cicd.yml

name: CI/CD

on:
  # Runs on PRs to master and on pushes (merge) to master
  pull_request:
    branches: [ "master" ]
  push:
    branches: [ "master" ]
  workflow_dispatch:

# Minimal permissions + permission to publish packages to GHCR
permissions:
  contents: read
  packages: write

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  tests:
    name: Tests
    runs-on: ubuntu-latest
    steps:
      # Checkout code
      - name: Check out code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # better for versioning (tags/commits)

      # Set up Java 21 (Temurin) for tests
      - name: Set up Java 21 (Temurin)
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      # Set up Gradle cache automatically
      - name: Setup Gradle (with caching)
        uses: gradle/actions/setup-gradle@v4

      # Ensure wrapper has execute permission
      - name: Make Gradle wrapper executable
        run: chmod +x gradlew

      # Run test suite
      - name: Run unit tests
        run: ./gradlew --no-daemon clean test

      # Upload test reports always, even on failure
      - name: Upload test reports (always)
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: test-reports
          path: |
            build/test-results/test
            build/reports/tests/test

  build_and_publish:
    name: Build, Docker and Push
    runs-on: ubuntu-latest
    needs: tests
    if: false
    env:
      # Base image name (adjust as needed)
      APP_NAME: espacogeek-api



    steps:
      # Checkout code (with full history for versioning)
      - name: Check out code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Normalize owner/repo to lowercase (GHCR requirement)
      - name: Normalize GHCR owner/repo
        shell: bash
        run: |
          OWNER_LC="${GITHUB_REPOSITORY_OWNER,,}"
          REPO_LC="${GITHUB_REPOSITORY#*/}"
          REPO_LC="${REPO_LC,,}"
          echo "GHCR_OWNER_LC=${OWNER_LC}" >> "$GITHUB_ENV"
          echo "GHCR_REPO_LC=${REPO_LC}" >> "$GITHUB_ENV"

      # Set up Java 21 (Temurin) for WAR build
      - name: Set up Java 21 (Temurin)
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      # Set up Gradle cache for builds
      - name: Setup Gradle (with caching)
        uses: gradle/actions/setup-gradle@v4

      # Ensure wrapper has execute permission (Linux runners)
      - name: Make Gradle wrapper executable
        run: chmod +x gradlew

      # Read the project version defined in build.gradle (project.version)
      - name: Read Gradle project version
        id: gradle_version
        shell: bash
        run: |
          echo "version=$(./gradlew -q properties | sed -n 's/^version: \(.*\)$/\1/p')" >> "$GITHUB_OUTPUT"

      # Generate version tags for Docker images and artifacts
      # - On PR: pr-<number>-<short-sha>, v<version>-pr-<number>
      # - On push to master: latest, sha-<short-sha>, <yyyyMMdd>, v<version>
      - name: Compute version tags
        id: vars
        shell: bash
        run: |
          set -euo pipefail
          SHORT_SHA="$(git rev-parse --short HEAD)"
          DATE_TAG="$(date +%Y%m%d)"
          VERSION="${{ steps.gradle_version.outputs.version }}"
          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
            PR_NUMBER="${{ github.event.pull_request.number }}"
            TAGS="pr-${PR_NUMBER}-${SHORT_SHA},v${VERSION}-pr-${PR_NUMBER}"
            SHOULD_PUSH="false" # do not push on PRs by default
          else
            # push to master
            # Includes the 'last-release' tag (Docker does not allow spaces in tags)
            TAGS="latest,last-release,sha-${SHORT_SHA},${DATE_TAG},v${VERSION}"
            SHOULD_PUSH="true"
          fi
          echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
          echo "date_tag=${DATE_TAG}" >> "$GITHUB_OUTPUT"
          echo "tags_csv=${TAGS}" >> "$GITHUB_OUTPUT"
          echo "should_push=${SHOULD_PUSH}" >> "$GITHUB_OUTPUT"

      # Set up Docker Buildx and layer cache
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Log in to GHCR (uses GITHUB_TOKEN)
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Normalize the computed tags to a multiline format for docker/buildx
      - name: Prepare tag list (multiline)
        id: tags
        shell: bash
        run: |
          IFS=',' read -ra T <<< "${{ steps.vars.outputs.tags_csv }}"
          printf "jvm_tags<<EOF\n" >> "$GITHUB_OUTPUT"
          for tag in "${T[@]}"; do
            # Use APP_NAME as the JVM image name
            echo "ghcr.io/${{ env.GHCR_OWNER_LC }}/${{ env.APP_NAME }}:$tag" >> "$GITHUB_OUTPUT"
          done
          printf "EOF\n" >> "$GITHUB_OUTPUT"

          printf "native_tags<<EOF\n" >> "$GITHUB_OUTPUT"
          for tag in "${T[@]}"; do
            # Use '-native' suffix to differentiate native image (adjust if needed)
            echo "ghcr.io/${{ env.GHCR_OWNER_LC }}/${{ env.APP_NAME }}-native:$tag" >> "$GITHUB_OUTPUT"
          done
          printf "EOF\n" >> "$GITHUB_OUTPUT"

