test/.gitea/workflows/ci.yaml

name: Test Build Deploy

on:
  push:
    branches:
      - master

env:
  PHP_VERSION: '8.4'
  NODE_VERSION: '22'
  ARTIFACT_NAME: laravel-release
  RELEASE_FILE: laravel-release.tar.gz

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ env.PHP_VERSION }}
          extensions: pdo, pdo_sqlite, sqlite3
          coverage: none

      - name: Copy environment file
        run: cp .env.example .env

      - name: Install Composer dependencies
        run: composer install --no-interaction --prefer-dist --optimize-autoloader

      - name: Generate application key
        run: php artisan key:generate --ansi

      - name: Run migrations
        run: php artisan migrate --no-interaction --force

      - name: Run Laravel tests
        run: composer run test

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: test

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ env.PHP_VERSION }}
          extensions: pdo, pdo_sqlite, sqlite3
          coverage: none

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm

      - name: Install production Composer dependencies
        run: composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader

      - name: Install Node dependencies
        run: npm ci

      - name: Build frontend assets
        run: npm run build

      - name: Create release artifact
        run: |
          tar \
            --exclude='.git' \
            --exclude='.gitea' \
            --exclude='.env' \
            --exclude="${RELEASE_FILE}" \
            --exclude='node_modules' \
            --exclude='tests' \
            --exclude='storage/logs/*' \
            --exclude='storage/framework/cache/*' \
            --exclude='storage/framework/sessions/*' \
            --exclude='storage/framework/views/*' \
            -czf "/tmp/${RELEASE_FILE}" .
          mv "/tmp/${RELEASE_FILE}" "${RELEASE_FILE}"

      - name: Upload release artifact
        uses: actions/upload-artifact@v3
        with:
          name: ${{ env.ARTIFACT_NAME }}
          path: ${{ env.RELEASE_FILE }}
          if-no-files-found: error

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: build

    env:
      # Required Gitea secrets:
      # - SSH_HOST: server hostname or IP address
      # - SSH_PORT: SSH port, usually 22
      # - SSH_USER: SSH username for deployment
      # - SSH_PASSWORD: SSH password for deployment
      # - DEPLOY_PATH: absolute path on the server where the app will be deployed
      # - APP_ENV_FILE: full production .env file content, including APP_KEY and DB credentials
      SSH_HOST: ${{ secrets.SSH_HOST }}
      SSH_PORT: ${{ secrets.SSH_PORT }}
      SSH_USER: ${{ secrets.SSH_USER }}
      SSH_PASSWORD: ${{ secrets.SSH_PASSWORD }}
      DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
      APP_ENV_FILE: ${{ secrets.APP_ENV_FILE }}

    steps:
      - name: Download release artifact
        uses: actions/download-artifact@v3
        with:
          name: ${{ env.ARTIFACT_NAME }}

      - name: Install SSH password helper
        run: sudo apt-get update && sudo apt-get install -y sshpass

      - name: Validate deployment secrets
        run: |
          test -n "${SSH_HOST}" || (echo "Missing required secret: SSH_HOST" && exit 1)
          test -n "${SSH_USER}" || (echo "Missing required secret: SSH_USER" && exit 1)
          test -n "${SSH_PASSWORD}" || (echo "Missing required secret: SSH_PASSWORD" && exit 1)
          test -n "${DEPLOY_PATH}" || (echo "Missing required secret: DEPLOY_PATH" && exit 1)

      - name: Configure SSH
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh

      - name: Create deployment environment file
        if: env.APP_ENV_FILE != ''
        run: printf '%s\n' "${APP_ENV_FILE}" > .env.deploy

      - name: Upload release to server
        run: |
          SSHPASS="${SSH_PASSWORD}" sshpass -e rsync -avz \
            -e "ssh -p ${SSH_PORT:-22} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \
            "${RELEASE_FILE}" "${SSH_USER}@${SSH_HOST}:/tmp/${RELEASE_FILE}"

      - name: Upload environment file to server
        if: env.APP_ENV_FILE != ''
        run: |
          SSHPASS="${SSH_PASSWORD}" sshpass -e rsync -avz \
            -e "ssh -p ${SSH_PORT:-22} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \
            .env.deploy "${SSH_USER}@${SSH_HOST}:/tmp/.env.deploy"

      - name: Extract release and finalize deployment
        run: |
          SSHPASS="${SSH_PASSWORD}" sshpass -e ssh \
            -p "${SSH_PORT:-22}" \
            -o StrictHostKeyChecking=no \
            -o UserKnownHostsFile=/dev/null \
            "${SSH_USER}@${SSH_HOST}" << EOF
          set -e
          mkdir -p "${DEPLOY_PATH}"
          tar -xzf "/tmp/${RELEASE_FILE}" -C "${DEPLOY_PATH}"
          rm -f "/tmp/${RELEASE_FILE}"
          cd "${DEPLOY_PATH}"
          if [ -f /tmp/.env.deploy ]; then
            mv /tmp/.env.deploy .env
            chmod 600 .env
          fi
          php artisan storage:link || true
          php artisan migrate --force
          php artisan optimize
          EOF