alrahma_sunday_school/.gitea/workflows/deploy.yml

name: Deploy to Shared Hosting

on:
  push:
    branches:
      - develop
  workflow_dispatch:
    inputs:
      target:
        description: 'Deployment target'
        required: true
        default: 'production'

jobs:
  deploy:
    name: Shared hosting deploy
    runs-on: ubuntu-latest

    env:
      DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
      DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
      DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
      DEPLOY_APP_PATH: ${{ secrets.DEPLOY_APP_PATH }}
      DEPLOY_PUBLIC_PATH: ${{ secrets.DEPLOY_PUBLIC_PATH }}
      DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
      DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
      DEPLOY_PHP_BIN: ${{ secrets.DEPLOY_PHP_BIN }}
      DEPLOY_INDEX_REQUIRE: ${{ secrets.DEPLOY_INDEX_REQUIRE }}
      GITEA_BASE_URL: ${{ secrets.GITEA_BASE_URL }}
      GITEA_PACKAGE_OWNER: ${{ secrets.GITEA_PACKAGE_OWNER }}
      GITEA_PACKAGE_USER: ${{ secrets.GITEAPACKAGEUSER }}
      GITEA_PACKAGE_TOKEN: ${{ secrets.GITEAPACKAGETOKEN }}
      GIT_SSL_NO_VERIFY: 'true'

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        env:
          GIT_SSL_NO_VERIFY: 'true'

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: dom, gd, intl, mbstring, mysqli, zip
          coverage: none

      - name: Validate Composer config
        run: composer validate --no-check-publish --strict

      - name: Install production dependencies
        run: composer install --no-dev --no-interaction --prefer-dist --no-progress --optimize-autoloader

      - name: Create deployment artifact
        run: bash scripts/build-deploy-artifact.sh

      - name: Publish deployment package
        if: ${{ env.GITEA_PACKAGE_USER != '' && env.GITEA_PACKAGE_TOKEN != '' }}
        run: |
          BASE_URL="${GITEA_BASE_URL:-https://192.168.3.80}"
          PACKAGE_OWNER="${GITEA_PACKAGE_OWNER:-melabidi}"
          PACKAGE_NAME="alrahma_sunday_school"
          REF_NAME="${GITHUB_REF_NAME:-manual}"
          SHORT_SHA="$(printf '%s' "${GITHUB_SHA}" | cut -c1-7)"
          VERSION="$(printf '%s-%s-%s' "${REF_NAME}" "${GITHUB_RUN_NUMBER}" "${SHORT_SHA}" | sed 's/[^A-Za-z0-9._+-]/-/g')"
          FILE_NAME="${PACKAGE_NAME}-${VERSION}.tar.gz"
          PACKAGE_URL="${BASE_URL}/api/packages/${PACKAGE_OWNER}/generic/${PACKAGE_NAME}/${VERSION}/${FILE_NAME}"

          tar -czf "build/${FILE_NAME}" -C build/deploy .
          echo "Publishing package ${PACKAGE_NAME} ${VERSION}"

          curl --fail-with-body --insecure \
            --user "${GITEA_PACKAGE_USER}:${GITEA_PACKAGE_TOKEN}" \
            --upload-file "build/${FILE_NAME}" \
            "${PACKAGE_URL}"

          echo "Package uploaded: ${PACKAGE_URL}"

      - name: Resolve shared-hosting paths
        run: |
          APP_PATH="${DEPLOY_APP_PATH:-${DEPLOY_PATH}}"
          PUBLIC_PATH="${DEPLOY_PUBLIC_PATH}"

          if [ -z "${APP_PATH}" ]; then
            echo "Set DEPLOY_APP_PATH (application directory next to public_html)."
            echo "Example: /home/u280815660/domains/home.alrahmaisgl.org/alrahma"
            exit 1
          fi

          if [ -z "${PUBLIC_PATH}" ]; then
            PUBLIC_PATH="$(dirname "${APP_PATH}")/public_html"
            echo "DEPLOY_PUBLIC_PATH is not set; using ${PUBLIC_PATH}"
          fi

          echo "APP_PATH=${APP_PATH}" >> "$GITHUB_ENV"
          echo "PUBLIC_PATH=${PUBLIC_PATH}" >> "$GITHUB_ENV"
          echo "SSH_PORT=${DEPLOY_PORT:-65002}" >> "$GITHUB_ENV"
          echo "PHP_BIN=${DEPLOY_PHP_BIN:-/opt/alt/php85/usr/bin/php}" >> "$GITHUB_ENV"
          echo "INDEX_REQUIRE=${DEPLOY_INDEX_REQUIRE:-../alrahma/app/Config/Paths.php}" >> "$GITHUB_ENV"

