@akash-chowdhury-24/deployhub 2.0.14 → 2.0.16

package/README.md

@@ -86,7 +86,7 @@ This interactive wizard will:
 - Set up storage providers (AWS, Google Drive, Azure, GCP, Dropbox, Local)
 - Optionally configure deployment targets (SSH, Docker, EC2, Azure VM, GCP VM, Kubernetes)
 - Generate `deployhub.config.json`
-- Generate `.github/workflows/deployhub.yml`
+- Generate `.github/workflows/deployhub.yml` and `.github/workflows/deployhub-rollback.yml`
 - Generate `.env.example`
 
 ### 2. Configure credentials
@@ -182,7 +182,8 @@ The wizard asks the same core questions for every setup:
 **Generated files:**
 
 - `deployhub.config.json` — project settings (no secrets)
-- `.github/workflows/deployhub.yml` — CI pipeline
+- `.github/workflows/deployhub.yml` — CI deploy pipeline (push to main)
+- `.github/workflows/deployhub-rollback.yml` — manual CI rollback (`workflow_dispatch`)
 - `.env.example` — list of env vars you may need
 - `nginx.conf` — auto-generated if frontend deploys to SSH
 - `Dockerfile` — auto-generated if missing and you chose Docker or Kubernetes deploy (your existing `Dockerfile` is never overwritten)
@@ -228,12 +229,41 @@ Or push to `main` / `master` — the generated workflow runs the same command.
 deployhub artifact list              # local artifacts
 deployhub artifact list --remote     # include storage history.json
 deployhub artifact restore <buildId> # download a past build
-deployhub deploy                     # deploy latest artifact without rebuilding
-deployhub rollback                   # previous build from history
-deployhub rollback <buildId>         # exact build (required if semver is ambiguous)
+
+deployhub deploy                     # deploy latest artifact to defaultEnvironment
+deployhub deploy --env staging       # deploy one named environment
+deployhub deploy --env all           # every enabled environment (skips disabled)
+
+deployhub rollback                   # previous build for defaultEnvironment
+deployhub rollback --env production  # roll back one env using its own history
+deployhub rollback 1.0.6-a1b2c3d --env staging
+deployhub rollback --env all         # continue-on-error across enabled envs
+
+deployhub env list                   # list environments (method, status, last deploy)
+deployhub env add staging            # add an environment (interactive method prompts)
+deployhub env enable staging         # include in deploy / --env all
+deployhub env disable staging        # exclude without deleting config
+deployhub env remove staging         # remove env (re-point defaultEnvironment first if needed)
+
+deployhub sync-workflows             # regenerate deploy + rollback GitHub Actions YAML
+deployhub sync-k8s-ports             # fix containerPort/targetPort in existing k8s manifests
 deployhub logs                       # last deployment logs
 ```
 
+### Rollback behavior
+
+`deployhub rollback` restores a previous artifact from **that environment's** `envs/{env}/history.json` (legacy project `history.json` is treated as the default env's history) and redeploys it:
+
+| Argument | Behavior |
+|----------|----------|
+| *(none)* | Rolls back to the **previous** build (second entry in newest-first history) |
+| Exact `buildId` | Rolls back to that specific build |
+| Semver / version string matching **multiple** builds | Does **not** guess — prints the matching `buildId`s and exits; re-run with an exact one |
+
+`buildId` looks like `{semver}-{stamp}` where the stamp is a short git SHA when available, otherwise a CI run id, otherwise a high-resolution timestamp. When `DOCKER_IMAGE_TAG` is left unset, Docker and Kubernetes use that same `buildId` as the image tag — so you can correlate an artifact in storage with the image that was pushed.
+
+For CI-triggered rollback, see [CI rollback](#ci-rollback-deployhub-rollbackyml).
+
 ---
 
 ## Walkthrough: Storage only
@@ -276,12 +306,14 @@ Artifacts appear under `artifact/{projectName}/{date}/v{buildId}/` locally.
