NestJS Backend
Deployment Pipeline

# ---- Build Stage ----
FROM node:20-alpine AS builder
WORKDIR /app
COPY package.json ./
RUN npm i
# prisma.config.ts imports app config (e.g. src/config/database.config.ts),
# so the full source tree must exist before `prisma generate` runs.
COPY . .
# prisma.config.ts validates DB_* eagerly on load, even though `generate`
# never opens a real connection. These placeholders exist only for this
# RUN instruction's shell, never as persistent image ENV.
RUN DB_HOST=placeholder DB_PORT=3306 DB_USER=placeholder DB_PASSWORD=placeholder DB_NAME=placeholder \
    npm run build

# ---- Production Stage ----
FROM node:20-alpine AS production
WORKDIR /app
ENV NODE_ENV=production
# `prisma` is a production dependency so migrate deploy works with NODE_ENV=production.
COPY package.json ./
RUN npm i
COPY . .
RUN DB_HOST=placeholder DB_PORT=3306 DB_USER=placeholder DB_PASSWORD=placeholder DB_NAME=placeholder \
    npx prisma generate
COPY --from=builder /app/dist ./dist
COPY entrypoint.sh ./entrypoint.sh
COPY scripts/migrate-deploy.sh ./scripts/migrate-deploy.sh
RUN chmod +x ./entrypoint.sh ./scripts/migrate-deploy.sh
EXPOSE 2001
ENTRYPOINT ["./entrypoint.sh"]

node_modules
npm-debug.log
dist
.git
.gitignore
.env
.env.*
*.md
.vscode
.idea
Dockerfile
.dockerignore
.github
test
coverage

#!/bin/sh
set -e
# prisma.config.ts builds its own connection string from DB_HOST/DB_PORT/
# DB_USER/DB_PASSWORD/DB_NAME — present via --env-file at docker run, so no
# separate DATABASE_URL is needed here.
echo "Running database migrations..."
./scripts/migrate-deploy.sh
npm run prisma:seed
echo "Starting application..."
exec node dist/src/main

#!/bin/sh
set -e
MAX_ATTEMPTS=25
attempt=0

should_auto_resolve() {
  case "${PRISMA_AUTO_RESOLVE_APPLIED:-}" in
    true|1|yes|TRUE) return 0 ;;
    false|0|no|FALSE) return 1 ;;
  esac
  case "${APP_ENV:-}" in
    dev|development|local|DEV) return 0 ;;
  esac
  return 1
}

while [ "$attempt" -lt "$MAX_ATTEMPTS" ]; do
  if npx prisma migrate deploy 2>/tmp/prisma-deploy.err; then
    exit 0                       # success
  fi
  cat /tmp/prisma-deploy.err >&2

  # 1142 / REFERENCES denied → print GRANT help, stop (manual fix)
  if grep -q '1142' /tmp/prisma-deploy.err; then
    print_references_grant_help; exit 1
  fi
  # P3018 — failed while applying this run → manual recovery only
  if grep -q 'P3018' /tmp/prisma-deploy.err; then
    print_references_grant_help; exit 1
  fi
  # Only P3009 (a previously-failed migration) is auto-recoverable
  if ! grep -q 'P3009' /tmp/prisma-deploy.err; then exit 1; fi

  FAILED=$(extract_failed_migration_p3009 /tmp/prisma-deploy.err)
  if should_auto_resolve; then
    echo "Auto-resolving: $FAILED (attempt $((attempt+1))/$MAX_ATTEMPTS)"
    npx prisma migrate resolve --applied "$FAILED"
    attempt=$((attempt+1)); continue
  fi
  print_manual_recovery_p3009 "$FAILED"; exit 1
done
echo "Too many failed migration recovery attempts."; exit 1

name: Deploy Backend
on:
  push:
    branches:
      - feat/local

env:
  APP_NAME: medical-backend
  IMAGE_NAME: medical-backend
  IMAGE_TAG: ${{ github.sha }}

jobs:
  deploy:
    runs-on: medical-frontend     # self-hosted runner
    environment: dev
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create .env from Secrets and Vars
        shell: bash
        run: |
          touch .env
          chmod 600 .env
          echo '${{ toJSON(secrets) }}' | jq -r 'to_entries[] | select(.key != "GITHUB_TOKEN" and .key != "github_token") | "\(.key)=\(.value)"' >> .env
          echo '${{ toJSON(vars) }}'    | jq -r 'to_entries[] | "\(.key)=\(.value)"' >> .env

      - name: Build Docker image
        run: docker build --pull --no-cache -t ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} .

      - name: Stop existing container
        run: docker stop ${{ env.APP_NAME }} || true

      - name: Remove existing container
        run: docker rm ${{ env.APP_NAME }} || true

      # entrypoint.sh runs migrate -> seed -> start inside this one container.
      # set -e stops before the app starts if migrations fail.
      - name: Run new container
        run: |
          docker run -d \
            --name ${{ env.APP_NAME }} \
            --restart unless-stopped \
            -p 127.0.0.1:8100:2001 \
            --env-file .env \
            -e PRISMA_AUTO_RESOLVE_APPLIED=true \
            -e APP_ENV=dev \
            ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}

      - name: Clean up old images
        run: |
          docker images "${{ env.IMAGE_NAME }}" --format '{{.Tag}}' \
            | grep -v "^${{ env.IMAGE_TAG }}$" \
            | xargs -r -I {} docker rmi "${{ env.IMAGE_NAME }}:{}" || true
          docker image prune -f

      - name: Remove .env file
        if: always()
        run: rm -f .env

await prisma.user.upsert({
  where:  { email: ADMIN_EMAIL },
  update: { name: ADMIN_NAME, passwordHash, status: UserStatus.ACTIVE, type: UserType.ADMIN },
  create: { name: ADMIN_NAME, email: ADMIN_EMAIL, passwordHash, status: UserStatus.ACTIVE, type: UserType.ADMIN },
});

# Mark a migration as already applied (its SQL is correctly in the DB):
docker run --rm --env-file .env --entrypoint sh medical-backend:<tag> \
  -c "npx prisma migrate resolve --applied <migration_name>"

# Or, if the migration genuinely never applied (after reverting partial changes):
docker run --rm --env-file .env --entrypoint sh medical-backend:<tag> \
  -c "npx prisma migrate resolve --rolled-back <migration_name>"