      # Build Docker image for the JVM app using the existing Dockerfile
      - name: Build JVM Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/Dockerfile.jvm
          platforms: linux/amd64
          push: ${{ steps.vars.outputs.should_push == 'true' && github.event_name == 'push' }}
          tags: ${{ steps.tags.outputs.jvm_tags }}
          labels: |
            org.opencontainers.image.version=${{ steps.gradle_version.outputs.version }}
            org.opencontainers.image.revision=${{ steps.vars.outputs.short_sha }}
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Final summary with generated tags
      - name: Summary
        if: always()
        run: |
          echo "Project version: ${{ steps.gradle_version.outputs.version }}"
          echo "Tags generated: ${{ steps.vars.outputs.tags_csv }}"
          echo "Push enabled: ${{ steps.vars.outputs.should_push }}"

  build_native_and_publish:
    name: Native Build, Docker and Push
    runs-on: ubuntu-latest
    needs: tests
    if: ${{ needs.tests.result == 'success' }}
    env:
      APP_NAME: espacogeek-api
      # Path to the native binary produced by Gradle nativeCompile
      NATIVE_BINARY: build/native/nativeCompile/espaco-geek

    # MariaDB service used for the in-pipeline health check validation
    services:
      mariadb:
        image: mariadb:11.4
        env:
          MYSQL_ROOT_PASSWORD: ci_root_pw
          MYSQL_DATABASE: espacogeekdb
          MYSQL_USER: testuser
          MYSQL_PASSWORD: testpass
        ports:
          - 3306:3306
        options: >-
          --health-cmd "healthcheck.sh --connect --innodb_initialized"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
          --health-start-period 30s

    steps:
      # Checkout code (full history for versioning)
      - name: Check out code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # Normalize owner/repo to lowercase (GHCR requirement)
      - name: Normalize GHCR owner/repo
        shell: bash
        run: |
          OWNER_LC="${GITHUB_REPOSITORY_OWNER,,}"
          REPO_LC="${GITHUB_REPOSITORY#*/}"
          REPO_LC="${REPO_LC,,}"
          echo "GHCR_OWNER_LC=${OWNER_LC}" >> "$GITHUB_ENV"
          echo "GHCR_REPO_LC=${REPO_LC}" >> "$GITHUB_ENV"

      # Set up GraalVM 21 (Community Edition) with native-image on the runner.
      # The toolchain fulfils build.gradle's java.toolchain.languageVersion = 21.
      # github-token enables automatic GraalVM release download caching on GHCR.
      - name: Setup GraalVM 21 (Community) with native-image
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: '21'
          distribution: 'graalvm-community'
          github-token: ${{ secrets.GITHUB_TOKEN }}
          native-image-job-reports: 'true'

      # Set up Gradle with aggressive dependency and build-output caching
      - name: Setup Gradle (with caching)
        uses: gradle/actions/setup-gradle@v4
        with:
          gradle-home-cache-cleanup: true

      # Ensure wrapper has execute permission
      - name: Make Gradle wrapper executable
        run: chmod +x gradlew

      # Read the project version defined in build.gradle
      - name: Read Gradle project version
        id: gradle_version
        shell: bash
        run: |
          echo "version=$(./gradlew -q properties | sed -n 's/^version: \(.*\)$/\1/p')" >> "$GITHUB_OUTPUT"

      # Generate version tags (same logic as JVM job, with -native suffix)
      - name: Compute version tags
        id: vars
        shell: bash
        run: |
          set -euo pipefail
          SHORT_SHA="$(git rev-parse --short HEAD)"
          DATE_TAG="$(date +%Y%m%d)"
          VERSION="${{ steps.gradle_version.outputs.version }}"
          if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then
            PR_NUMBER="${{ github.event.pull_request.number }}"
            TAGS="pr-${PR_NUMBER}-${SHORT_SHA},v${VERSION}-pr-${PR_NUMBER}"
            SHOULD_PUSH="false"
          else
            TAGS="latest,last-release,sha-${SHORT_SHA},${DATE_TAG},v${VERSION}"
            SHOULD_PUSH="true"
          fi
          echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
          echo "date_tag=${DATE_TAG}" >> "$GITHUB_OUTPUT"
          echo "tags_csv=${TAGS}" >> "$GITHUB_OUTPUT"
          echo "should_push=${SHOULD_PUSH}" >> "$GITHUB_OUTPUT"

