multi-env-pipeline-poc/.gitea/workflows/deploy-staging.yml

name: Deploy Staging

on:
  push:
    branches:
      - staging

env:
  REGISTRY_URL: ${{ vars.REGISTRY_URL }}
  IMAGE_NAME: ${{ vars.IMAGE_NAME }}
  APP_ENV: staging

jobs:
  build-and-push:
    name: Build and Push
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.meta.outputs.image_tag }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Gitea Registry
        run: |
          set -euo pipefail
          echo "${{ secrets.TOKEN }}" | docker login $REGISTRY_URL -u ${{ gitea.actor }} --password-stdin

      - name: Build and push
        id: meta
        run: |
          set -euo pipefail
          SHA_TAG="${{ gitea.sha }}"
          STAGING_TAG="staging-latest"
          BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

          docker buildx build \
            --push \
            --build-arg APP_VERSION=staging-${SHA_TAG} \
            --build-arg BUILD_DATE=${BUILD_DATE} \
            --build-arg GIT_COMMIT=${SHA_TAG} \
            --build-arg GIT_BRANCH=staging \
            -t ${REGISTRY_URL}/${IMAGE_NAME}:${STAGING_TAG} \
            -t ${REGISTRY_URL}/${IMAGE_NAME}:sha-${SHA_TAG} \
            .

          echo "image_tag=${STAGING_TAG}" >> $GITEA_OUTPUT
          echo "::notice::Image pushed: ${REGISTRY_URL}/${IMAGE_NAME}:${STAGING_TAG}"

  deploy:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: build-and-push
    steps:
      - name: Deploy via SSH
        run: |
          set -euo pipefail
          IMAGE_TAG="${{ needs.build-and-push.outputs.image_tag }}"

          eval $(ssh-agent -s)
          echo "${{ secrets.DEPLOY_SSH_KEY }}" | ssh-add -

          mkdir -p ~/.ssh
          ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

          # 1. Pasamos las variables como argumentos en el mismo orden
          ssh ${{ secrets.DEPLOY_USERNAME }}@${{ secrets.DEPLOY_HOST }} bash -s \
            "${{ env.REGISTRY_URL }}" \
            "${{ env.IMAGE_NAME }}" \
            "${IMAGE_TAG}" \
            "${{ gitea.sha }}" \
            "${{ gitea.actor }}" \
            "${{ gitea.run_id }}" \
            "${{ secrets.TOKEN }}" << 'EOF'
            set -euo pipefail
            
            # 2. Las recibimos dentro de la sesión remota
            REGISTRY_URL=$1
            IMAGE_NAME=$2
            IMAGE_TAG=$3
            GIT_SHA=$4
            GITEA_ACTOR=$5
            BUILD_NUMBER=$6
            TOKEN=$7
            
            # Variables locales del script
            GIT_BRANCH="staging"
            BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
            
            echo "Pulling image..."
            echo "$TOKEN" | docker login $REGISTRY_URL -u $GITEA_ACTOR --password-stdin
            docker pull $REGISTRY_URL/$IMAGE_NAME:$IMAGE_TAG
            
            echo "Stopping existing container..."
            docker stop cicd-staging 2>/dev/null || true
            docker rm cicd-staging 2>/dev/null || true
            
            echo "Starting new container..."
            docker run -d --name cicd-staging --restart unless-stopped -p 8082:80 \
              -e APP_ENV=staging \
              -e APP_VERSION=staging-${GIT_SHA} \
              -e GIT_COMMIT=${GIT_SHA} \
              -e GIT_BRANCH=${GIT_BRANCH} \
              -e BUILD_DATE=${BUILD_DATE} \
              -e DEPLOY_TIME=${BUILD_DATE} \
              -e BUILD_NUMBER=${BUILD_NUMBER} \
              $REGISTRY_URL/$IMAGE_NAME:$IMAGE_TAG
              
            echo "Waiting for health check..."
            HEALTHY=false
            for i in $(seq 1 12); do
              RESPONSE=$(curl -sf http://localhost:8082/health || echo "")
              if [ -n "$RESPONSE" ]; then
                ENV_VALUE=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['env'])" 2>/dev/null || echo "unknown")
                if [ "$ENV_VALUE" = "staging" ]; then
                  echo "::notice::Staging smoke tests passed"
                  HEALTHY=true
                  break
                fi
              fi
              sleep 5
            done
            if [ "$HEALTHY" = false ]; then
              echo "::error::Staging smoke tests/health check failed"
              exit 1
            fi
          EOF

  notify:
    name: Notification
    runs-on: ubuntu-latest
    needs: [build-and-push, deploy]
    if: always()
    steps:
      - name: Write summary
        run: |
          cat << 'SUMMARY' >> $GITEA_HOME/workflow/summary
          ## Staging Deployment ${{ needs.deploy.result }}

          **Branch:** staging
          **Commit:** ${{ gitea.sha }}
          **Image:** ${{ vars.REGISTRY_URL }}/${{ vars.IMAGE_NAME }}:staging-latest
          **URL:** https://practicas.staging.kubistudio.cloud
          SUMMARY