@akash-chowdhury-24/deployhub 2.0.13 → 2.0.15

package/src/utils/docker-image-deploy.js

@@ -10,6 +10,7 @@ import {
   generateSpringRuntimeDockerfile,
   isFrontendStaticFramework,
   isInterpretedBackendFramework,
+  replaceDockerImageTag,
   resolveDockerImageRef,
   EXPLICIT_IMAGE_TAG_WARNING,
 } from './docker-image.js';
@@ -67,8 +68,9 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
   /**
    * Push only when registry credentials are configured. Avoids a noisy failed
    * push to Docker Hub for local-only image names.
+   * @param {string} [imageRef]
    */
-  async function maybePushImage() {
+  async function maybePushImage(imageRef = fullImage) {
     if (!hasRegistryCredentials()) {
       log.info(
         'docker push skipped (DOCKER_REGISTRY_USERNAME/TOKEN not set — local image only)'
@@ -76,12 +78,12 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
       return;
     }
 
-    log.info(`Pushing ${fullImage} to registry...`);
-    await execa('docker', ['push', fullImage], {
+    log.info(`Pushing ${imageRef} to registry...`);
+    await execa('docker', ['push', imageRef], {
       stdio: 'inherit',
       env: getDockerEnv(),
     });
-    log.success(`Pushed ${fullImage}`);
+    log.success(`Pushed ${imageRef}`);
   }
 
   /**
@@ -102,21 +104,22 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
   /**
    * Prefer the image already built during the pipeline `docker` stage.
    * Retag when the pipeline used `:latest` and deploy needs a version tag.
+   * @param {string} [imageRef]
    */
-  async function ensureImageFromPipeline() {
-    if (await imageExistsLocally(fullImage)) {
-      log.info(`Reusing existing image ${fullImage}`);
+  async function ensureImageFromPipeline(imageRef = fullImage) {
+    if (await imageExistsLocally(imageRef)) {
+      log.info(`Reusing existing image ${imageRef}`);
       return true;
     }
 
     const candidates = [...new Set([latestImage, legacyLatestImage])].filter(
-      (ref) => ref !== fullImage
+      (ref) => ref !== imageRef
     );
 
     for (const candidate of candidates) {
       if (!(await imageExistsLocally(candidate))) continue;
-      log.info(`Re-tagging pipeline image ${candidate} → ${fullImage}`);
-      await execa('docker', ['tag', candidate, fullImage], {
+      log.info(`Re-tagging pipeline image ${candidate} → ${imageRef}`);
+      await execa('docker', ['tag', candidate, imageRef], {
         stdio: 'inherit',
         env: getDockerEnv(),
       });
@@ -211,12 +214,13 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
 
   /**
    * @param {string} artifactDir
+   * @param {string} [imageRef]
    */
-  async function buildFromArtifactContents(artifactDir) {
+  async function buildFromArtifactContents(artifactDir, imageRef = fullImage) {
     const zipPath = path.join(artifactDir, 'artifact.zip');
     if (!(await fs.pathExists(zipPath))) {
       throw new Error(
-        `No local image found for ${fullImage} and no artifact.zip to build from. ` +
+        `No local image found for ${imageRef} and no artifact.zip to build from. ` +
           'Enable pipeline.docker so the image is built from project source, or run deployhub build first.'
       );
     }
@@ -281,7 +285,7 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
         await prepareBackendBuildContext(buildContext, metadata, framework, port);
       }
 
-      await execa('docker', ['build', '-t', fullImage, '.'], {
+      await execa('docker', ['build', '-t', imageRef, '.'], {
         cwd: buildContext,
         stdio: 'inherit',
         env: getDockerEnv(),
@@ -295,36 +299,55 @@ export function createDockerImageDeployContext(config, env = process.env, log) {
   /**
    * Ensure a deployable image exists locally, then push when credentials are set.
    * @param {string} artifactDir
-   * @param {{ skipPush?: boolean }} [options]
+   * @param {{
+   *   skipPush?: boolean,
+   *   fullImage?: string,
+   *   skipImageReuse?: boolean,
+   * }} [options]
    */
   async function ensureImageReadyForDeploy(artifactDir, options = {}) {
+    const imageRef = options.fullImage || fullImage;
+    const latestRef = options.fullImage
+      ? replaceDockerImageTag(options.fullImage, 'latest')
+      : latestImage;
+    const lastSlash = imageRef.lastIndexOf('/');
+    const lastColon = imageRef.lastIndexOf(':');
+    const effectiveTag =
+      lastColon > lastSlash ? imageRef.slice(lastColon + 1) : 'latest';
+
     await dockerLogin();
 