      # Compile the GraalVM native executable directly on the runner.
      # Gradle dependency cache (from setup-gradle) and GraalVM toolchain cache
      # (from setup-graalvm) are reused across runs to minimise build time.
      - name: Compile native image
        shell: bash
        run: ./gradlew nativeCompile -x test --no-daemon -Dorg.gradle.jvmargs="-Xmx2g -XX:MaxMetaspaceSize=512m"
      
      # Build a minimal Docker image from the pre-compiled native binary.
      # Using an inline Dockerfile avoids re-running the expensive native compile
      # inside Docker and leverages the runner's Gradle build cache instead.
      - name: Build native Docker image
        shell: bash
        run: |
          set -euo pipefail
          docker build --tag "native-validation:ci" -f - . << 'DOCKERFILE'
          FROM debian:12-slim
          WORKDIR /app
          RUN apt-get update \
           && apt-get install -y --no-install-recommends curl ca-certificates \
           && rm -rf /var/lib/apt/lists/*
          ARG TZ=America/Sao_Paulo
          ENV TZ=${TZ}
          COPY build/native/nativeCompile/espaco-geek /app/espaco-geek
          RUN chmod +x /app/espaco-geek
          EXPOSE 8080 8081
          HEALTHCHECK --interval=15s --timeout=5s --retries=5 --start-period=60s \
              CMD curl -f http://localhost:8081/actuator/health || exit 1
          RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser
          USER appuser
          ENTRYPOINT ["/app/espaco-geek"]
          DOCKERFILE

      # Start the native container using the MariaDB service (host network so that
      # the container can reach the MariaDB service on 127.0.0.1:3306).
      # Flyway will run all pending migrations against the fresh espacogeekdb schema.
      - name: Start native container for pipeline validation
        shell: bash
        run: |
          docker run -d \
            --name native-validation \
            --memory="256m" \
            --cpus="0.3" \
            --network host \
            -e "SPRING_DATASOURCE_URL=jdbc:mysql://127.0.0.1:3306/espacogeekdb" \
            -e "SPRING_DATASOURCE_USERNAME=testuser" \
            -e "SPRING_DATASOURCE_PASSWORD=testpass" \
            -e "SPRING_MVC_CORS_ALLOWED_ORIGINS=http://localhost:3000" \
            -e "SPRING_AUTO_DDL=none" \
            native-validation:ci
          # SPRING_AUTO_DDL maps to spring.jpa.hibernate.ddl-auto (see application.properties)

      # Poll the Spring Boot Actuator health endpoint (management port 8081).
      # The pipeline fails if the container does not become healthy within 180 s.
      - name: Wait for native container health check
        shell: bash
        run: |
          set -euo pipefail
          HEALTH_URL="http://localhost:8081/actuator/health"
          MAX_WAIT=180
          INTERVAL=10
          ELAPSED=0
          echo "Polling ${HEALTH_URL} (timeout ${MAX_WAIT}s, interval ${INTERVAL}s)..."
          while [ "${ELAPSED}" -lt "${MAX_WAIT}" ]; do
            HTTP_CODE=$(curl -o /dev/null -s -w "%{http_code}" --max-time 5 "${HEALTH_URL}" || echo "000")
            if [ "${HTTP_CODE}" -eq 200 ]; then
              echo "✅ Health check passed (HTTP ${HTTP_CODE}) after ${ELAPSED}s"
              exit 0
            fi
            echo "⏳ HTTP ${HTTP_CODE} after ${ELAPSED}s – retrying in ${INTERVAL}s..."
            sleep "${INTERVAL}"
            ELAPSED=$((ELAPSED + INTERVAL))
          done
          echo "❌ Health check timed out after ${MAX_WAIT}s (last HTTP ${HTTP_CODE})"
          docker logs native-validation || true
          exit 1

      # Log in to GHCR only when we are about to push (master pushes)
      - name: Login to GHCR
        if: steps.vars.outputs.should_push == 'true' && github.event_name == 'push'
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Tag and push native Docker image
        if: steps.vars.outputs.should_push == 'true' && github.event_name == 'push'
        shell: bash
        run: |
          set -euo pipefail
          FULL_TAG="ghcr.io/${{ env.GHCR_OWNER_LC }}/${{ env.APP_NAME }}:native"
          docker tag native-validation:ci "${FULL_TAG}"
          docker push "${FULL_TAG}"
          echo "Pushed: ${FULL_TAG}"