 **Remote storage** (S3 and other providers) uses a different layout:
 
 ```text
-{project}/builds/{buildId}/artifact.zip   # immutable per CI/build
-{project}/history.json                    # newest-first index for rollback / list --remote
-{project}/latest/artifact.zip             # mutable pointer overwritten every upload (NOT a backup)
+{project}/builds/{buildId}/artifact.zip          # immutable per CI/build (shared across envs)
+{project}/history.json                           # build catalog for artifact list --remote
+{project}/latest/artifact.zip                    # last uploaded build (NOT a backup)
+{project}/envs/{env}/history.json                # per-environment deploy history (rollback)
+{project}/envs/{env}/latest/artifact.zip         # last deploy to that env (NOT a backup)
 ```
 
-`buildId` is unique per pipeline run (e.g. `1.0.6-a1b2c3d`) even if `package.json` semver is unchanged. Legacy keys `{project}/v{semver}/artifact.zip` are no longer written; they remain readable for older uploads only.
+`buildId` is unique per pipeline run (e.g. `1.0.6-a1b2c3d`) even if `package.json` semver is unchanged. Legacy keys `{project}/v{semver}/artifact.zip` are no longer written; they remain readable for older uploads only. Build once, then promote the same `buildId` to any environment with `deployhub deploy --env`.
 
 ### Same steps for other languages
 
@@ -555,17 +587,27 @@ All JS frontends share the same install/build flow: `npm ci` → `npm run build`
 After `init`, commit these files:
 
 ```bash
-git add deployhub.config.json .github/workflows/deployhub.yml .env.example
+git add deployhub.config.json .github/workflows/deployhub.yml .github/workflows/deployhub-rollback.yml .env.example
 git commit -m "Add DeployHub CI"
 ```
 
 1. Open **Settings → Secrets and variables → Actions** in your GitHub repo.
 2. Add every secret listed at the end of `deployhub init` (storage + deployment).
-3. Push to `main` or `master` — the workflow triggers on push.
+3. Push to `main` or `master` — the deploy workflow triggers on push.
+
+The deploy workflow (`deployhub.yml`) installs the correct language runtime (Node, Python, Java, Go, .NET, Ruby) based on your `deployhub.config.json`, installs DeployHub, runs `deployhub build`, and uses your secrets.
+
+To run a deploy manually: **Actions → DeployHub → Run workflow**.
 
-The workflow installs the correct language runtime (Node, Python, Java, Go, .NET, Ruby) based on your `deployhub.config.json`, installs DeployHub, runs `deployhub build`, and uses your secrets.
+### CI rollback (`deployhub-rollback.yml`)
 
-To run manually: **Actions → DeployHub → Run workflow**.
+`init` also generates a separate **DeployHub Rollback** workflow (`deployhub-rollback.yml`). It is triggered only via GitHub Actions' **Run workflow** button (not on push):
+
+1. Open **Actions → DeployHub Rollback → Run workflow**.
+2. Optionally enter an exact `buildId` (leave blank to roll back to the previous build).
+3. Run the workflow.
+
+Already-initialized projects that only have `deployhub.yml` will not get the rollback workflow from a re-run of unrelated commands — run **`deployhub sync-workflows`** once to regenerate both workflow files from your current `deployhub.config.json`, then commit and push.
 
 ---
 
@@ -648,6 +690,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### SSH
 
+**Verification:** Real-world verified DEPLOY and ROLLBACK.
+
 **Prerequisites (before `deployhub init`):**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (deploy path ownership + Nginx/sudo for frontends)
 - [ ] A Linux server with SSH enabled
@@ -687,7 +731,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Docker
 
-**Verification:** Real-world verified (local and CI Docker deploys).
+**Verification:** Real-world verified DEPLOY and ROLLBACK (local and CI).
