deploy.yml

name: Deploy

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      network:
        description: 'Target network'
        required: true
        default: 'westend'
        type: choice
        options:
          - westend
          - rococo
          - polkadot
      contract:
        description: 'Specific contract to deploy (leave empty for all)'
        required: false
        type: string
      dry_run:
        description: 'Dry run (skip actual deployment)'
        required: false
        default: true
        type: boolean

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: Pre-deployment Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true
          components: rustfmt, clippy

      - name: Cache cargo registry
        uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Add WASM target
        run: rustup target add wasm32-unknown-unknown

      - name: Install cargo-contract
        run: cargo install cargo-contract --locked

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Run clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Run unit tests
        run: cargo test --all-features --exclude ipfs-metadata --exclude oracle --exclude escrow --exclude proxy --exclude security-audit --exclude compliance_registry || true

      - name: Run contract tests
        run: |
          cd contracts
          for dir in */; do
            if [ -f "$dir/Cargo.toml" ] && [ "$dir" != "ipfs-metadata/" ] && [ "$dir" != "oracle/" ] && [ "$dir" != "escrow/" ] && [ "$dir" != "proxy/" ] && [ "$dir" != "security-audit/" ] && [ "$dir" != "compliance_registry/" ]; then
              cd "$dir"
              cargo contract build || true
              cd ..
            fi
          done

  security:
    name: Security Checks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true

      - name: Install cargo-audit
        run: cargo install cargo-audit

      - name: Run security audit
        run: cargo audit --workspace || true

  build:
    name: Build Release Artifacts
    runs-on: ubuntu-latest
    needs: [test, security]
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true

      - name: Add WASM target
        run: rustup target add wasm32-unknown-unknown

      - name: Install cargo-contract
        run: cargo install cargo-contract --locked

      - name: Build contracts in release mode
        run: |
          cd contracts
          for dir in */; do
            if [ -f "$dir/Cargo.toml" ]; then
              cd "$dir"
              cargo contract build --release || true
              cd ..
            fi
          done

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: contracts
          path: |
            contracts/*/target/ink/*.contract
            contracts/*/target/ink/*.wasm

  deploy:
    name: Deploy Contracts
    runs-on: ubuntu-latest
    needs: build
    environment: ${{ inputs.network || 'westend' }}
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
          toolchain: stable
          override: true

      - name: Add WASM target
        run: rustup target add wasm32-unknown-unknown

      - name: Install cargo-contract
        run: cargo install cargo-contract --locked

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          name: contracts
          path: artifacts/

      - name: Back up current deployment state
        run: |
          NETWORK="${{ inputs.network || 'westend' }}"
          mkdir -p deployments/backups
          if [ -d "deployments/$NETWORK" ]; then
            cp -r "deployments/$NETWORK" "deployments/backups/${NETWORK}-$(date +%Y%m%d-%H%M%S)"
          fi

      - name: Deploy contracts
        env:
          SURI: ${{ secrets.DEPLOY_SURI }}
          NETWORK: ${{ inputs.network || 'westend' }}
          DRY_RUN: ${{ inputs.dry_run || 'false' }}
        run: |
          DEPLOY_ARGS="--network $NETWORK"
          if [ -n "${{ inputs.contract }}" ]; then
            DEPLOY_ARGS="$DEPLOY_ARGS --contract ${{ inputs.contract }}"
          fi
          if [ "$DRY_RUN" = "true" ]; then
            echo "Dry run mode - skipping actual deployment"
            echo "Would run: ./scripts/deploy.sh $DEPLOY_ARGS --verify"
          else
            ./scripts/deploy.sh $DEPLOY_ARGS --verify
          fi

      - name: Verify deployment
        if: ${{ inputs.dry_run != true }}
        env:
          NETWORK: ${{ inputs.network || 'westend' }}
        run: |
          ./scripts/deploy.sh --network "$NETWORK" --list

      - name: Upload deployment records
        if: ${{ inputs.dry_run != true }}
        uses: actions/upload-artifact@v4
        with:
          name: deployment-records
          path: deployments/

  rollback:
    name: Rollback (on failure)
    runs-on: ubuntu-latest
    needs: deploy
    if: failure()
    environment: ${{ inputs.network || 'westend' }}
    steps:
      - uses: actions/checkout@v4

      - name: Download deployment backups
        uses: actions/download-artifact@v4
        with:
          name: deployment-records
          path: deployments/
        continue-on-error: true

      - name: Restore previous deployment state
        env:
          NETWORK: ${{ inputs.network || 'westend' }}
        run: |
          echo "Deployment failed. Restoring previous state..."
          LATEST_BACKUP=$(ls -td deployments/backups/${NETWORK}-* 2>/dev/null | head -1)
          if [ -n "$LATEST_BACKUP" ]; then
            echo "Restoring from backup: $LATEST_BACKUP"
            cp -r "$LATEST_BACKUP"/* "deployments/$NETWORK/" 2>/dev/null || true
            echo "Previous deployment state restored."
          else
            echo "No backup found. Manual intervention may be required."
          fi

      - name: Notify rollback
        run: |
          echo "::warning::Deployment to ${{ inputs.network || 'westend' }} failed and was rolled back."

  notify:
    name: Deployment Notification
    runs-on: ubuntu-latest
    needs: deploy
    if: always()
    steps:
      - name: Report deployment status
        run: |
          if [ "${{ needs.deploy.result }}" = "success" ]; then
            echo "Deployment to ${{ inputs.network || 'westend' }} completed successfully."
          else
            echo "::error::Deployment to ${{ inputs.network || 'westend' }} failed."
          fi