wifi-densepose/.github/workflows/cd.yml

name: Continuous Deployment

on:
  push:
    branches: [ main ]
    tags: [ 'v*' ]
  workflow_run:
    workflows: ["Continuous Integration"]
    types:
      - completed
    branches: [ main ]
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deployment environment'
        required: true
        default: 'staging'
        type: choice
        options:
        - staging
        - production
      force_deploy:
        description: 'Force deployment (skip checks)'
        required: false
        default: false
        type: boolean

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}

jobs:
  # Pre-deployment checks
  pre-deployment:
    name: Pre-deployment Checks
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch'
    outputs:
      deploy_env: ${{ steps.determine-env.outputs.environment }}
      image_tag: ${{ steps.determine-tag.outputs.tag }}
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Determine deployment environment
      id: determine-env
      env:
        # Use environment variable to prevent shell injection
        GITHUB_EVENT_NAME: ${{ github.event_name }}
        GITHUB_REF: ${{ github.ref }}
        GITHUB_INPUT_ENVIRONMENT: ${{ github.event.inputs.environment }}
      run: |
        if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
          echo "environment=$GITHUB_INPUT_ENVIRONMENT" >> $GITHUB_OUTPUT
        elif [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
          echo "environment=staging" >> $GITHUB_OUTPUT
        elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then
          echo "environment=production" >> $GITHUB_OUTPUT
        else
          echo "environment=staging" >> $GITHUB_OUTPUT
        fi

    - name: Determine image tag
      id: determine-tag
      run: |
        if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
          echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
        else
          echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
        fi

    - name: Verify image exists
      run: |
        docker manifest inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.determine-tag.outputs.tag }}

  # Deploy to staging
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: [pre-deployment]
    if: needs.pre-deployment.outputs.deploy_env == 'staging'
    environment:
      name: staging
      url: https://staging.wifi-densepose.com
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up kubectl
      uses: azure/setup-kubectl@v3
      with:
        version: 'v1.28.0'

    - name: Configure kubectl
      run: |
        echo "${{ secrets.KUBE_CONFIG_DATA_STAGING }}" | base64 -d > kubeconfig
        export KUBECONFIG=kubeconfig

    - name: Deploy to staging namespace
      run: |
        export KUBECONFIG=kubeconfig
        
        # Update image tag in deployment
        kubectl set image deployment/wifi-densepose wifi-densepose=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.pre-deployment.outputs.image_tag }} -n wifi-densepose-staging
        
        # Wait for rollout to complete
        kubectl rollout status deployment/wifi-densepose -n wifi-densepose-staging --timeout=600s
        
        # Verify deployment
        kubectl get pods -n wifi-densepose-staging -l app=wifi-densepose

    - name: Run smoke tests
      run: |
        sleep 30
        curl -f https://staging.wifi-densepose.com/health || exit 1
        curl -f https://staging.wifi-densepose.com/api/v1/info || exit 1

    - name: Run integration tests against staging
      run: |
        python -m pytest tests/integration/ --base-url=https://staging.wifi-densepose.com -v

  # Deploy to production
  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [pre-deployment, deploy-staging]
    if: needs.pre-deployment.outputs.deploy_env == 'production' || (github.ref == 'refs/tags/v*' && needs.deploy-staging.result == 'success')
    environment:
      name: production
      url: https://wifi-densepose.com
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up kubectl
      uses: azure/setup-kubectl@v3
      with:
        version: 'v1.28.0'

    - name: Configure kubectl
      run: |
        echo "${{ secrets.KUBE_CONFIG_DATA_PRODUCTION }}" | base64 -d > kubeconfig
        export KUBECONFIG=kubeconfig

    - name: Pre-deployment backup
      run: |
        export KUBECONFIG=kubeconfig
        
        # Backup current deployment
        kubectl get deployment wifi-densepose -n wifi-densepose -o yaml > backup-deployment.yaml
        
        # Backup database
        kubectl exec -n wifi-densepose deployment/postgres -- pg_dump -U wifi_user wifi_densepose > backup-db.sql

    - name: Blue-Green Deployment
      run: |
        export KUBECONFIG=kubeconfig
        
        # Create green deployment
        kubectl patch deployment wifi-densepose -n wifi-densepose -p '{"spec":{"template":{"metadata":{"labels":{"version":"green"}}}}}'
        kubectl set image deployment/wifi-densepose wifi-densepose=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.pre-deployment.outputs.image_tag }} -n wifi-densepose
        
        # Wait for green deployment to be ready
        kubectl rollout status deployment/wifi-densepose -n wifi-densepose --timeout=600s
        
        # Verify green deployment health
        kubectl wait --for=condition=ready pod -l app=wifi-densepose,version=green -n wifi-densepose --timeout=300s

    - name: Traffic switching validation
      run: |
        export KUBECONFIG=kubeconfig
        
        # Get green pod IP for direct testing
        GREEN_POD=$(kubectl get pods -n wifi-densepose -l app=wifi-densepose,version=green -o jsonpath='{.items[0].metadata.name}')
        
        # Test green deployment directly
        kubectl exec -n wifi-densepose $GREEN_POD -- curl -f http://localhost:8000/health
        kubectl exec -n wifi-densepose $GREEN_POD -- curl -f http://localhost:8000/api/v1/info

    - name: Switch traffic to green
      run: |
        export KUBECONFIG=kubeconfig
        
        # Update service selector to point to green
        kubectl patch service wifi-densepose-service -n wifi-densepose -p '{"spec":{"selector":{"version":"green"}}}'
        
        # Wait for traffic switch
        sleep 30

    - name: Production smoke tests
      run: |
        curl -f https://wifi-densepose.com/health || exit 1
        curl -f https://wifi-densepose.com/api/v1/info || exit 1

