Inboxintel/.gitea/workflows/deploy-staging.yml

name: Deploy Staging

# Continuous deployment to the LOCAL staging stack. Fires when develop advances
# (i.e. after a PR is merged into develop), rebuilding and restarting the isolated
# staging stack on this machine.
#
# Runs on the self-hosted host-mode runner (labels: self-hosted, windows) so it can
# reach the host's Docker and publish to localhost:18081. Because the runner does a
# fresh checkout that (correctly) does NOT contain the git-ignored deploy/.env.staging,
# the staging secrets are supplied as Gitea Actions secrets and the env file is
# regenerated here at deploy time.
on:
  push:
    branches: [develop]
  workflow_dispatch: {}      # also allow a manual "Run workflow" from the Gitea UI

jobs:
  deploy:
    runs-on: [self-hosted, windows]
    steps:
      - uses: actions/checkout@v4

      - name: Write staging env from secrets
        shell: powershell
        # Per-line writes (not a here-string) so the step can't be broken by how the
        # runner indents/wraps the script. Gitea substitutes ${{ secrets.* }} first;
        # ascii = no BOM, which docker compose's env parser needs.
        run: |
          Set-Content deploy/.env.staging "POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }}" -Encoding ascii
          Add-Content deploy/.env.staging "GOOGLE_CLIENT_ID=${{ secrets.STAGING_GOOGLE_CLIENT_ID }}" -Encoding ascii
          Add-Content deploy/.env.staging "GOOGLE_CLIENT_SECRET=${{ secrets.STAGING_GOOGLE_CLIENT_SECRET }}" -Encoding ascii
          Add-Content deploy/.env.staging "AI_MODE=Disabled" -Encoding ascii
          Add-Content deploy/.env.staging "FRONTEND_ORIGIN=http://localhost:18081" -Encoding ascii
          Add-Content deploy/.env.staging "MAX_MESSAGES=2000" -Encoding ascii
          Write-Host "wrote $((Get-Content deploy/.env.staging).Count) env lines"

      - name: Redeploy staging stack
        shell: powershell
        run: |
          docker compose -p inboxintel-staging `
            --env-file deploy/.env.staging `
            -f docker-compose.yml -f docker-compose.staging.yml `
            up -d --build
          docker compose -p inboxintel-staging ps

      - name: Verify staging health
        shell: powershell
        # 'up -d' returns as soon as containers START, so a container that crashes
        # on boot (e.g. bad DB password) would still report success. Poll the actual
        # endpoints and fail the job if either isn't serving, dumping api logs so the
        # cause is visible in the run. ASCII only (Windows PowerShell reads .ps1 as ANSI).
        run: |
          $ok = $false
          foreach ($i in 1..20) {
            Start-Sleep -Seconds 3
            try { Invoke-WebRequest "http://localhost:18081/" -UseBasicParsing -TimeoutSec 5 | Out-Null; $fe = 200 }
            catch { $fe = 0 }
            # A 401 from the api means it is serving (auth enforced); Invoke-WebRequest
            # throws on non-2xx, so read the status code off the exception.
            try { Invoke-WebRequest "http://localhost:18080/api/v1/auth/me" -UseBasicParsing -TimeoutSec 5 | Out-Null; $api = 200 }
            catch { $api = $_.Exception.Response.StatusCode.value__; if (-not $api) { $api = 0 } }
            Write-Host "attempt $i - frontend=$fe api=$api"
            if ($fe -eq 200 -and $api -gt 0) { $ok = $true; break }
          }
          if (-not $ok) {
            Write-Host "Staging health check FAILED. Last 40 api log lines:"
            docker logs inboxintel-staging-api-1 --tail 40
            exit 1
          }
          Write-Host "Staging healthy - Frontend http://localhost:18081  API http://localhost:18080"