deploy.yml

name: Deploy

on:
  push:
    branches: [main]

# Prevent concurrent deployments
concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false

jobs:
  # Run CI checks first (reuse existing workflow)
  ci:
    uses: ./.github/workflows/ci.yml

  deploy-supabase:
    needs: ci
    runs-on: ubuntu-latest
    environment: production
    env:
      SUPABASE_PROJECT_REF: ${{ secrets.SUPABASE_PROJECT_REF }}
      SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
      SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }}
    steps:
      - name: Check deploy secrets
        run: |
          if [ -z "$SUPABASE_PROJECT_REF" ]; then
            echo "::notice::SUPABASE_PROJECT_REF not set — skipping deploy"
            echo "SKIP_DEPLOY=true" >> "$GITHUB_ENV"
          fi

      - uses: actions/checkout@v4
        if: env.SKIP_DEPLOY != 'true'

      - uses: supabase/setup-cli@v1
        if: env.SKIP_DEPLOY != 'true'
        with:
          version: latest

      - name: Link Supabase project
        if: env.SKIP_DEPLOY != 'true'
        run: supabase link --project-ref "$SUPABASE_PROJECT_REF"

      - name: Push database migrations
        if: env.SKIP_DEPLOY != 'true'
        run: yes | supabase db push

      - name: Deploy Edge Functions
        if: env.SKIP_DEPLOY != 'true'
        run: supabase functions deploy mcp-server --no-verify-jwt

      - name: Smoke test Edge Function health endpoint
        if: env.SKIP_DEPLOY != 'true'
        run: |
          curl -sf --retry 3 --retry-delay 5 \
            "https://${SUPABASE_PROJECT_REF}.supabase.co/functions/v1/mcp-server/health"

      - name: Notify deploy failure
        if: failure() && env.SKIP_DEPLOY != 'true'
        run: |
          echo "::error::Supabase deployment failed — check the logs above."
          exit 1

  # Next.js deployment to Vercel:
  # Use the Vercel GitHub integration (zero config) rather than a manual
  # workflow step. Connect the repo in the Vercel dashboard and it will
  # auto-deploy on every push to main. No workflow job needed here.