deploy-admin.yml

name: Deploy Admin (Reusable)

on:
  workflow_call:
    inputs:
      environment:
        description: 'Deployment environment (staging or production)'
        required: true
        type: string
      image_tag:
        description: 'Docker image tag to use'
        required: true
        type: string
      registry:
        description: 'Docker registry URL'
        required: true
        type: string
    secrets:
      DIGITALOCEAN_ACCESS_TOKEN:
        required: true
      RECAPTCHA_SITE_KEY:
        required: false

permissions: {}

jobs:
  build:
    name: Build Admin
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: ${{ inputs.environment }}
    
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6.0.1
      
      - name: Set up Node.js
        uses: actions/setup-node@v6.1.0
        with:
          node-version: 22
      
      - name: Install dependencies
        run: npm ci
      
      - name: Build admin
        env:
          NODE_ENV: "production" # Important for Next.js base path
          # Build-time environment variables for Next.js
          # These NEXT_PUBLIC_* variables are embedded into the client bundle
          NEXT_PUBLIC_BASE_URL: ${{ vars.BASE_URL }}
          NEXT_PUBLIC_RECAPTCHA_SITE_KEY: ${{ secrets.RECAPTCHA_SITE_KEY }}
        run: |
          echo "🔨 Building admin with NEXT_PUBLIC variables..."
          echo "   NEXT_PUBLIC_BASE_URL: $NEXT_PUBLIC_BASE_URL"
          echo "   NEXT_PUBLIC_RECAPTCHA_SITE_KEY: ${NEXT_PUBLIC_RECAPTCHA_SITE_KEY:+***set***}"
          
          if [ -z "$NEXT_PUBLIC_BASE_URL" ]; then
            echo "⚠️ WARNING: NEXT_PUBLIC_BASE_URL is empty!"
          fi
          
          if [ -z "$NEXT_PUBLIC_RECAPTCHA_SITE_KEY" ]; then
            echo "⚠️ WARNING: NEXT_PUBLIC_RECAPTCHA_SITE_KEY is empty!"
          fi
          
          # Export variables explicitly for Next.js
          export NEXT_PUBLIC_BASE_URL="$NEXT_PUBLIC_BASE_URL"
          export NEXT_PUBLIC_RECAPTCHA_SITE_KEY="$NEXT_PUBLIC_RECAPTCHA_SITE_KEY"
          
          npx nx build admin --configuration=production
          
          echo "✅ Build complete"
          echo "🔍 Verifying NEXT_PUBLIC variables are embedded in bundle..."
          
          # Check if variables are in the built JavaScript bundles
          if grep -r "$NEXT_PUBLIC_BASE_URL" dist/apps/admin/.next/static/chunks/*.js 2>/dev/null; then
            echo "✅ NEXT_PUBLIC_BASE_URL found in bundle"
          else
            echo "⚠️ WARNING: NEXT_PUBLIC_BASE_URL not found in bundle - checking further..."
            echo "   Searching in all build files..."
            find dist/apps/admin/.next -name "*.js" -exec grep -l "$NEXT_PUBLIC_BASE_URL" {} \; | head -5 || echo "   Not found in any JS files!"
          fi
      
      - name: Install doctl
        uses: digitalocean/action-doctl@v2.5.1
        with:
          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
      
      - name: Log in to DigitalOcean Container Registry
        run: doctl registry login --expiry-seconds 1200
      
      - name: Build Docker image
        working-directory: apps/admin
        run: |
          docker build \
            -t ${{ inputs.registry }}/lems:admin-${{ inputs.image_tag }} \
            -f Dockerfile \
            ../..
          
          echo "✅ Docker image built successfully"
          echo "ℹ️  Server-side configuration will be provided at runtime via docker-compose"
          echo "ℹ️  Client-side (NEXT_PUBLIC_*) variables were embedded at build time"
      
      - name: Push Docker image
        run: docker push ${{ inputs.registry }}/lems:admin-${{ inputs.image_tag }}