 
 **Prerequisites:**
 - [ ] Docker installed (`docker --version` works)
@@ -722,6 +766,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### AWS EC2
 
+**Verification:** Real-world verified DEPLOY and ROLLBACK.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (`ec2-user` on Amazon Linux)
 - [ ] EC2 instance launched in AWS Console (DeployHub does not create it)
@@ -758,6 +804,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Azure VM
 
+**Verification:** Real-world verified DEPLOY. Rollback logic confirmed via shared-SSH-path audit; not yet live-tested independently.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (`azureuser` or your VM login user)
 - [ ] Azure VM created in Portal (DeployHub does not provision it)
@@ -792,6 +840,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### GCP VM
 
+**Verification:** Real-world verified DEPLOY. Rollback logic confirmed via shared-SSH-path audit; not yet live-tested independently.
+
 **Prerequisites:**
 - [ ] Complete **[one-time server setup](#one-time-server-setup-before-your-first-deploy)** (your GCP SSH username)
 - [ ] Compute Engine VM created (DeployHub does not create it)
@@ -832,7 +882,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 
 ### Kubernetes
 
-**Verification:** Real-world verified (including k3s and CI deploys).
+**Verification:** Real-world verified DEPLOY and ROLLBACK (including k3s and CI).
 
 **Prerequisites:**
 - [ ] Existing Kubernetes cluster (DeployHub does not provision clusters)
@@ -868,7 +918,7 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 6. Add GitHub Secrets for CI (see table — **`KUBECONFIG` must be the file contents, not a path**)
 7. Run `deployhub doctor`, then `git push origin main`
 
-> **Warning — Service `targetPort`:** the default `targetPort` in generated `k8s/service.yaml` may not match your app's actual exposed port (e.g. a static nginx image serves on port **80**, not the config's default like 3000). Verify and adjust `k8s/service.yaml`'s `targetPort` (and the Deployment `containerPort` if needed) before your first deploy.
+> **Ports in generated Kubernetes manifests:** `containerPort` and `targetPort` are derived from your project's Dockerfile `EXPOSE` line (frontend / nginx images correctly get **80**; backends get their real exposed port). If no Dockerfile or usable `EXPOSE` exists yet, DeployHub falls back to a per-project-type default that matches its Dockerfile templates. Fresh `init` does **not** require a manual port edit. The Service's external `port:` stays **80** for all project types by design (Ingress-friendly); only the internal `targetPort` / `containerPort` track the container. Already-initialized projects with stale `3000` values can run `deployhub sync-k8s-ports` to patch just those fields.
 
 | Variable | Description | Example | Where to get it |
 |----------|-------------|---------|-----------------|
@@ -952,21 +1002,35 @@ Run `deployhub doctor` after any config change.
 
 | Command | Description |
 |---------|-------------|
-| `deployhub init` | Interactive project setup |
-| `deployhub build` | Full pipeline: detect → install → test → build → artifact → storage → deploy |
+| `deployhub init` | Interactive project setup (one or multiple environments) |
+| `deployhub build` | Full pipeline: detect → install → test → build → artifact → storage → deploy (default / push-triggered envs) |
 | `deployhub artifact create` | Create artifact from current build |
 | `deployhub artifact list [--remote]` | List local artifacts; `--remote` merges storage `history.json` |
 | `deployhub artifact restore <buildId\|semver>` | Download and extract an artifact |
 | `deployhub storage add <provider>` | Add storage provider credentials |
 | `deployhub storage list` | List storage providers and connection status |
-| `deployhub deploy` | Deploy latest artifact |
-| `deployhub rollback [buildId\|semver]` | Previous build, or exact buildId (ambiguous semver lists matches and exits) |
+| `deployhub deploy` | Deploy latest artifact to `defaultEnvironment` |
+| `deployhub deploy --env staging` | Deploy to one named environment |
+| `deployhub deploy --env all` | Deploy to every enabled environment (skips disabled) |
+| `deployhub rollback` | Roll back `defaultEnvironment` to its previous build |