    - name: Cleanup old deployment
      run: |
        export KUBECONFIG=kubeconfig
        
        # Remove blue version label from old pods
        kubectl label pods -n wifi-densepose -l app=wifi-densepose,version!=green version-
        
        # Scale down old replica set (optional)
        # kubectl scale rs -n wifi-densepose -l app=wifi-densepose,version!=green --replicas=0

    - name: Upload deployment artifacts
      uses: actions/upload-artifact@v3
      with:
        name: production-deployment-${{ github.run_number }}
        path: |
          backup-deployment.yaml
          backup-db.sql

  # Rollback capability
  rollback:
    name: Rollback Deployment
    runs-on: ubuntu-latest
    if: failure() && (needs.deploy-staging.result == 'failure' || needs.deploy-production.result == 'failure')
    needs: [pre-deployment, deploy-staging, deploy-production]
    environment:
      name: ${{ needs.pre-deployment.outputs.deploy_env }}
    steps:
    - name: Set up kubectl
      uses: azure/setup-kubectl@v3
      with:
        version: 'v1.28.0'

    - name: Configure kubectl
      run: |
        if [[ "${{ needs.pre-deployment.outputs.deploy_env }}" == "production" ]]; then
          echo "${{ secrets.KUBE_CONFIG_DATA_PRODUCTION }}" | base64 -d > kubeconfig
          NAMESPACE="wifi-densepose"
        else
          echo "${{ secrets.KUBE_CONFIG_DATA_STAGING }}" | base64 -d > kubeconfig
          NAMESPACE="wifi-densepose-staging"
        fi
        export KUBECONFIG=kubeconfig
        echo "NAMESPACE=$NAMESPACE" >> $GITHUB_ENV

    - name: Rollback deployment
      run: |
        export KUBECONFIG=kubeconfig
        
        # Rollback to previous version
        kubectl rollout undo deployment/wifi-densepose -n ${{ env.NAMESPACE }}
        
        # Wait for rollback to complete
        kubectl rollout status deployment/wifi-densepose -n ${{ env.NAMESPACE }} --timeout=600s
        
        # Verify rollback
        kubectl get pods -n ${{ env.NAMESPACE }} -l app=wifi-densepose

  # Post-deployment monitoring
  post-deployment:
    name: Post-deployment Monitoring
    runs-on: ubuntu-latest
    needs: [deploy-staging, deploy-production]
    if: always() && (needs.deploy-staging.result == 'success' || needs.deploy-production.result == 'success')
    steps:
    - name: Monitor deployment health
      run: |
        ENV="${{ needs.pre-deployment.outputs.deploy_env }}"
        if [[ "$ENV" == "production" ]]; then
          BASE_URL="https://wifi-densepose.com"
        else
          BASE_URL="https://staging.wifi-densepose.com"
        fi
        
        # Monitor for 5 minutes
        for i in {1..10}; do
          echo "Health check $i/10"
          curl -f $BASE_URL/health || exit 1
          curl -f $BASE_URL/api/v1/status || exit 1
          sleep 30
        done

    - name: Update deployment status
      uses: actions/github-script@v6
      with:
        script: |
          const deployEnv = '${{ needs.pre-deployment.outputs.deploy_env }}';
          const environmentUrl = deployEnv === 'production' ? 'https://wifi-densepose.com' : 'https://staging.wifi-densepose.com';
          
          const { data: deployment } = await github.rest.repos.createDeploymentStatus({
            owner: context.repo.owner,
            repo: context.repo.repo,
            deployment_id: context.payload.deployment.id,
            state: 'success',
            environment_url: environmentUrl,
            description: 'Deployment completed successfully'
          });

  # Notification
  notify:
    name: Notify Deployment Status
    runs-on: ubuntu-latest
    needs: [deploy-staging, deploy-production, post-deployment]
    if: always()
    steps:
    - name: Notify Slack on success
      if: needs.deploy-production.result == 'success' || needs.deploy-staging.result == 'success'
      uses: 8398a7/action-slack@v3
      with:
        status: success
        channel: '#deployments'
        text: |
          🚀 Deployment successful!
          Environment: ${{ needs.pre-deployment.outputs.deploy_env }}
          Image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.pre-deployment.outputs.image_tag }}
          URL: https://${{ needs.pre-deployment.outputs.deploy_env == 'production' && 'wifi-densepose.com' || 'staging.wifi-densepose.com' }}
      env:
        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

    - name: Notify Slack on failure
      if: needs.deploy-production.result == 'failure' || needs.deploy-staging.result == 'failure'
      uses: 8398a7/action-slack@v3
      with:
        status: failure
        channel: '#deployments'
        text: |
          ❌ Deployment failed!
          Environment: ${{ needs.pre-deployment.outputs.deploy_env }}
          Please check the logs and consider rollback if necessary.
      env:
        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

    - name: Create deployment issue on failure
      if: needs.deploy-production.result == 'failure'
      uses: actions/github-script@v6
      with:
        script: |
          github.rest.issues.create({
            owner: context.repo.owner,
            repo: context.repo.repo,
            title: `Production Deployment Failed - ${new Date().toISOString()}`,
            body: `
            ## Deployment Failure Report
            
            **Environment:** Production
            **Image Tag:** ${{ needs.pre-deployment.outputs.image_tag }}
            **Workflow Run:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
            
            **Action Required:**
            - [ ] Investigate deployment failure
            - [ ] Consider rollback if necessary
            - [ ] Fix underlying issues
            - [ ] Re-deploy when ready
            
            **Logs:** Check the workflow run for detailed error messages.
            `,
            labels: ['deployment', 'production', 'urgent']
          })