-    const reused = await ensureImageFromPipeline();
+    let reused = false;
+    if (!options.skipImageReuse) {
+      reused = await ensureImageFromPipeline(imageRef);
+    } else {
+      log.info(`Skipping local image reuse — rebuilding ${imageRef} from artifact`);
+    }
+
     let ranCompose = false;
 
     if (!reused) {
-      const result = await buildFromArtifactContents(artifactDir);
+      const result = await buildFromArtifactContents(artifactDir, imageRef);
       ranCompose = Boolean(result?.ranCompose);
     }
 
     if (ranCompose) {
-      return { ranCompose: true };
+      return { ranCompose: true, fullImage: imageRef };
     }
 
     if (!options.skipPush) {
-      await maybePushImage();
+      await maybePushImage(imageRef);
     }
 
     const dockerEnv = getDockerEnv();
-    if (imageTag !== 'latest' && fullImage !== latestImage) {
-      await execa('docker', ['tag', fullImage, latestImage], {
+    if (effectiveTag !== 'latest' && imageRef !== latestRef) {
+      await execa('docker', ['tag', imageRef, latestRef], {
         stdio: 'pipe',
         env: dockerEnv,
       }).catch(() => {});
     }
 
-    return { ranCompose: false };
+    return { ranCompose: false, fullImage: imageRef };
   }
 
   return {

package/src/utils/docker-image.js

@@ -41,12 +41,12 @@ export function resolveImageTag(env = process.env, options = {}) {
 }
 
 /**
+ * Same repository naming as resolveDockerImageRef, with an explicit tag.
+ * Ignores DOCKER_IMAGE_TAG / git / CI — used when restoring a known buildId.
+ *
  * @param {import('../core/config.js').DeployHubConfig} config
  * @param {Record<string, string|undefined>} [env]
- * @param {{
- *   getGitShortSha?: () => string|null,
- *   now?: () => Date,
- * }} [options]
+ * @param {string} imageTag
  * @returns {{
  *   imageName: string,
  *   imageTag: string,
@@ -56,12 +56,8 @@ export function resolveImageTag(env = process.env, options = {}) {
  *   tagSource: ImageTagSource,
  * }}
  */
-export function resolveDockerImageRef(config, env = process.env, options = {}) {
+export function resolveDockerImageRefForTag(config, env = process.env, imageTag) {
   const imageName = env.DOCKER_IMAGE_NAME || config.project;
-  const { imageTag, tagSource } = resolveImageTag(env, {
-    ...options,
-    buildId: /** @type {{ buildId?: string }} */ (config).buildId,
-  });
   const registryUrl = env.DOCKER_REGISTRY_URL || '';
 
   const repository =
@@ -75,6 +71,47 @@ export function resolveDockerImageRef(config, env = process.env, options = {}) {
     fullImage: `${repository}:${imageTag}`,
     latestImage: `${repository}:latest`,
     legacyLatestImage: `${config.project}:latest`,
+    tagSource: 'buildId',
+  };
+}
+
+/**
+ * Replace the tag portion of a docker image ref (handles registry:port/name:tag).
+ * @param {string} imageRef
+ * @param {string} newTag
+ */
+export function replaceDockerImageTag(imageRef, newTag) {
+  const lastSlash = imageRef.lastIndexOf('/');
+  const lastColon = imageRef.lastIndexOf(':');
+  if (lastColon > lastSlash) {
+    return `${imageRef.slice(0, lastColon)}:${newTag}`;
+  }
+  return `${imageRef}:${newTag}`;
+}
+
+/**
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {Record<string, string|undefined>} [env]
+ * @param {{
+ *   getGitShortSha?: () => string|null,
+ *   now?: () => Date,
+ * }} [options]
+ * @returns {{
+ *   imageName: string,
+ *   imageTag: string,
+ *   fullImage: string,
+ *   latestImage: string,
+ *   legacyLatestImage: string,
+ *   tagSource: ImageTagSource,
+ * }}
+ */
+export function resolveDockerImageRef(config, env = process.env, options = {}) {
+  const { imageTag, tagSource } = resolveImageTag(env, {
+    ...options,
+    buildId: /** @type {{ buildId?: string }} */ (config).buildId,
+  });
+  return {
+    ...resolveDockerImageRefForTag(config, env, imageTag),
     tagSource,
   };
 }
@@ -217,6 +254,8 @@ export function describeInterpretedBackendGap(framework) {
 
