stack127-release-e2e.yml

name: Stack127 Release

on:
  push:
    branches:
      - main
    paths-ignore:
      - "**/*.md"
      - "content_docs/**"
      - "skills/**"
      - "stack127_docs/**"
      - "stack127_records/**"
      - "tests/**"
  workflow_dispatch:
    inputs:
      commit_sha:
        description: "Exact current main SHA to release. Leave empty for main."
        required: false
        type: string

permissions:
  contents: read
  packages: write

concurrency:
  group: stack127-production
  cancel-in-progress: false
  queue: max

jobs:
  release:
    runs-on: ubuntu-latest
    environment: production
    timeout-minutes: 60
    env:
      RELEASE_SHA: ${{ inputs.commit_sha || github.sha }}
      STACK127_RELEASE_SHA: ${{ inputs.commit_sha || github.sha }}
      STACK127_FRONTEND_HOSTING: ${{ vars.STACK127_FRONTEND_HOSTING || 'legacy' }}
      STACK127_SITE_URL: ${{ vars.STACK127_SITE_URL || 'https://stack127.com' }}
      GITHUB_TOKEN: ${{ github.token }}
      DATABASE_URL: ${{ secrets.DATABASE_POOLER_URL || secrets.DATABASE_URL }}
      SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
      SUPABASE_PUBLISHABLE_KEY: ${{ secrets.SUPABASE_PUBLISHABLE_KEY }}
      SUPABASE_SECRET_KEY: ${{ secrets.SUPABASE_SECRET_KEY }}
      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID || secrets.CLOUDFLARE_ACCOUNT_ID }}
      CLOUDFLARE_ZONE_ID: ${{ vars.CLOUDFLARE_ZONE_ID || secrets.CLOUDFLARE_ZONE_ID }}
      GOOGLE_ANALYTICS_ID: ${{ vars.GOOGLE_ANALYTICS_ID || 'G-ZJNG8SCGE1' }}
      UMAMI_URL: ${{ vars.UMAMI_URL || 'https://umami.ravitejaknts.com' }}
      UMAMI_WEBSITE_ID: ${{ vars.UMAMI_WEBSITE_ID || 'ff47ea40-04e6-4a74-b4cc-e420d28433d3' }}

    steps:
      - name: Checkout release
        uses: actions/checkout@v4
        with:
          ref: ${{ env.RELEASE_SHA }}
          fetch-depth: 0

      - name: Verify current main
        shell: bash
        run: |
          set -euo pipefail
          origin_sha="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
          test -n "$origin_sha"
          test "$RELEASE_SHA" = "$origin_sha"

      - uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: npm

      - run: npm ci

      - name: Prepare production environment
        env:
          DATABASE_URL: ${{ secrets.DATABASE_POOLER_URL || secrets.DATABASE_URL }}
          SUPABASE_URL: ${{ secrets.SUPABASE_URL }}
          SUPABASE_PUBLISHABLE_KEY: ${{ secrets.SUPABASE_PUBLISHABLE_KEY }}
          SUPABASE_SECRET_KEY: ${{ secrets.SUPABASE_SECRET_KEY }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ZONE_ID: ${{ vars.CLOUDFLARE_ZONE_ID || secrets.CLOUDFLARE_ZONE_ID }}
        shell: bash
        run: |
          set -euo pipefail
          umask 077
          test -n "$DATABASE_URL"
          test -n "$CLOUDFLARE_API_TOKEN"
          test -n "$CLOUDFLARE_ZONE_ID"
          printf 'DATABASE_URL=%s\n' "$DATABASE_URL" > .env.database
          printf 'SUPABASE_URL=%s\n' "$SUPABASE_URL" >> .env.database
          printf 'SUPABASE_PUBLISHABLE_KEY=%s\n' "$SUPABASE_PUBLISHABLE_KEY" >> .env.database
          printf 'SUPABASE_SECRET_KEY=%s\n' "$SUPABASE_SECRET_KEY" >> .env.database
          node scripts/stack127/deployment/write-target-env.mjs "$RUNNER_TEMP/stack127-deploy.env"
          printf 'CLOUDFLARE_API_TOKEN=%s\n' "$CLOUDFLARE_API_TOKEN" >> "$RUNNER_TEMP/stack127-deploy.env"
          printf 'CLOUDFLARE_ZONE_ID=%s\n' "$CLOUDFLARE_ZONE_ID" >> "$RUNNER_TEMP/stack127-deploy.env"

