deploy.yml

name: Deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: agentcode-production-deploy
  cancel-in-progress: false

jobs:
  verify:
    name: Verify
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 11.11.0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      - name: Restore Next.js cache
        uses: actions/cache@v4
        with:
          path: .next/cache
          key: ${{ runner.os }}-next-${{ hashFiles('package.json', 'pnpm-lock.yaml') }}-${{ hashFiles('src/**/*', 'challenges/**/*', 'scripts/challenges/**/*', 'prisma/**/*', 'task-worker/**/*', 'tests/**/*', 'next.config.*', 'tsconfig.json', 'vitest.config.ts') }}
          restore-keys: |
            ${{ runner.os }}-next-${{ hashFiles('package.json', 'pnpm-lock.yaml') }}-

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Validate Prisma schema
        env:
          DATABASE_URL: postgresql://agentcode:agentcode@127.0.0.1:5432/agentcode?schema=public
        run: |
          pnpm exec prisma validate
          pnpm exec prisma generate

      - name: Validate challenge assets
        run: pnpm challenge:validate

      - name: Run evaluator fixtures
        run: pnpm challenge:fixtures

      - name: Test
        run: pnpm test

      - name: Typecheck
        run: pnpm typecheck

      - name: Lint
        run: pnpm lint

      - name: Build
        run: pnpm build

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: verify

    steps:
      - name: Configure SSH
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          printf '%s\n' "${{ secrets.DEPLOY_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/deploy_key ~/.ssh/known_hosts

      - name: Run deployment
        shell: bash
        run: |
          set -euo pipefail
          ssh \
            -i ~/.ssh/deploy_key \
            -o IdentitiesOnly=yes \
            -o StrictHostKeyChecking=yes \
            "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
            "sudo -n -u agentcode /usr/bin/bash /opt/agentcode/scripts/deploy.sh"