 export default {
   resolveDockerImageRef,
+  resolveDockerImageRefForTag,
+  replaceDockerImageTag,
   resolveImageTag,
   highResImageTagFallback,
   EXPLICIT_IMAGE_TAG_WARNING,

package/src/utils/dockerfile-expose.js

@@ -0,0 +1,117 @@
+import fs from 'fs-extra';
+import path from 'path';
+
+/** Static SPA frameworks that use nginx:alpine + EXPOSE 80 in generated Dockerfiles. */
+const STATIC_FRONTEND_FRAMEWORKS = new Set([
+  'react',
+  'vue',
+  'angular',
+  'svelte',
+  'astro',
+  'vanilla',
+]);
+
+/**
+ * Parse the listening port from Dockerfile EXPOSE instructions.
+ * Uses the last EXPOSE line (final stage in multi-stage builds).
+ * Supports `EXPOSE 80`, `EXPOSE 80/tcp`, and multi-port lines (first numeric wins on that line).
+ *
+ * @param {string} content
+ * @returns {number|null}
+ */
+export function parseDockerfileExposePort(content) {
+  if (!content || typeof content !== 'string') return null;
+
+  /** @type {number|null} */
+  let lastPort = null;
+
+  for (const rawLine of content.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith('#')) continue;
+
+    const match = line.match(/^EXPOSE\s+(.+)$/i);
+    if (!match) continue;
+
+    const tokens = match[1].trim().split(/\s+/);
+    for (const token of tokens) {
+      const portToken = token.split('/')[0];
+      if (!/^\d+$/.test(portToken)) continue;
+      const port = Number(portToken);
+      if (port >= 1 && port <= 65535) {
+        lastPort = port;
+        break;
+      }
+    }
+  }
+
+  return lastPort;
+}
+
+/**
+ * Per-type fallback matching generated Dockerfile templates when EXPOSE is unavailable.
+ *
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @returns {number}
+ */
+export function resolveFallbackContainerPort(config) {
+  const projectType = config.projectType || 'frontend';
+  const framework =
+    (projectType === 'both'
+      ? config.backend?.framework || config.framework
+      : config.framework) ||
+    (projectType === 'frontend' ? 'react' : 'express');
+
+  if (projectType === 'frontend' && STATIC_FRONTEND_FRAMEWORKS.has(framework)) {
+    return 80;
+  }
+
+  if (['laravel', 'symfony', 'php'].includes(framework)) return 80;
+  if (['fastapi', 'django', 'flask', 'python'].includes(framework)) return 8000;
+  if (['spring', 'java'].includes(framework)) return 8080;
+  if (framework === 'go') return 8080;
+  if (framework === 'dotnet') return 5000;
+  if (framework === 'rails') return 3000;
+
+  // nextjs, nestjs, express, and other Node backends
+  return 3000;
+}
+
+/**
+ * Precedence: Dockerfile EXPOSE → config.port / backend.port → per-type fallback.
+ *
+ * @param {string} cwd
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @returns {Promise<{ port: number, source: 'expose'|'config'|'fallback' }>}
+ */
+export async function resolveContainerPort(cwd, config) {
+  const dockerfilePath = path.join(cwd, 'Dockerfile');
+  if (await fs.pathExists(dockerfilePath)) {
+    try {
+      const content = await fs.readFile(dockerfilePath, 'utf8');
+      const exposed = parseDockerfileExposePort(content);
+      if (exposed != null) {
+        return { port: exposed, source: 'expose' };
+      }
+    } catch {
+      // treat as unparseable / unreadable → continue
+    }
+  }
+
+  if (config.projectType === 'both' && config.backend?.port) {
+    return { port: Number(config.backend.port), source: 'config' };
+  }
+  if (config.port) {
+    return { port: Number(config.port), source: 'config' };
+  }
+  if (config.backend?.port) {
+    return { port: Number(config.backend.port), source: 'config' };
+  }
+
+  return { port: resolveFallbackContainerPort(config), source: 'fallback' };
+}
+
+export default {
+  parseDockerfileExposePort,
+  resolveFallbackContainerPort,
+  resolveContainerPort,
+};