      - name: Run minimum release checks
        run: npm run test:core

      - name: Detect migration changes
        id: migrations
        shell: bash
        run: |
          set -euo pipefail
          base="${{ github.event.before }}"
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] || [ -z "$base" ] || [[ "$base" =~ ^0+$ ]]; then
            echo 'run=true' >> "$GITHUB_OUTPUT"
            echo 'functions=true' >> "$GITHUB_OUTPUT"
            exit 0
          fi
          # Removing a historical migration file does not change production schema.
          if git diff --quiet "$base" "$RELEASE_SHA" --diff-filter=AM -- supabase/migrations; then
            echo 'run=false' >> "$GITHUB_OUTPUT"
          else
            echo 'run=true' >> "$GITHUB_OUTPUT"
          fi
          # The cache worker bundles the shared cache target rules.
          if git diff --quiet "$base" "$RELEASE_SHA" -- supabase/functions scripts/stack127/cache/targets.mjs scripts/stack127/cache/refresh.mjs scripts/stack127/frontend/content-queue.mjs lib/cache-tags.ts lib/launch-directories-data.ts lib/platform-fees/section-routes.ts lib/platform-fees/groups.ts; then
            echo 'functions=false' >> "$GITHUB_OUTPUT"
          else
            echo 'functions=true' >> "$GITHUB_OUTPUT"
          fi

      - name: Install Supabase CLI
        if: steps.migrations.outputs.run == 'true' || (steps.migrations.outputs.functions == 'true' && vars.STACK127_CACHE_WORKER_RUNTIME != 'node')
        uses: supabase/setup-cli@v1
        with:
          # Version 3 rejects [inbucket] in supabase/config.toml. Change the two together.
          version: 2.122.1

      - name: Apply database migrations
        if: steps.migrations.outputs.run == 'true'
        env:
          DATABASE_URL: ${{ secrets.DATABASE_MIGRATION_URL || env.DATABASE_URL }}
        run: supabase --yes db push --db-url "$DATABASE_URL" --include-all

      - name: Run production target preflight
        # npm postbuild checks the generated manifests inside the only image build.
        run: npm run stack127:deploy:preflight -- --static-source-only --env-file "$RUNNER_TEMP/stack127-deploy.env"

      - name: Capture content before the frontend build
        if: env.STACK127_FRONTEND_HOSTING == 'cloudflare'
        id: frontend_snapshot
        run: node scripts/stack127/frontend/content-queue.mjs snapshot --sha "$RELEASE_SHA" --force --before-backend-deploy --output "$RUNNER_TEMP/frontend-queue.json"

      - name: Build the static frontend before the backend switch
        if: env.STACK127_FRONTEND_HOSTING == 'cloudflare'
        run: node scripts/stack127/frontend/build.mjs --output "$RUNNER_TEMP/frontend-assets"

      - name: Verify the isolated static frontend preview
        if: env.STACK127_FRONTEND_HOSTING == 'cloudflare'
        run: node scripts/stack127/frontend/deploy.mjs --directory "$RUNNER_TEMP/frontend-assets" --preview

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve image name
        id: image
        shell: bash
        run: |
          owner="$(printf '%s' "$GITHUB_REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')"
          echo "image=ghcr.io/$owner/stack127-web" >> "$GITHUB_OUTPUT"

      - name: Build and push once
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ steps.image.outputs.image }}:${{ env.RELEASE_SHA }}
            ${{ steps.image.outputs.image }}:production
          secret-files: stack127-database-env=.env.database
          build-args: |
            STACK127_BUILD_SHA=${{ env.RELEASE_SHA }}
            GOOGLE_ANALYTICS_ID=${{ vars.GOOGLE_ANALYTICS_ID || 'G-ZJNG8SCGE1' }}
            UMAMI_URL=${{ vars.UMAMI_URL || 'https://umami.ravitejaknts.com' }}
            UMAMI_WEBSITE_ID=${{ vars.UMAMI_WEBSITE_ID || 'ff47ea40-04e6-4a74-b4cc-e420d28433d3' }}
          cache-from: type=gha,scope=stack127-production-web
          cache-to: type=gha,mode=min,scope=stack127-production-web

      - name: Verify main before switching the backend
        shell: bash
        run: |
          set -euo pipefail
          test "$RELEASE_SHA" = "$(git ls-remote origin refs/heads/main | awk '{print $1}')"