      - name: Cleanup validation container
        if: always()
        run: docker rm -f native-validation 2>/dev/null || true

      # Final summary
      - name: Summary
        if: always()
        run: |
          echo "Project version: ${{ steps.gradle_version.outputs.version }}"
          echo "Tags generated: ${{ steps.vars.outputs.tags_csv }}"
          echo "Push enabled: ${{ steps.vars.outputs.should_push }}"

  deploy_jvm:
    name: Deploy JVM to Hostinger
    runs-on: ubuntu-latest
    needs: [tests, build_and_publish]
    if: ${{ needs.build_and_publish.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
    env:
      APP_NAME: espacogeek-api

    steps:
      - name: Normalize GHCR owner/repo
        shell: bash
        run: |
          OWNER_LC="${GITHUB_REPOSITORY_OWNER,,}"
          echo "GHCR_OWNER_LC=${OWNER_LC}" >> "$GITHUB_ENV"

      # Deploy to Hostinger via SSH (separate job so a re-run doesn't rebuild the image)
      - name: Deploy to Hostinger via SSH
        uses: appleboy/ssh-action@v0.1.9
        with:
          host: ${{ secrets.HOSTINGER_HOST }}
          username: ${{ secrets.HOSTINGER_USER }}
          key: ${{ secrets.HOSTINGER }}
          port: ${{ secrets.HOSTINGER_PORT }}
          envs: GHCR_OWNER_LC,APP_NAME
          script_stop: false
          script: |
            # Trap for SSH-level cleanup (runs even if SSH connection interrupted)
            cleanup_on_exit() {
              echo "Running SSH-level cleanup..."
              rm -f .env.espacogeek 2>/dev/null || true
              docker logout ghcr.io 2>/dev/null || true
            }
            trap cleanup_on_exit EXIT INT TERM

            # Define deploy script path
            DEPLOY_SCRIPT="/opt/espacogeek/deploy.sh"

            # Create directory if doesn't exist
            mkdir -p "$(dirname "$DEPLOY_SCRIPT")"

            # Create deployment script - NO health checks
            cat > "$DEPLOY_SCRIPT" << 'DEPLOY_SCRIPT_EOF'
            #!/bin/bash
            set -euo pipefail

            RED='\033[0;31m'
            GREEN='\033[0;32m'
            YELLOW='\033[1;33m'
            BLUE='\033[0;34m'
            NC='\033[0m'

            log_info() { echo -e "${BLUE}[INFO]${NC} $*"; }
            log_success() { echo -e "${GREEN}[✓]${NC} $*"; }
            log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
            log_error() { echo -e "${RED}[✗]${NC} $*"; }

            GHCR_OWNER_LC="${1:-}"
            APP_NAME="${2:-}"
            IMAGE_TAG="${3:-latest}"
            ENV_FILE="${4:-.env.espacogeek}"
            CONTAINER_NAME="espacogeek-api"
            BACKUP_DIR="${HOME}/espacogeek-backups"
            OLD_CONTAINER_BACKUP="${CONTAINER_NAME}-old"
            TIMESTAMP=$(date +%Y%m%d_%H%M%S)

            # Trap to ensure env file cleanup on exit (success or failure)
            cleanup_env_file() {
              if [ -f "$ENV_FILE" ]; then
                log_info "Cleaning up environment file..."
                rm -f "$ENV_FILE"
              fi
            }
            trap cleanup_env_file EXIT

            if [ -z "$GHCR_OWNER_LC" ] || [ -z "$APP_NAME" ]; then
              log_error "Usage: $0 <GHCR_OWNER_LC> <APP_NAME> [IMAGE_TAG] [ENV_FILE]"
              exit 1
            fi

            IMAGE="ghcr.io/${GHCR_OWNER_LC}/${APP_NAME}:${IMAGE_TAG}"

            container_exists() { docker ps -a --format '{{.Names}}' | grep -q "^${1}$"; }

            if container_exists "$CONTAINER_NAME"; then
              log_info "Creating backup of old container..."
              mkdir -p "$BACKUP_DIR"
              BACKUP_FILE="${BACKUP_DIR}/${CONTAINER_NAME}_backup_${TIMESTAMP}.tar"
              if docker export "$CONTAINER_NAME" > "$BACKUP_FILE"; then
                log_success "Container backup created"
                ls -t "${BACKUP_DIR}/${CONTAINER_NAME}_backup_"*.tar 2>/dev/null | tail -n +6 | xargs rm -f 2>/dev/null || true
              else
                log_error "Failed to backup container"
                exit 1
              fi
            fi