package/src/utils/github-actions.js

@@ -259,19 +259,23 @@ function applyKubernetesWorkflowEnv(deployEnvironments, environments, envVars) {
   envVars.add('KUBECONFIG: ${{ github.workspace }}/.kube/config');
 }
 
+export const DEPLOY_WORKFLOW_FILENAME = 'deployhub.yml';
+export const ROLLBACK_WORKFLOW_FILENAME = 'deployhub-rollback.yml';
+
 /**
+ * Shared env entries for deploy and rollback workflows (same secret resolution).
+ * Uses getDeploymentWorkflowSecretKeys(env.type) — no separate rollback list.
+ *
  * @param {string[]} storageProviders
  * @param {string[]} deployEnvironments
  * @param {Record<string, { type: string }>} environments
- * @param {string} [cliSource]
  * @param {import('../core/config.js').DeployHubConfig} [config]
- * @returns {string}
+ * @returns {Set<string>}
  */
-export function generateWorkflowYaml(
+export function buildWorkflowEnvEntries(
   storageProviders,
   deployEnvironments,
   environments,
-  cliSource = DEFAULT_NPM_CLI_SOURCE,
   config = null
 ) {
   /** @type {Set<string>} */
@@ -295,10 +299,65 @@ export function generateWorkflowYaml(
   }
 
   applyKubernetesWorkflowEnv(deployEnvironments, environments, envVars);
+  return envVars;
+}
 
-  const envBlock = Array.from(envVars)
-    .map((line) => `          ${line}`)
+/**
+ * @param {Set<string>} envVars
+ * @param {string} [indent]
+ */
+function formatWorkflowEnvBlock(envVars, indent = '          ') {
+  return Array.from(envVars)
+    .map((line) => `${indent}${line}`)
     .join('\n');
+}
+
+/**
+ * Shell command to run deployhub rollback from the installed scoped package.
+ * @returns {string}
+ */
+export function getCliRollbackCommand() {
+  return `node ./node_modules/${NPM_PACKAGE}/src/cli/index.js rollback`;
+}
+
+/**
+ * Collect secret names referenced as ${{ secrets.NAME }} in workflow YAML.
+ * @param {string} yaml
+ * @returns {string[]}
+ */
+export function extractWorkflowSecretKeys(yaml) {
+  /** @type {Set<string>} */
+  const keys = new Set();
+  const re = /\$\{\{\s*secrets\.([A-Z0-9_]+)\s*\}\}/g;
+  let match;
+  while ((match = re.exec(yaml)) !== null) {
+    keys.add(match[1]);
+  }
+  return [...keys].sort();
+}
+
+/**
+ * @param {string[]} storageProviders
+ * @param {string[]} deployEnvironments
+ * @param {Record<string, { type: string }>} environments
+ * @param {string} [cliSource]
+ * @param {import('../core/config.js').DeployHubConfig} [config]
+ * @returns {string}
+ */
+export function generateWorkflowYaml(
+  storageProviders,
+  deployEnvironments,
+  environments,
+  cliSource = DEFAULT_NPM_CLI_SOURCE,
+  config = null
+) {
+  const envVars = buildWorkflowEnvEntries(
+    storageProviders,
+    deployEnvironments,
+    environments,
+    config
+  );
+  const envBlock = formatWorkflowEnvBlock(envVars);
 
   const installSpec = getCliInstallSpec(cliSource);
   const backendSteps = getBackendSetupSteps(config);
@@ -340,6 +399,71 @@ ${envBlock}
   return workflow;
 }
 