      - name: Deploy and verify the backend
        env:
          DOKPLOY_API_URL: ${{ vars.STACK127_DOKPLOY_API_URL || 'https://dokploy.stack127.com' }}
          DOKPLOY_API_KEY: ${{ secrets.DOKPLOY_API_KEY }}
          DOKPLOY_APPLICATION_ID: ${{ vars.STACK127_DOKPLOY_APPLICATION_ID || '_oKhy4YdVBc513i_qjVHC' }}
          DOKPLOY_DOCKER_IMAGE: ${{ steps.image.outputs.image }}:${{ env.RELEASE_SHA }}
          GHCR_DOKPLOY_USERNAME: ${{ vars.GHCR_DOKPLOY_USERNAME || github.repository_owner }}
          GHCR_DOKPLOY_TOKEN: ${{ secrets.GHCR_DOKPLOY_TOKEN }}
          STACK127_SITE_URL: ${{ vars.STACK127_SITE_URL || 'https://stack127.com' }}
          STACK127_RELEASE_SHA: ${{ env.RELEASE_SHA }}
          CF_ACCESS_CLIENT_ID: ${{ secrets.CF_ACCESS_CLIENT_ID }}
          CF_ACCESS_CLIENT_SECRET: ${{ secrets.CF_ACCESS_CLIENT_SECRET }}
        run: node scripts/stack127/deployment/dokploy-release.mjs release

      - name: Activate the static frontend after backend health passes
        if: env.STACK127_FRONTEND_HOSTING == 'cloudflare'
        run: |
          node scripts/stack127/frontend/content-queue.mjs check --sha "$RELEASE_SHA"
          node scripts/stack127/frontend/deploy.mjs --directory "$RUNNER_TEMP/frontend-assets" --activate

      - name: Verify static content and APIs before acknowledging the release snapshot
        if: env.STACK127_FRONTEND_HOSTING == 'cloudflare'
        run: node scripts/stack127/frontend/content-queue.mjs complete --snapshot "$RUNNER_TEMP/frontend-queue.json" --directory "$RUNNER_TEMP/frontend-assets"

      - name: Deploy Supabase Edge Functions
        if: steps.migrations.outputs.functions == 'true' && vars.STACK127_CACHE_WORKER_RUNTIME != 'node'
        env:
          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
          SUPABASE_PROJECT_REF: ${{ vars.SUPABASE_PROJECT_REF }}
        shell: bash
        run: |
          set -euo pipefail
          test -n "$SUPABASE_ACCESS_TOKEN"
          test -n "$SUPABASE_PROJECT_REF"
          supabase functions deploy cache-worker --project-ref "$SUPABASE_PROJECT_REF" --use-api --no-verify-jwt

      - name: Purge changed release pages and warm main routes
        # Retained APIs also need a purge for releases that change only code.
        env:
          STACK127_RELEASE_BEFORE: ${{ github.event.before }}
          STACK127_RELEASE_SHA: ${{ env.RELEASE_SHA }}
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          CLOUDFLARE_ZONE_ID: ${{ vars.CLOUDFLARE_ZONE_ID || secrets.CLOUDFLARE_ZONE_ID }}
        run: node scripts/stack127/cache/purge-release.mjs

      - name: Verify the final release revision
        env:
          DOKPLOY_API_URL: ${{ vars.STACK127_DOKPLOY_API_URL || 'https://dokploy.stack127.com' }}
          DOKPLOY_API_KEY: ${{ secrets.DOKPLOY_API_KEY }}
          DOKPLOY_APPLICATION_ID: ${{ vars.STACK127_DOKPLOY_APPLICATION_ID || '_oKhy4YdVBc513i_qjVHC' }}
          DOKPLOY_DOCKER_IMAGE: ${{ steps.image.outputs.image }}:${{ env.RELEASE_SHA }}
          GHCR_DOKPLOY_USERNAME: ${{ vars.GHCR_DOKPLOY_USERNAME || github.repository_owner }}
          GHCR_DOKPLOY_TOKEN: ${{ secrets.GHCR_DOKPLOY_TOKEN }}
          CF_ACCESS_CLIENT_ID: ${{ secrets.CF_ACCESS_CLIENT_ID }}
          CF_ACCESS_CLIENT_SECRET: ${{ secrets.CF_ACCESS_CLIENT_SECRET }}
        shell: bash
        run: |
          set -euo pipefail
          test "$RELEASE_SHA" = "$(git ls-remote origin refs/heads/main | awk '{print $1}')"
          node scripts/stack127/deployment/dokploy-release.mjs health
          test "$RELEASE_SHA" = "$(git ls-remote origin refs/heads/main | awk '{print $1}')"

      - name: Preserve failed content versions for retry
        if: failure() && env.STACK127_FRONTEND_HOSTING == 'cloudflare' && steps.frontend_snapshot.outcome == 'success'
        run: node scripts/stack127/frontend/content-queue.mjs fail --snapshot "$RUNNER_TEMP/frontend-queue.json" --error "Release failed in GitHub run $GITHUB_RUN_ID."

      - name: Remove private release files
        if: always()
        run: rm -f .env.database "$RUNNER_TEMP/stack127-deploy.env" "$RUNNER_TEMP/frontend-queue.json"