            if container_exists "$CONTAINER_NAME"; then
              log_info "Stopping old container..."
              docker stop "$CONTAINER_NAME" 2>/dev/null || true
              docker rename "$CONTAINER_NAME" "${OLD_CONTAINER_BACKUP}" 2>/dev/null || true
              log_success "Old container renamed to ${OLD_CONTAINER_BACKUP}"
            fi

            log_info "Pulling new image..."
            if ! docker pull "$IMAGE"; then
              log_error "Failed to pull image"
              if container_exists "${OLD_CONTAINER_BACKUP}"; then
                log_warn "Restoring old container..."
                docker rename "${OLD_CONTAINER_BACKUP}" "$CONTAINER_NAME" 2>/dev/null || true
                docker start "$CONTAINER_NAME" 2>/dev/null || true
              fi
              exit 1
            fi
            log_success "Image pulled successfully"

            log_info "Starting new container..."
            if ! docker run -d --name "$CONTAINER_NAME" --network infra_network -p 8080:8080 --restart unless-stopped --env-file "$ENV_FILE" "$IMAGE"; then
              log_error "Failed to start container"
              if container_exists "${OLD_CONTAINER_BACKUP}"; then
                log_warn "Restoring old container..."
                docker rename "${OLD_CONTAINER_BACKUP}" "$CONTAINER_NAME" 2>/dev/null || true
                docker start "$CONTAINER_NAME" 2>/dev/null || true
              fi
              exit 1
            fi
            log_success "Container started successfully"

            # Wait for the application to initialize with a basic health check
            log_info "Waiting for application to initialize (up to 30s)..."
            MAX_RETRIES=6
            SLEEP_SECONDS=5
            retries=0
            HEALTHY=0
            while [ "$retries" -lt "$MAX_RETRIES" ]; do
              if ! container_exists "$CONTAINER_NAME"; then
                log_error "Health check: container '$CONTAINER_NAME' is not running"
                break
              fi

              STATUS="$(docker inspect -f '{{.State.Status}}' "$CONTAINER_NAME" 2>/dev/null || echo "unknown")"
              RESTARTING="$(docker inspect -f '{{.State.Restarting}}' "$CONTAINER_NAME" 2>/dev/null || echo "false")"

              if [ "$STATUS" = "running" ] && [ "$RESTARTING" = "false" ]; then
                log_success "Health check passed: container is running (status=$STATUS, restarting=$RESTARTING)"
                HEALTHY=1
                break
              fi

              log_info "Health check: status=$STATUS, restarting=$RESTARTING. Retrying in ${SLEEP_SECONDS}s..."
              sleep "$SLEEP_SECONDS"
              retries=$((retries + 1))
            done

            if [ "$HEALTHY" -ne 1 ]; then
              log_error "Container failed health check after $((MAX_RETRIES * SLEEP_SECONDS))s"
              if container_exists "$CONTAINER_NAME"; then
                log_warn "Stopping and removing failed new container..."
                docker rm -f "$CONTAINER_NAME" 2>/dev/null || true
              fi
              if container_exists "${OLD_CONTAINER_BACKUP}"; then
                log_warn "Restoring old container..."
                docker rename "${OLD_CONTAINER_BACKUP}" "$CONTAINER_NAME" 2>/dev/null || true
                docker start "$CONTAINER_NAME" 2>/dev/null || true
              fi
              exit 1
            fi
            if container_exists "${OLD_CONTAINER_BACKUP}"; then
              log_info "Removing old container backup..."
              docker rm -f "${OLD_CONTAINER_BACKUP}" 2>/dev/null || true
              log_success "Old container removed"
            fi

            log_success ""
            log_success "=== DEPLOYMENT SUCCESSFUL ==="
            docker ps -a --filter name="$CONTAINER_NAME"
            log_info ""
            log_info "Recent logs:"
            docker logs --tail 10 "$CONTAINER_NAME" || true
            log_success "============================="
            DEPLOY_SCRIPT_EOF