+| `deployhub rollback --env production` | Roll back one env from `envs/{env}/history.json` |
+| `deployhub rollback <buildId> --env staging` | Restore an exact `buildId` to that environment |
+| `deployhub rollback --env all` | Roll back each enabled env (continue-on-error + summary) |
+| `deployhub env list` | List environments (method, enabled, trigger, last deploy) |
+| `deployhub env add <name>` | Add an environment (interactive method prompts; regenerates workflows) |
+| `deployhub env enable <name>` | Enable an environment for deploy / `--env all` |
+| `deployhub env disable <name>` | Disable without deleting config |
+| `deployhub env remove <name>` | Remove an environment (re-point `defaultEnvironment` first if needed) |
+| `deployhub sync-workflows` | Regenerate `.github/workflows/deployhub.yml` and `deployhub-rollback.yml` from config |
+| `deployhub sync-k8s-ports` | Update only `containerPort` / `targetPort` in `k8s/deployment.yaml` and `k8s/service.yaml` from Dockerfile `EXPOSE` (or config/fallback). Does **not** change replicas, resources, env, or probes. Heavily customized / multi-container manifests may need a manual review |
 | `deployhub logs` | Show logs from last deployment |
-| `deployhub doctor` | Pre-flight checks |
+| `deployhub doctor [--all]` | Pre-flight checks per environment (`--all` includes disabled envs as informational) |
 | `deployhub verify` | Health check on configured endpoint |
 | `deployhub clean` | Remove old local artifacts |
 | `deployhub update` | Check for CLI updates |
 
+**Tests:** `npm test` — currently **270 passing** across the Jest suites.
+
 ## GitHub Secrets
 
 Add these secrets in your repository (Settings → Secrets and variables → Actions). Only add secrets for providers you selected during `init`. At the end of `deployhub init`, DeployHub prints the exact list for your project.
@@ -1009,6 +1073,8 @@ Add these secrets in your repository (Settings → Secrets and variables → Act
 | `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_USERNAME`, `DOCKER_REGISTRY_TOKEN`, `DOCKER_REGISTRY_URL`, `DOCKER_HOST` | Docker deployment (`DOCKER_IMAGE_TAG` optional) |
 | `KUBECONFIG`, `KUBE_CONTEXT`, `KUBE_NAMESPACE`, `DOCKER_IMAGE_NAME`, `DOCKER_REGISTRY_USERNAME`, `DOCKER_REGISTRY_TOKEN`, `DOCKER_REGISTRY_URL`, `DOCKER_IMAGE_TAG`, `KUBE_IMAGE_PULL_SECRET` | Kubernetes — **`KUBECONFIG` in GitHub Secrets must be the kubeconfig file contents (or base64), not a filesystem path**. `DOCKER_IMAGE_TAG`, `KUBE_NAMESPACE`, `DOCKER_REGISTRY_URL`, and `KUBE_IMAGE_PULL_SECRET` are optional |
 
+**Kubernetes rollback vs deploy — registry credentials:** Kubernetes **rollback** specifically **requires** `DOCKER_REGISTRY_USERNAME` and `DOCKER_REGISTRY_TOKEN`. Rollback rebuilds and must push a fresh image tagged with the restored `buildId`; without registry credentials it fails loudly and early (a rollback that cannot push can never succeed against a real cluster). This is stricter than a normal Kubernetes **deploy**, which may still allow local-only / no-push flows in some setups. If deploy worked without those secrets but rollback fails asking for them, that asymmetry is intentional.
+
 See [Deployment method guides](#deployment-method-guides) for full per-method variable tables with examples.
 
 ## `deployhub doctor` Output
@@ -1025,11 +1091,16 @@ The doctor command runs independent checks and always completes without crashing
   Checking Health endpoint...   ✓ URL reachable (HTTP 200)
   Checking Secrets...           ✓ All required env vars present
   Checking GitHub Actions...    ✓ Workflow file exists at .github/workflows/deployhub.yml
+  Checking Rollback workflow... ✓ Missing .github/workflows/deployhub-rollback.yml — run deployhub sync-workflows to add CI rollback (workflow_dispatch)
   Checking Storage write...     ✓ Test upload succeeded
 
-  ✓ Ready to deploy (10/10 checks passed)
+  ✓ Ready to deploy (11/11 checks passed)
 ```
 
+The **Rollback workflow** check is informational and non-blocking (`✓` even when the file is missing). It suggests `deployhub sync-workflows` so already-initialized projects can pick up `deployhub-rollback.yml` without a full re-init. When the file exists, the message confirms the path instead.
