vantage-app/.gitea/workflows/server-deploy.yml

name: Server Deploy

on:
    push:
        branches:
            - main
    # Manual runs rebuild everything: there is no "before" commit to diff
    # against, which the change detection below treats as "build it all". That
    # is also the escape hatch for a repo VARIABLE change — editing HQ_URL
    # pushes no commit, so nothing would rebuild on its own.
    workflow_dispatch:

jobs:
    deploy:
        runs-on: ubuntu-docker
        container: docker:dind
        steps:
            # git is needed twice over: actions/checkout clones with it, and the
            # change detection below diffs with it.
            - name: Setup
              run: apk add --update nodejs npm git

            - name: Checkout
              uses: actions/checkout@v4
              with:
                  # The default shallow clone has one commit, which cannot be
                  # diffed against the previous push.
                  fetch-depth: 0

            - name: Work out what changed
              id: changed
              run: |
                  set -eu

                  BEFORE="${{ github.event.before }}"
                  ZERO="0000000000000000000000000000000000000000"

                  # Build everything whenever the comparison cannot be trusted:
                  # a manual run, a brand-new branch, or a force-push whose old
                  # head is no longer in the repository. Listing every tracked
                  # file makes every filter below match, so there is no second
                  # code path to keep correct.
                  if [ -z "$BEFORE" ] || [ "$BEFORE" = "$ZERO" ] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
                      echo "No usable base commit — building every image."
                      git ls-files > /tmp/changed.txt
                  else
                      git diff --name-only "$BEFORE" HEAD > /tmp/changed.txt
                  fi

                  echo "--- changed files ---"
                  cat /tmp/changed.txt
                  echo "---------------------"

                  # A change to the workflow itself can change a build arg, and
                  # a build arg is baked into the image, so it rebuilds all.
                  if grep -qE '^\.gitea/workflows/' /tmp/changed.txt; then
                      ALL=1
                  else
                      ALL=0
                  fi

                  flag() {
                      name="$1"
                      pattern="$2"
                      if [ "$ALL" = "1" ] || grep -qE "$pattern" /tmp/changed.txt; then
                          echo "$name=true" >> "$GITHUB_OUTPUT"
                          echo "build $name"
                      else
                          echo "$name=false" >> "$GITHUB_OUTPUT"
                          echo "skip  $name"
                      fi
                  }

                  # shared/ is gone from this repository: it is the private
                  # module gitea.hostxtra.co.uk/vantage/vantage-shared, pinned
                  # per service in its own go.mod. A change over there reaches
                  # a service when somebody bumps that pin, which is a commit
                  # under the service's own directory and so already matches
                  # below. There is no longer a directory whose change fans out
                  # to three images, and no longer a way to ship a service
                  # against a shared/ it was never built with.
                  #
                  # proto/ is gone too. It documents the wire types, and it
                  # moved to sit beside the hand-written pb it describes, so
                  # that a message added to one is added to the other in the
                  # same commit. Nothing here reads it.
                  flag server    '^(server/|default_steps/|go\.work)'

                  # web/ uses its own directory as the build context, so
                  # nothing outside it can affect it. It is the only front end
                  # left here: the marketing site and the docs went to
                  # vantage-site and vantage-docs, the HQ console to
                  # vantage-admin.
                  flag web       '^web/'

            # vantage-shared is private, so every Go build below needs a
            # credential for it. A netrc is written once here rather than a
            # token being passed as a build arg, which would survive in the
            # builder layer's history.
            - name: Write the module fetch credential
              run: |
                  umask 077
                  printf 'machine gitea.hostxtra.co.uk\nlogin %s\npassword %s\n' \
                    "${{ secrets.REGISTRY_USER }}" "${{ secrets.RELEASE_TOKEN }}" \
                    > "$HOME/.netrc"

            - name: Log in to registry
              run: |
                  echo "${{ secrets.RELEASE_TOKEN }}" | \
                    docker login ${{ vars.DOCKER_HOST }} \
                      -u "${{ secrets.REGISTRY_USER }}" --password-stdin

            - name: Set up Go
              if: steps.changed.outputs.server == 'true'
              uses: actions/setup-go@v5
              with:
                  go-version: "1.26"
                  cache: true
                  cache-dependency-path: server/go.sum
              env:
                  GOPRIVATE: gitea.hostxtra.co.uk/*

            - name: Verify the OpenAPI document is current
              if: steps.changed.outputs.server == 'true'
              env:
                  GOPRIVATE: gitea.hostxtra.co.uk/*
              run: |
                  go install github.com/swaggo/swag/v2/cmd/swag@v2.0.0-rc5
                  cd server
                  go mod download gitea.hostxtra.co.uk/vantage/vantage-shared
                  SHARED_DIR="$(go list -m -f '{{.Dir}}' gitea.hostxtra.co.uk/vantage/vantage-shared)"
                  if [ -z "$SHARED_DIR" ] || [ ! -d "$SHARED_DIR" ]; then
                      echo "vantage-shared source not in the module cache: '$SHARED_DIR'" >&2
                      exit 1
                  fi
                  swag init --generalInfo cmd/main.go --dir "./,$SHARED_DIR" --output internal/api/docs --outputTypes json --v3.1
                  mv -f internal/api/docs/swagger.json internal/api/docs/openapi.json
                  git diff --exit-code internal/api/docs/openapi.json

            - name: Build and push server image
              if: steps.changed.outputs.server == 'true'
              run: |
                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/server:latest"
                  docker build --secret id=netrc,src="$HOME/.netrc" \
                    -t "$IMAGE" -f server/Dockerfile .
                  docker push "$IMAGE"

            - name: Build and push web image
              if: steps.changed.outputs.web == 'true'
              run: |
                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/web:latest"
                  docker build \
                    --build-arg NEXT_PUBLIC_HQ_URL="${{ vars.HQ_URL }}" \
                    -t "$IMAGE" \
                    -f web/Dockerfile web/
                  docker push "$IMAGE"