            # Make script executable
            chmod +x "$DEPLOY_SCRIPT"

            # Create environment file with secrets expansion
            cat > .env.espacogeek << ENVEOF
            SPRING_DATASOURCE_URL=${{ secrets.SPRING_DATASOURCE_URL }}
            SPRING_DATASOURCE_USERNAME=${{ secrets.SPRING_DATASOURCE_USERNAME }}
            SPRING_DATASOURCE_PASSWORD=${{ secrets.SPRING_DATASOURCE_PASSWORD }}
            SPRING_MVC_CORS_ALLOWED_ORIGINS=${{ secrets.SPRING_MVC_CORS_ALLOWED_ORIGINS }}
            SECURITY_JWT_ISSUER=${{ secrets.SECURITY_JWT_ISSUER }}
            SECURITY_JWT_EXPIRATION_MS=${{ secrets.SECURITY_JWT_EXPIRATION_MS }}
            SECURITY_JWT_SECRET=${{ secrets.SECURITY_JWT_SECRET }}
            SAMESITE_WHEN_SAME_SITE=${{ secrets.SAMESITE_WHEN_SAME_SITE }}
            SECURITY_CSRF_COOKIE_DOMAIN=${{ secrets.SECURITY_CSRF_COOKIE_DOMAIN }}
            SECURITY_CSRF_COOKIE_SAME_SITE=${{ secrets.SECURITY_CSRF_COOKIE_SAME_SITE }}
            MAIL_HOST=${{ secrets.MAIL_HOST }}
            MAIL_PORT=${{ secrets.MAIL_PORT }}
            MAIL_USERNAME=${{ secrets.MAIL_USERNAME }}
            MAIL_PASSWORD=${{ secrets.MAIL_PASSWORD }}
            FRONTEND_URL=${{ secrets.FRONTEND_URL }}
            ENVEOF

            # Validate SPRING_DATASOURCE_URL before deployment
            echo "Validating environment file..."
            if ! grep -q "^SPRING_DATASOURCE_URL=" .env.espacogeek; then
              echo "ERROR: SPRING_DATASOURCE_URL not found in .env.espacogeek"
              cat .env.espacogeek
              rm -f .env.espacogeek
              exit 1
            fi
            DATASOURCE_URL=$(grep "^SPRING_DATASOURCE_URL=" .env.espacogeek | cut -d'=' -f2)
            if [ -z "$DATASOURCE_URL" ]; then
              echo "ERROR: SPRING_DATASOURCE_URL is empty"
              rm -f .env.espacogeek
              exit 1
            fi
            if [[ ! "$DATASOURCE_URL" =~ ^jdbc: ]]; then
              echo "ERROR: SPRING_DATASOURCE_URL must start with 'jdbc:' but got: $DATASOURCE_URL"
              rm -f .env.espacogeek
              exit 1
            fi
            echo "✓ SPRING_DATASOURCE_URL is valid: $DATASOURCE_URL"

            # Login to GHCR
            echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u "${{ secrets.GHCR_USER }}" --password-stdin

            # Execute deployment script
            "$DEPLOY_SCRIPT" "${GHCR_OWNER_LC}" "${APP_NAME}" "latest" ".env.espacogeek"

            # Explicit cleanup of environment file (in case script trap didn't run)
            rm -f .env.espacogeek

            # Logout from Docker to remove stored credentials
            docker logout ghcr.io

  deploy_native:
    name: Deploy Native to Hostinger
    runs-on: ubuntu-latest
    needs: [tests, build_native_and_publish]
    if: ${{ needs.tests.result == 'success' && needs.build_native_and_publish.result == 'success' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
    env:
      APP_NAME: espacogeek-api

    steps:
      - name: Normalize GHCR owner/repo
        shell: bash
        run: |
          OWNER_LC="${GITHUB_REPOSITORY_OWNER,,}"
          echo "GHCR_OWNER_LC=${OWNER_LC}" >> "$GITHUB_ENV"

      # Deploy to Hostinger via SSH (separate job so a re-run doesn't rebuild the image)
      - name: Deploy to Hostinger via SSH
        uses: appleboy/ssh-action@v0.1.9
        with:
          host: ${{ secrets.HOSTINGER_HOST }}
          username: ${{ secrets.HOSTINGER_USER }}
          key: ${{ secrets.HOSTINGER }}
          port: ${{ secrets.HOSTINGER_PORT }}
          envs: GHCR_OWNER_LC,APP_NAME
          script_stop: false
          script: |
            cleanup_on_exit() {
              echo "Running SSH-level cleanup..."
              rm -f .env.espacogeek 2>/dev/null || true
              docker logout ghcr.io 2>/dev/null || true
            }
            trap cleanup_on_exit EXIT INT TERM

            DEPLOY_SCRIPT="/opt/espacogeek/deploy.sh"

            mkdir -p "$(dirname "$DEPLOY_SCRIPT")"

            cat > "$DEPLOY_SCRIPT" << 'DEPLOY_SCRIPT_EOF'
            #!/bin/bash
            set -euo pipefail