+
+If checked-in workflow files exist but are **out of date** with `deployhub.config.json` (e.g. you ran `env add` or a silent migration and forgot `sync-workflows`), doctor also reports an informational **Workflow sync** nudge naming the missing environment or secret and suggesting `deployhub sync-workflows`. That check never fails the doctor exit code.
+
 If checks fail:
 
 ```
@@ -1062,9 +1133,11 @@ artifact/
 **Remote keys** (all storage providers):
 
 ```
-{project}/builds/{buildId}/artifact.zip
-{project}/history.json
-{project}/latest/artifact.zip    # overwritten every build — convenience pointer only, not version history
+{project}/builds/{buildId}/artifact.zip          # immutable per CI/build (shared across envs)
+{project}/history.json                           # build catalog for artifact list --remote
+{project}/latest/artifact.zip                    # overwritten every build — convenience pointer only
+{project}/envs/{env}/history.json                # per-environment deploy history (rollback)
+{project}/envs/{env}/latest/artifact.zip         # last deploy to that env (NOT a backup)
 ```
 
 Legacy (read-only fallback, no longer written): `{project}/v{semver}/artifact.zip`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akash-chowdhury-24/deployhub",
-  "version": "2.0.14",
+  "version": "2.0.16",
   "description": "Zero-configuration deployment and artifact manager",
   "type": "module",
   "main": "./src/cli/index.js",

package/src/artifact/engine.js

@@ -13,6 +13,12 @@ import {
   copyDeployAssetsToArtifactDir,
 } from '../utils/scaffold.js';
 import { getGeneratedByMetadata, getArtifactReadmeFooter } from '../utils/author.js';
+import {
+  getEnabledEnvironmentNames,
+  getEnvMethod,
+  getEnvSettings,
+  resolveDefaultEnvironmentName,
+} from '../core/config.js';
 
 /**
  * @param {string} cwd
@@ -151,13 +157,14 @@ async function stageFrontendArtifact(cwd, stagingDir, config) {
 
   await copyKubernetesManifestsIfPresent(cwd, stagingDir);
 
-  const hasSshDeploy = (config.deploy || []).some(
-    (envName) => config.environments[envName]?.type === 'ssh'
+  const deployTargets = getEnabledEnvironmentNames(config);
+  const hasSshDeploy = deployTargets.some(
+    (envName) => getEnvMethod(config.environments[envName]) === 'ssh'
   );
 
   if (hasSshDeploy && !fs.existsSync(path.join(stagingDir, 'nginx.conf'))) {
-    const envName = config.deploy?.[0];
-    const env = envName ? config.environments[envName] : null;
+    const envName = resolveDefaultEnvironmentName(config) || deployTargets[0];
+    const env = envName ? getEnvSettings(config.environments[envName]) : null;
     const deployPath =
       env?.frontendDeployPath || env?.deployPath || env?.path || `/var/www/${config.project}`;
     const nginxConf = generateNginxConfig(config.project, deployPath, outputName);

package/src/cli/index.js

@@ -14,6 +14,8 @@ import { registerVerifyCommand } from '../commands/verify.js';
 import { registerCleanCommand } from '../commands/clean.js';
 import { registerUpdateCommand } from '../commands/update.js';
 import { registerSyncWorkflowsCommand } from '../commands/sync-workflows.js';
+import { registerSyncK8sPortsCommand } from '../commands/sync-k8s-ports.js';
+import { registerEnvCommand } from '../commands/env.js';
 import { formatVersionOutput, printBanner, shouldShowBanner } from '../utils/author.js';
 
 loadEnv();
@@ -43,5 +45,7 @@ registerVerifyCommand(program);
 registerCleanCommand(program);
 registerUpdateCommand(program);
 registerSyncWorkflowsCommand(program);
+registerSyncK8sPortsCommand(program);
+registerEnvCommand(program);
 
 program.parse();

package/src/commands/deploy.js

@@ -1,10 +1,16 @@
 import chalk from 'chalk';
 import { loadConfig, loadEnv } from '../core/config.js';
+import { resolveEnvTargets } from '../core/environments.js';
 import { runPipeline } from '../core/pipeline.js';
