Develop

.deploy.env.example

@@ -0,0 +1,4 @@
+# Deployment image references used by docker-compose on servers
+# Provide full image references including registry and tag
+BACKEND_IMAGE=
+FRONTEND_IMAGE=

.dockerignore

@@ -0,0 +1,28 @@
+# cache
+__pycache__/
+.mypy_cache
+.ruff_cache
+*.py[cod]
+*.pyo
+*.pyd
+*.db
+
+# Virtual environments
+backend/.venv/
+env/
+venv/
+
+# Editor & OS files
+.idea/
+.vscode/
+
+# Logs
+*.log
+
+# Git
+.git/
+.gitignore
+
+# Secrets & environment files
+.env
+.env.*

.github/workflows/ci-cd-dev.yml

@@ -0,0 +1,245 @@
+name: CI/CD Dev
+
+on:
+  # Any PR to develop → tests + lint + type-check only (no deploy)
+  pull_request:
+    branches:
+      - develop
+  # Push to develop branch → CI + build + deploy to dev VM
+  push:
+    branches:
+      - develop
+
+env:
+  BACKEND_IMAGE_NAME: snippetly-backend
+  FRONTEND_IMAGE_NAME: snippetly-frontend
+
+jobs:
+  backend-tests:
+    name: Backend Tests + Ruff + Pyright (Dev)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Install dependencies (tests + dev tooling)
+        working-directory: ./backend
+        run: |
+          uv sync --group test --group dev
+
+      - name: Ruff lint
+        working-directory: ./backend
+        run: |
+          uv run ruff check .
+
+      - name: Pyright type-check
+        working-directory: ./backend
+        run: |
+          uv run pyright
+
+  frontend-build:
+    name: Frontend Build (Dev)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: ./frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: ./frontend
+        run: npm ci
+
+      - name: Build
+        working-directory: ./frontend
+        run: npm run build
+
+      - name: Run tests
+        working-directory: ./frontend
+        run: npm test
+
+  build-push-dev:
+    name: Build & Push Images (Dev)
+    runs-on: ubuntu-latest
+    # Only on push to develop branch (not on PRs)
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    needs: [ backend-tests, frontend-build ]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker login to ACR (Dev, Service Principal)
+        run: |
+          echo "${{ secrets.DEV_AZURE_SP_PASSWORD }}" | docker login "${{ secrets.DEV_ACR_LOGIN_SERVER }}" \
+            -u "${{ secrets.DEV_AZURE_SP_APP_ID }}" \
+            --password-stdin
+
+      - name: Build & push backend
+        uses: docker/build-push-action@v5
+        with:
+          context: ./backend
+          file: ./backend/Dockerfile
+          push: true
+          tags: ${{ secrets.DEV_ACR_LOGIN_SERVER }}/${{ env.BACKEND_IMAGE_NAME }}:${{ github.sha }}
+          cache-from: type=registry,ref=${{ secrets.DEV_ACR_LOGIN_SERVER }}/${{ env.BACKEND_IMAGE_NAME }}:cache
+          cache-to: type=registry,ref=${{ secrets.DEV_ACR_LOGIN_SERVER }}/${{ env.BACKEND_IMAGE_NAME }}:cache,mode=max
+
+      - name: Build & push frontend (Nginx)
+        uses: docker/build-push-action@v5
+        with:
+          context: ./frontend
+          file: ./frontend/Dockerfile
+          push: true
+          tags: ${{ secrets.DEV_ACR_LOGIN_SERVER }}/${{ env.FRONTEND_IMAGE_NAME }}:${{ github.sha }}
+          build-args: |
+            VITE_SERVER_BASE_URL=${{ secrets.DEV_PUBLIC_URL || format('http://{0}', secrets.DEV_SSH_HOST) }}
+          cache-from: type=registry,ref=${{ secrets.DEV_ACR_LOGIN_SERVER }}/${{ env.FRONTEND_IMAGE_NAME }}:cache
+          cache-to: type=registry,ref=${{ secrets.DEV_ACR_LOGIN_SERVER }}/${{ env.FRONTEND_IMAGE_NAME }}:cache,mode=max
+
+  deploy-dev:
+    name: Deploy to Azure VM (Dev)
+    runs-on: ubuntu-latest
+    # Only on push to develop branch (not on PRs)
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    needs: [ build-push-dev ]
+    environment: dev
+    concurrency:
+      group: cd-dev
+      cancel-in-progress: true
+    steps:
+      - name: Deploy over SSH
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DEV_SSH_HOST }}
+          username: ${{ secrets.DEV_SSH_USER }}
+          key: ${{ secrets.DEV_SSH_KEY }}
+          script_stop: true
+          script: |
+            set -euo pipefail
+            cd /opt/snippetly
+
+            # Rollback function
+            rollback() {
+              echo "❌ Deployment failed! Rolling back to previous version..."
