pullpreview.yml

name: pullpreview
on:
  schedule:
    - cron: "30 */4 * * *"
  pull_request:
    types: [labeled, unlabeled, synchronize, closed, reopened, opened]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: read # to fetch code (actions/checkout)
  pull-requests: write # to remove labels / write PR comments

jobs:
  deploy_smoke_1:
    runs-on: ubuntu-slim
    if: >-
      github.event_name == 'schedule' ||
      github.event.label.name == 'pullpreview' ||
      ((github.event.action == 'opened' ||
        github.event.action == 'reopened' ||
        github.event.action == 'synchronize' ||
        github.event.action == 'closed') &&
       contains(github.event.pull_request.labels.*.name, 'pullpreview'))
    outputs:
      live: ${{ steps.pullpreview.outputs.live }}
    timeout-minutes: 35
    steps:
      - uses: actions/checkout@v6

      - name: Deploy smoke app (v1)
        id: pullpreview
        uses: "./"
        with:
          admins: "@collaborators/push"
          app_path: ./examples/workflow-smoke
          instance_type: micro
          max_domain_length: 30
          # Enable HTTPS preview URL through Caddy + Let's Encrypt.
          proxy_tls: web:8080
          # required here because the mysql image is private in GHCR
          registries: docker://${{ secrets.GHCR_PAT }}@ghcr.io
          # how long this instance will stay alive (each further commit will reset the timer)
          ttl: 1h
        env:
          AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
          AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"

      - name: Assert deploy v1 and DB seed state
        if: steps.pullpreview.outputs.live == 'true'
        shell: bash
        env:
          PREVIEW_URL: ${{ steps.pullpreview.outputs.url }}
        run: |
          set -euo pipefail

          if [[ "${PREVIEW_URL}" != https://* ]]; then
            echo "::error::Expected https preview URL when proxy_tls is enabled, got ${PREVIEW_URL}"
            exit 1
          fi

          response=""
          for attempt in $(seq 1 60); do
            response="$(curl -fsSL --max-time 15 "${PREVIEW_URL}" || true)"
            if grep -q 'Hello World Deploy 1' <<<"${response}" && \
              grep -q 'seed_count=1' <<<"${response}" && \
              grep -q 'seed_label=persisted' <<<"${response}"; then
              echo "Smoke v1 checks passed for ${PREVIEW_URL}"
              exit 0
            fi

            echo "Attempt ${attempt}/60: waiting for v1 response from ${PREVIEW_URL}"
            sleep 5
          done

          echo "::error::Unexpected response from ${PREVIEW_URL}"
          printf '%s\n' "${response}"
          exit 1

  deploy_smoke_2:
    runs-on: ubuntu-slim
    needs: deploy_smoke_1
    if: needs.deploy_smoke_1.result == 'success' && needs.deploy_smoke_1.outputs.live == 'true'
    timeout-minutes: 35
    steps:
      - uses: actions/checkout@v6

      - name: Update app payload to v2
        shell: bash
        run: |
          set -euo pipefail

          printf '%s\n' 'Hello World Deploy 2' > examples/workflow-smoke/web/message.txt

          # This file should be synced, but with persistent DB volume it should not run.
          cat > examples/workflow-smoke/dumps/999_should_not_run.sql <<'SQL'
          INSERT INTO seed_data (label) VALUES ('should-not-run');
          SQL

      - name: Redeploy smoke app (v2)
        id: pullpreview
        uses: "./"
        with:
          admins: "@collaborators/push"
          app_path: ./examples/workflow-smoke
          instance_type: micro
          max_domain_length: 30
          proxy_tls: web:8080
          registries: docker://${{ secrets.GHCR_PAT }}@ghcr.io
          ttl: 1h
        env:
          AWS_ACCESS_KEY_ID: "${{ secrets.AWS_ACCESS_KEY_ID }}"
          AWS_SECRET_ACCESS_KEY: "${{ secrets.AWS_SECRET_ACCESS_KEY }}"

      - name: Assert deploy v2 and DB persistence
        if: steps.pullpreview.outputs.live == 'true'
        shell: bash
        env:
          PREVIEW_URL: ${{ steps.pullpreview.outputs.url }}
        run: |
          set -euo pipefail

          if [[ "${PREVIEW_URL}" != https://* ]]; then
            echo "::error::Expected https preview URL when proxy_tls is enabled, got ${PREVIEW_URL}"
            exit 1
          fi

          response=""
          for attempt in $(seq 1 60); do
            response="$(curl -fsSL --max-time 15 "${PREVIEW_URL}" || true)"
            if grep -q 'Hello World Deploy 2' <<<"${response}" && \
              grep -q 'seed_count=1' <<<"${response}" && \
              grep -q 'seed_label=persisted' <<<"${response}"; then
              echo "Smoke v2 checks passed for ${PREVIEW_URL}"
              exit 0
            fi

            echo "Attempt ${attempt}/60: waiting for v2 response from ${PREVIEW_URL}"
            sleep 5
          done

          echo "::error::Unexpected response from ${PREVIEW_URL}"
          printf '%s\n' "${response}"
          exit 1

  deploy_smoke_hetzner:
    runs-on: ubuntu-slim
    if: >-
      github.event_name == 'schedule' ||
      github.event.label.name == 'pullpreview' ||
      ((github.event.action == 'opened' ||
        github.event.action == 'reopened' ||
        github.event.action == 'synchronize' ||
        github.event.action == 'closed') &&
       contains(github.event.pull_request.labels.*.name, 'pullpreview'))
    timeout-minutes: 35
    steps:
      - uses: actions/checkout@v6

      - name: Deploy smoke app on Hetzner
        id: pullpreview
        uses: "./"
        with:
          admins: "@collaborators/push"
          app_path: ./examples/workflow-smoke
          provider: hetzner
          region: ash
          image: ubuntu-24.04
          dns: rev2.click
          instance_type: cpx21
          max_domain_length: 30
          # required here because the mysql image is private in GHCR
          registries: docker://${{ secrets.GHCR_PAT }}@ghcr.io
          proxy_tls: web:8080
          ttl: 1h
        env:
          HCLOUD_TOKEN: "${{ secrets.HCLOUD_TOKEN }}"
          HETZNER_CA_KEY: "${{ secrets.HETZNER_CA_KEY }}"