 import { listLocalArtifacts } from '../artifact/engine.js';
 import { deployToAll } from '../deployment/index.js';
 import { sendNotifications } from '../notifications/index.js';
-import axios from 'axios';
+import {
+  anyEnvHasResolvableHealthCheckUrl,
+  runHealthChecksForEnvs,
+  formatHealthCheckAllSummary,
+} from '../utils/health-check.js';
+import { createLogger } from '../logger/index.js';
 
 /**
  * @param {import('commander').Command} program
@@ -12,11 +18,34 @@ import axios from 'axios';
 export function registerDeployCommand(program) {
   program
     .command('deploy')
-    .description('Deploy the latest artifact')
-    .action(async () => {
+    .description('Deploy the latest artifact (default environment, or --env)')
+    .option(
+      '--env <name>',
+      'Environment to deploy (name, or "all" for every enabled environment)'
+    )
+    .action(async (opts) => {
       loadEnv();
       const cwd = process.cwd();
       const config = await loadConfig(cwd);
+      const log = createLogger('deploy');
+
+      let targets;
+      let skippedDisabled;
+      try {
+        ({ targets, skippedDisabled } = resolveEnvTargets(config, opts.env));
+      } catch (err) {
+        console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        process.exit(1);
+      }
+
+      for (const name of skippedDisabled) {
+        log.info(`Skipping disabled environment "${name}"`);
+      }
+
+      if (targets.length === 0) {
+        console.error(chalk.red('No enabled environments to deploy.'));
+        process.exit(1);
+      }
 
       const artifacts = await listLocalArtifacts(cwd);
       if (artifacts.length === 0) {
@@ -34,27 +63,43 @@ export function registerDeployCommand(program) {
           async run(ctx) {
             const deployed = await deployToAll(
               ctx.config,
-              /** @type {string} */ (ctx.state.artifactDir)
+              /** @type {string} */ (ctx.state.artifactDir),
+              targets
             );
             ctx.state.deployedTargets = deployed;
           },
         },
         {
           name: 'verify',
-          enabled: (ctx) => !!ctx.config.healthCheck?.url,
+          enabled: (ctx) => {
+            const deployed = /** @type {string[]} */ (
+              ctx.state.deployedTargets || targets
+            );
+            return anyEnvHasResolvableHealthCheckUrl(ctx.config, deployed);
+          },
           async run(ctx) {
-            const url = ctx.config.healthCheck.url;
-            const timeout = (ctx.config.healthCheck.timeout || 30) * 1000;
-            const start = Date.now();
-            const response = await axios.get(url, {
-              timeout,
-              validateStatus: () => true,
-            });
-            const elapsed = Date.now() - start;
-            if (response.status < 200 || response.status >= 400) {
-              throw new Error(`Health check failed: HTTP ${response.status}`);
+            const deployed = /** @type {string[]} */ (
+              ctx.state.deployedTargets || targets
+            );
+            const { results, failures } = await runHealthChecksForEnvs(
+              ctx.config,
+              deployed
+            );
+
+            if (deployed.length > 1 || failures.length > 0) {
+              console.log('');
+              console.log(formatHealthCheckAllSummary(results, failures));
+            } else if (results[0]) {
+              console.log(
+                chalk.green(
+                  `Health check passed (${results[0].envName}): HTTP ${results[0].status} (${results[0].elapsed}ms)`
+                )
+              );
+            }
+
+            if (failures.length > 0) {
+              throw new Error(failures[0].error);
             }
-            console.log(chalk.green(`Health check passed: ${response.status} (${elapsed}ms)`));
           },
         },
         {