+              if [ -f .deploy.env.bak ]; then
+                mv .deploy.env.bak .deploy.env
+                set -a
+                . ./.deploy.env
+                set +a
+                docker compose -f docker-compose.yml -f docker-compose.override.yml pull || true
+                docker compose -f docker-compose.yml -f docker-compose.override.yml up -d || true
+                echo "✅ Rollback completed"
+              else
+                echo "⚠️ No backup found, cannot rollback"
+              fi
+              exit 1
+            }
+
+            # Trap errors for rollback
+            trap 'rollback' ERR
+
+            # Pull latest code from develop branch
+            echo "Pulling latest code from develop branch..."
+            git fetch origin
+            git checkout develop
+            git pull origin develop
+
+            # Ensure .deploy.env exists
+            if [ ! -f .deploy.env ]; then
+              cat > .deploy.env << 'EOF'
+            BACKEND_IMAGE=
+            FRONTEND_IMAGE=
+            EOF
+            fi
+
+            # Compute image tags for this run (same as in build-push-dev)
+            BACKEND_IMAGE="${{ secrets.DEV_ACR_LOGIN_SERVER }}/${{ env.BACKEND_IMAGE_NAME }}:${{ github.sha }}"
+            FRONTEND_IMAGE="${{ secrets.DEV_ACR_LOGIN_SERVER }}/${{ env.FRONTEND_IMAGE_NAME }}:${{ github.sha }}"
+
+            echo "Updating deployment configuration..."
+            # Update images in .deploy.env (creates .bak file automatically)
+            sed -i.bak \
+            -e "s|^BACKEND_IMAGE=.*$|BACKEND_IMAGE=${BACKEND_IMAGE}|" \
+            -e "s|^FRONTEND_IMAGE=.*$|FRONTEND_IMAGE=${FRONTEND_IMAGE}|" \
+            .deploy.env
+
+            # Load deployment environment
+            set -a
+            # shellcheck source=/dev/null
+            . ./.deploy.env
+            set +a
+
+            echo "Using BACKEND_IMAGE=$BACKEND_IMAGE"
+            echo "Using FRONTEND_IMAGE=$FRONTEND_IMAGE"
+
+            # Login to ACR
+            echo "Logging into Azure Container Registry..."
+            echo "${{ secrets.DEV_AZURE_SP_PASSWORD }}" | docker login "${{ secrets.DEV_ACR_LOGIN_SERVER }}" \
+              -u "${{ secrets.DEV_AZURE_SP_APP_ID }}" \
+              --password-stdin
+
+            # Pull and deploy (Dev: use base compose + override for pgadmin + exposed ports)
+            echo "Pulling Docker images..."
+            docker compose -f docker-compose.yml -f docker-compose.override.yml pull
+
+            echo "Starting services..."
+            docker compose -f docker-compose.yml -f docker-compose.override.yml up -d
+
+            # Wait for services to be healthy
+            echo "Waiting for services to be healthy..."
+            sleep 30
+
+            # Verify deployment - critical services must be running
+            echo "Verifying deployment..."
+            docker compose -f docker-compose.yml -f docker-compose.override.yml ps
+
+            # Health check: ensure backend is responding (with retry)
+            echo "Performing health check..."
+            MAX_RETRIES=10
+            RETRY_COUNT=0
+            HEALTH_CHECK_URL="http://${{ secrets.DEV_SSH_HOST }}/api/health"
+
+            while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
+              if curl -f -s "$HEALTH_CHECK_URL" > /dev/null 2>&1; then
+                echo "✅ Health check passed!"
+                break
+              fi
+
+              RETRY_COUNT=$((RETRY_COUNT + 1))
+              if [ $RETRY_COUNT -lt $MAX_RETRIES ]; then
+                echo "⏳ Health check attempt $RETRY_COUNT/$MAX_RETRIES failed, retrying in 5s..."
+                sleep 5
+              else
+                echo "❌ Health check failed after $MAX_RETRIES attempts!"
+                echo "Backend logs:"
+                docker logs snippetly-backend --tail 50 || true
+                exit 1
+              fi
+            done
+
+            echo "✅ Deployment successful! Cleaning up backup..."
+            rm -f .deploy.env.bak
+
+            # Cleanup old images (keep images from last 24 hours for dev)
+            echo "Cleaning up old Docker images..."
+            docker image prune -af --filter "until=24h" || true
+
+            echo "Dev deployment completed successfully!"