            RED='\033[0;31m'
            GREEN='\033[0;32m'
            YELLOW='\033[1;33m'
            BLUE='\033[0;34m'
            NC='\033[0m'

            log_info() { echo -e "${BLUE}[INFO]${NC} $*"; }
            log_success() { echo -e "${GREEN}[✓]${NC} $*"; }
            log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
            log_error() { echo -e "${RED}[✗]${NC} $*"; }

            GHCR_OWNER_LC="${1:-}"
            APP_NAME="${2:-}"
            IMAGE_TAG="${3:-native}"
            ENV_FILE="${4:-.env.espacogeek}"
            CONTAINER_NAME="espacogeek-api"
            BACKUP_DIR="${HOME}/espacogeek-api-backups"
            OLD_CONTAINER_BACKUP="${CONTAINER_NAME}-old"
            TIMESTAMP=$(date +%Y%m%d_%H%M%S)

            cleanup_env_file() {
              if [ -f "$ENV_FILE" ]; then
                log_info "Cleaning up environment file..."
                rm -f "$ENV_FILE"
              fi
            }
            trap cleanup_env_file EXIT

            if [ -z "$GHCR_OWNER_LC" ] || [ -z "$APP_NAME" ]; then
              log_error "Usage: $0 <GHCR_OWNER_LC> <APP_NAME> [IMAGE_TAG] [ENV_FILE]"
              exit 1
            fi

            IMAGE="ghcr.io/${GHCR_OWNER_LC}/${APP_NAME}:${IMAGE_TAG}"

            container_exists() { docker ps -a --format '{{.Names}}' | grep -q "^${1}$"; }

            if container_exists "$CONTAINER_NAME"; then
              log_info "Creating backup of old container..."
              mkdir -p "$BACKUP_DIR"
              BACKUP_FILE="${BACKUP_DIR}/${CONTAINER_NAME}_backup_${TIMESTAMP}.tar"
              if docker export "$CONTAINER_NAME" > "$BACKUP_FILE"; then
                log_success "Container backup created"
                ls -t "${BACKUP_DIR}/${CONTAINER_NAME}_backup_"*.tar 2>/dev/null | tail -n +6 | xargs rm -f 2>/dev/null || true
              else
                log_error "Failed to backup container"
                exit 1
              fi
            fi

            if container_exists "$CONTAINER_NAME"; then
              log_info "Stopping old container..."
              docker stop "$CONTAINER_NAME" 2>/dev/null || true
              docker rename "$CONTAINER_NAME" "${OLD_CONTAINER_BACKUP}" 2>/dev/null || true
              log_success "Old container renamed to ${OLD_CONTAINER_BACKUP}"
            fi

            log_info "Pulling new image..."
            if ! docker pull "$IMAGE"; then
              log_error "Failed to pull image"
              if container_exists "${OLD_CONTAINER_BACKUP}"; then
                log_warn "Restoring old container..."
                docker rename "${OLD_CONTAINER_BACKUP}" "$CONTAINER_NAME" 2>/dev/null || true
                docker start "$CONTAINER_NAME" 2>/dev/null || true
              fi
              exit 1
            fi
            log_success "Image pulled successfully"

            log_info "Starting new container..."
            if ! docker run -d --name "$CONTAINER_NAME" --network infra_network --restart unless-stopped --env-file "$ENV_FILE" "$IMAGE"; then
              log_error "Failed to start container"
              if container_exists "${OLD_CONTAINER_BACKUP}"; then
                log_warn "Restoring old container..."
                docker rename "${OLD_CONTAINER_BACKUP}" "$CONTAINER_NAME" 2>/dev/null || true
                docker start "$CONTAINER_NAME" 2>/dev/null || true
              fi
              exit 1
            fi
            log_success "Container started successfully"

            log_info "Waiting for application to initialize (up to 30s)..."
            MAX_RETRIES=6
            SLEEP_SECONDS=5
            retries=0
            HEALTHY=0
            while [ "$retries" -lt "$MAX_RETRIES" ]; do
              if ! container_exists "$CONTAINER_NAME"; then
                log_error "Health check: container '$CONTAINER_NAME' is not running"
                break
              fi

