cd-backend.yml

name: CD Backend

on:
  workflow_run:
    workflows:
      - CI Backend
    types:
      - completed

permissions:
  contents: read

concurrency:
  group: cd-backend-master
  cancel-in-progress: false

jobs:
  backend-cd:
    if: >
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.head_branch == 'master'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      KUBE_NAMESPACE: trafiq
      IMAGE_NAME: mohamedkhalil26/trafiq-backend
      RELEASE_SHA: ${{ github.event.workflow_run.head_sha }}

    steps:
      - name: Checkout repository at the promoted commit
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_sha }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Authenticate to Docker Hub
        uses: docker/login-action@v3
        with:
          username: mohamedkhalil26
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push backend image
        uses: docker/build-push-action@v5
        with:
          context: backend
          file: backend/server/Dockerfile
          push: true
          tags: |
            docker.io/${{ env.IMAGE_NAME }}:${{ env.RELEASE_SHA }}
            docker.io/${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Install kubectl
        uses: azure/setup-kubectl@v4
        with:
          version: v1.29.4

      - name: Write kubeconfig from GitHub secret
        env:
          KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
        run: |
          echo "$KUBE_CONFIG_DATA" | base64 --decode > "$RUNNER_TEMP/kubeconfig"
          chmod 600 "$RUNNER_TEMP/kubeconfig"

      - name: Deploy backend to Kubernetes
        env:
          KUBECONFIG: ${{ runner.temp }}/kubeconfig
          BACKEND_IMAGE: docker.io/${{ env.IMAGE_NAME }}:${{ env.RELEASE_SHA }}
          DOCKERHUB_USERNAME: mohamedkhalil26
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
          DOCKERHUB_EMAIL: ${{ vars.DOCKERHUB_EMAIL || 'devops@example.com' }}
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
          WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
        run: |
          kubectl create namespace "$KUBE_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -

          kubectl apply -f k8s/configmap.yaml

          # Runtime application secrets are created from GitHub secrets so the repo never stores credentials.
          kubectl create secret generic trafiq-backend-secrets \
            --namespace "$KUBE_NAMESPACE" \
            --from-literal=JWT_SECRET="$JWT_SECRET" \
            --dry-run=client -o yaml | kubectl apply -f -

          kubectl create secret docker-registry dockerhub-registry \
            --namespace "$KUBE_NAMESPACE" \
            --docker-server="https://index.docker.io/v1/" \
            --docker-username="$DOCKERHUB_USERNAME" \
            --docker-password="$DOCKERHUB_TOKEN" \
            --docker-email="$DOCKERHUB_EMAIL" \
            --dry-run=client -o yaml | kubectl apply -f -

          kubectl apply -f k8s/backend-deployment.yaml
          kubectl apply -f k8s/ingress.yaml

          kubectl set image deployment/trafiq-backend backend="$BACKEND_IMAGE" -n "$KUBE_NAMESPACE"

          # Deployment annotations make the running workload traceable back to the successful CI run.
          kubectl annotate deployment/trafiq-backend \
            -n "$KUBE_NAMESPACE" \
            ci.github.com/run-id="$WORKFLOW_RUN_ID" \
            ci.github.com/sha="$RELEASE_SHA" \
            --overwrite

          kubectl rollout status deployment/trafiq-backend -n "$KUBE_NAMESPACE" --timeout=180s