      - name: Configure SSH
        run: |
          test -n "${DEPLOY_HOST}"
          test -n "${DEPLOY_USER}"
          test -n "${DEPLOY_SSH_KEY}"

          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "${DEPLOY_SSH_KEY}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key

          {
            echo "Host shared-hosting"
            echo "  HostName ${DEPLOY_HOST}"
            echo "  User ${DEPLOY_USER}"
            echo "  Port ${SSH_PORT}"
            echo "  IdentityFile ~/.ssh/deploy_key"
            echo "  IdentitiesOnly yes"
            echo "  StrictHostKeyChecking accept-new"
            echo "  ServerAliveInterval 30"
          } > ~/.ssh/config
          chmod 600 ~/.ssh/config

          ssh-keyscan -p "${SSH_PORT}" "${DEPLOY_HOST}" >> ~/.ssh/known_hosts || true

      - name: Prepare remote directories
        run: |
          ssh shared-hosting "mkdir -p \
            '${APP_PATH}' \
            '${APP_PATH}/writable/cache' \
            '${APP_PATH}/writable/logs' \
            '${APP_PATH}/writable/session' \
            '${APP_PATH}/writable/uploads' \
            '${APP_PATH}/writable/debugbar' \
            '${APP_PATH}/writable/reports' \
            '${PUBLIC_PATH}'"

      - name: Deploy application files
        run: |
          rsync -az --delete \
            -e ssh \
            --exclude '.env' \
            --exclude 'writable/cache/***' \
            --exclude 'writable/logs/***' \
            --exclude 'writable/session/***' \
            --exclude 'writable/uploads/***' \
            --exclude 'writable/debugbar/***' \
            --exclude 'writable/reports/***' \
            build/deploy/ "shared-hosting:${APP_PATH}/"

      - name: Deploy public_html document root
        run: |
          rsync -az --delete \
            -e ssh \
            --exclude 'uploads/***' \
            --exclude 'cgi-bin/***' \
            --exclude '.well-known/***' \
            --exclude 'error_log' \
            --exclude 'default.php' \
            build/deploy/public/ "shared-hosting:${PUBLIC_PATH}/"

      - name: Finalize shared-hosting release
        run: |
          ssh shared-hosting "APP_PATH=$(printf '%q' "${APP_PATH}") PUBLIC_PATH=$(printf '%q' "${PUBLIC_PATH}") INDEX_REQUIRE=$(printf '%q' "${INDEX_REQUIRE}") PHP_BIN=$(printf '%q' "${PHP_BIN}") bash -s" <<'REMOTE'
          set -euo pipefail

          test -f "${PUBLIC_PATH}/index.php"
          test -d "${APP_PATH}/app"
          test -d "${APP_PATH}/vendor"

          grep -q "require FCPATH . '" "${PUBLIC_PATH}/index.php"
          sed -i "s|require FCPATH . '../[^']*app/Config/Paths.php';|require FCPATH . '${INDEX_REQUIRE}';|" "${PUBLIC_PATH}/index.php"
          grep -F "require FCPATH . '${INDEX_REQUIRE}';" "${PUBLIC_PATH}/index.php"

          chmod 644 "${PUBLIC_PATH}/index.php" "${PUBLIC_PATH}/.htaccess" || true
          find "${PUBLIC_PATH}" -type d -exec chmod 755 {} +
          find "${APP_PATH}/writable" -type d -exec chmod 775 {} + || true
          find "${APP_PATH}/writable" -type f -exec chmod 664 {} + || true

          if [ -x "${PHP_BIN}" ]; then
            (cd "${APP_PATH}" && "${PHP_BIN}" spark cache:clear) || true
          else
            (cd "${APP_PATH}" && php spark cache:clear) || true
          fi

          echo "Deployed app to ${APP_PATH}"
          echo "Deployed document root to ${PUBLIC_PATH}"
          echo "index.php requires ${INDEX_REQUIRE}"
          REMOTE