              STATUS="$(docker inspect -f '{{.State.Status}}' "$CONTAINER_NAME" 2>/dev/null || echo "unknown")"
              RESTARTING="$(docker inspect -f '{{.State.Restarting}}' "$CONTAINER_NAME" 2>/dev/null || echo "false")"

              if [ "$STATUS" = "running" ] && [ "$RESTARTING" = "false" ]; then
                log_success "Health check passed: container is running (status=$STATUS, restarting=$RESTARTING)"
                HEALTHY=1
                break
              fi

              log_info "Health check: status=$STATUS, restarting=$RESTARTING. Retrying in ${SLEEP_SECONDS}s..."
              sleep "$SLEEP_SECONDS"
              retries=$((retries + 1))
            done

            if [ "$HEALTHY" -ne 1 ]; then
              log_error "Container failed health check after $((MAX_RETRIES * SLEEP_SECONDS))s"
              if container_exists "$CONTAINER_NAME"; then
                log_warn "Stopping and removing failed new container..."
                docker rm -f "$CONTAINER_NAME" 2>/dev/null || true
              fi
              if container_exists "${OLD_CONTAINER_BACKUP}"; then
                log_warn "Restoring old container..."
                docker rename "${OLD_CONTAINER_BACKUP}" "$CONTAINER_NAME" 2>/dev/null || true
                docker start "$CONTAINER_NAME" 2>/dev/null || true
              fi
              exit 1
            fi
            if container_exists "${OLD_CONTAINER_BACKUP}"; then
              log_info "Removing old container backup..."
              docker rm -f "${OLD_CONTAINER_BACKUP}" 2>/dev/null || true
              log_success "Old container removed"
            fi

            log_success ""
            log_success "=== DEPLOYMENT SUCCESSFUL ==="
            docker ps -a --filter name="$CONTAINER_NAME"
            log_info ""
            log_info "Recent logs:"
            docker logs --tail 10 "$CONTAINER_NAME" || true
            log_success "============================="
            DEPLOY_SCRIPT_EOF

            chmod +x "$DEPLOY_SCRIPT"

            cat > .env.espacogeek << ENVEOF
            SPRING_DATASOURCE_URL=${{ secrets.SPRING_DATASOURCE_URL }}
            SPRING_DATASOURCE_USERNAME=${{ secrets.SPRING_DATASOURCE_USERNAME }}
            SPRING_DATASOURCE_PASSWORD=${{ secrets.SPRING_DATASOURCE_PASSWORD }}
            SPRING_MVC_CORS_ALLOWED_ORIGINS=${{ secrets.SPRING_MVC_CORS_ALLOWED_ORIGINS }}
            SECURITY_JWT_ISSUER=${{ secrets.SECURITY_JWT_ISSUER }}
            SECURITY_JWT_EXPIRATION_MS=${{ secrets.SECURITY_JWT_EXPIRATION_MS }}
            SECURITY_JWT_SECRET=${{ secrets.SECURITY_JWT_SECRET }}
            SAMESITE_WHEN_SAME_SITE=${{ secrets.SAMESITE_WHEN_SAME_SITE }}
            SECURITY_CSRF_COOKIE_DOMAIN=${{ secrets.SECURITY_CSRF_COOKIE_DOMAIN }}
            SECURITY_CSRF_COOKIE_SAME_SITE=${{ secrets.SECURITY_CSRF_COOKIE_SAME_SITE }}
            MAIL_HOST=${{ secrets.MAIL_HOST }}
            MAIL_PORT=${{ secrets.MAIL_PORT }}
            MAIL_USERNAME=${{ secrets.MAIL_USERNAME }}
            MAIL_PASSWORD=${{ secrets.MAIL_PASSWORD }}
            FRONTEND_URL=${{ secrets.FRONTEND_URL }}
            ENVEOF

            echo "Validating environment file..."
            if ! grep -q "^SPRING_DATASOURCE_URL=" .env.espacogeek; then
              echo "ERROR: SPRING_DATASOURCE_URL not found in .env.espacogeek"
              cat .env.espacogeek
              rm -f .env.espacogeek
              exit 1
            fi
            DATASOURCE_URL=$(grep "^SPRING_DATASOURCE_URL=" .env.espacogeek | cut -d'=' -f2)
            if [ -z "$DATASOURCE_URL" ]; then
              echo "ERROR: SPRING_DATASOURCE_URL is empty"
              rm -f .env.espacogeek
              exit 1
            fi
            if [[ ! "$DATASOURCE_URL" =~ ^jdbc: ]]; then
              echo "ERROR: SPRING_DATASOURCE_URL must start with 'jdbc:' but got: $DATASOURCE_URL"
              rm -f .env.espacogeek
              exit 1
            fi
            echo "✓ SPRING_DATASOURCE_URL is valid: $DATASOURCE_URL"

            echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u "${{ secrets.GHCR_USER }}" --password-stdin

            "$DEPLOY_SCRIPT" "${GHCR_OWNER_LC}" "${APP_NAME}" "native" ".env.espacogeek"

            rm -f .env.espacogeek

            docker logout ghcr.io