+/**
+ * Manual rollback via Actions tab / gh workflow run (workflow_dispatch only).
+ *
+ * @param {string[]} storageProviders
+ * @param {string[]} deployEnvironments
+ * @param {Record<string, { type: string }>} environments
+ * @param {string} [cliSource]
+ * @param {import('../core/config.js').DeployHubConfig} [config]
+ * @returns {string}
+ */
+export function generateRollbackWorkflowYaml(
+  storageProviders,
+  deployEnvironments,
+  environments,
+  cliSource = DEFAULT_NPM_CLI_SOURCE,
+  config = null
+) {
+  const envVars = buildWorkflowEnvEntries(
+    storageProviders,
+    deployEnvironments,
+    environments,
+    config
+  );
+  const envBlock = formatWorkflowEnvBlock(envVars);
+
+  const installSpec = getCliInstallSpec(cliSource);
+  const githubGitConfigStep = isGithubCliSource(cliSource)
+    ? `${getGithubGitConfigStep()}\n`
+    : '';
+  const kubernetesSteps = hasKubernetesDeploy(deployEnvironments, environments)
+    ? `${getKubernetesSetupSteps()}\n`
+    : '';
+
+  const rollbackCmd = getCliRollbackCommand();
+
+  return `${getWorkflowHeaderComment()}name: DeployHub Rollback
+on:
+  workflow_dispatch:
+    inputs:
+      buildId:
+        description: 'Exact buildId to restore (leave blank = previous build)'
+        required: false
+        type: string
+jobs:
+  rollback:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+${kubernetesSteps}${githubGitConfigStep}      - name: Install DeployHub CLI
+        run: npm install ${installSpec} --no-save
+      - name: Rollback
+        env:
+${envBlock}
+        run: |
+          if [ -n "\${{ inputs.buildId }}" ]; then
+            ${rollbackCmd} "\${{ inputs.buildId }}"
+          else
+            ${rollbackCmd}
+          fi
+`;
+}
+
 /**
  * @param {import('../core/config.js').DeployHubConfig} [config]
  * @returns {string}
@@ -373,6 +497,8 @@ function getInstallDepsCommand(config) {
 }
 
 /**
+ * Write deployhub.yml and deployhub-rollback.yml from the same secret/env helpers.
+ *
  * @param {string[]} storageProviders
  * @param {string[]} deployEnvironments
  * @param {Record<string, { type: string }>} environments
@@ -390,14 +516,55 @@ export async function writeWorkflowFile(
 ) {
   const workflowDir = path.join(cwd, '.github', 'workflows');
   await fs.ensureDir(workflowDir);
-  const content = generateWorkflowYaml(
+
+  const deployContent = generateWorkflowYaml(
     storageProviders,
     deployEnvironments,
     environments,
     cliSource,
     config
   );
-  await fs.writeFile(path.join(workflowDir, 'deployhub.yml'), content);
+  const rollbackContent = generateRollbackWorkflowYaml(
+    storageProviders,
+    deployEnvironments,
+    environments,
+    cliSource,
+    config
+  );
+
+  await fs.writeFile(path.join(workflowDir, DEPLOY_WORKFLOW_FILENAME), deployContent);
+  await fs.writeFile(path.join(workflowDir, ROLLBACK_WORKFLOW_FILENAME), rollbackContent);
+}
+
+/**
+ * Doctor helper: informational status for the rollback workflow file.
+ * Returns null when the check does not apply (no storage/deploy configured).
+ *
+ * @param {string} cwd
+ * @param {{ storage?: string[], deploy?: string[] }} config
+ * @returns {Promise<null | { name: string, pass: boolean, message: string }>}
+ */
+export async function getRollbackWorkflowDoctorCheck(cwd, config) {
+  const hasStorage = (config.storage || []).length > 0;
+  const hasDeploy = (config.deploy || []).length > 0;
+  if (!hasStorage || !hasDeploy) return null;
+
+  const rollbackPath = path.join(cwd, '.github', 'workflows', ROLLBACK_WORKFLOW_FILENAME);
+  if (await fs.pathExists(rollbackPath)) {
+    return {
+      name: 'Rollback workflow',
+      pass: true,
+      message: `Workflow file exists at .github/workflows/${ROLLBACK_WORKFLOW_FILENAME}`,
+    };
+  }
+
+  return {
+    name: 'Rollback workflow',
+    pass: true,
+    message:
+      `Missing .github/workflows/${ROLLBACK_WORKFLOW_FILENAME} — ` +
+      'run deployhub sync-workflows to add CI rollback (workflow_dispatch)',
+  };
 }
 
 /**