> "$GITHUB_OUTPUT"
          fi

  build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    # Backend/monorepo job — runs only when packages/* is present (skips on the
    # frontend-only playground; auto-runs if the monorepo packages are restored).
    needs: detect-packages
    if: needs.detect-packages.outputs.has_packages == 'true'
    permissions:
      contents: read
      packages: write
    strategy:
      fail-fast: false
      matrix:
        service: [api, oracle-keeper, indexer]
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/${{ matrix.service }}
          tags: |
            type=sha,prefix={{branch}}-
            type=ref,event=branch
            type=raw,value=latest,enable={{is_default_branch}}
      
      - name: Build and push Docker image
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
        with:
          context: .
          file: Dockerfile.${{ matrix.service }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}