ermnvldmr.com/.github/workflows/services-docs-next-required.yml

name: services/docs - next/required

on:
  push:
    branches: [next]
    paths:
      - 'services/docs/**'

concurrency:
  group: ci-docs-${{ github.ref_name }}
  cancel-in-progress: true

permissions:
  contents: read
  actions: read

jobs:
  setup-hugo:
    name: Setup - Hugo
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v2
        with:
          hugo-version: 'latest'
          extended: true

  build-hugo:
    name: Build - Hugo Site
    needs: setup-hugo
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0

      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v2
        with:
          hugo-version: 'latest'
          extended: true

      - name: Build Hugo site
        working-directory: services/docs
        run: hugo --gc --minify

  release-docker:
    name: Release - Docker Image
    needs: build-hugo
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}/docs
          tags: |
            type=raw,value=latest
            type=sha,format=short

      - name: Compute short SHA
        id: vars
        run: echo "short_sha=sha-$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ci/docker/docs/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            COMMIT_SHA=${{ steps.vars.outputs.short_sha }}
            VERSION=${{ steps.vars.outputs.short_sha }}

  deploy:
    name: Deploy - Kubernetes (GitOps)
    needs: release-docker
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: next
          token: ${{ secrets.GITOPS_TOKEN || secrets.GITHUB_TOKEN }}

      - name: Setup Kustomize
        uses: imranismail/setup-kustomize@v2
        with:
          kustomize-version: "5.3.0"

      - name: Deploy via GitOps
        run: |
          DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
          bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"

  verify-rollout:
    name: Verify - Production Rollout
    needs: deploy
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/next'
    steps:
      - name: Await production rollout
        run: |
          TARGET_COMMIT="sha-$(echo ${{ github.sha }} | cut -c1-7)"
          ENDPOINT="https://docs.ermnvldmr.com/version.json"

          echo "========================================================"
          echo "Verifying production deployment on $ENDPOINT"
          echo "Expected commit: $TARGET_COMMIT"
          echo "========================================================"

          MAX_ATTEMPTS=45
          ATTEMPT=1

          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
            echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..."

            RESPONSE=$(curl -sfL --max-time 10 -H "User-Agent: GitHub-Actions-Rollout-Verifier" "$ENDPOINT" 2>/dev/null || true)

            if [ -n "$RESPONSE" ]; then
              LIVE_COMMIT=$(echo "$RESPONSE" | jq -r '.commit // empty')

              echo "  Live commit: ${LIVE_COMMIT:-<none>}"

              if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ]; then
                echo "✅ Success! Production docs has successfully rolled out $TARGET_COMMIT."
                exit 0
              fi
            else
              echo "  Endpoint did not return valid JSON or timed out."
            fi

            ATTEMPT=$((ATTEMPT + 1))
            sleep 10
          done

          echo "❌ Deployment verification timed out after 7.5 minutes."
          exit 1