deploy.yml

name: Deploy

on:
  workflow_dispatch:
    inputs:
      release_tag:
        description: GitHub Release tag to deploy
        required: true
        type: string
      component:
        description: Component to deploy
        required: true
        default: app-server
        type: choice
        options:
          - app-server
          - gateway
          - all
      mode:
        description: Run deploy checks, inspect remote status, or perform deployment
        required: true
        default: check
        type: choice
        options:
          - check
          - status
          - deploy
      environment:
        description: GitHub Environment containing deployment secrets
        required: true
        type: environment
      deploy_ref:
        description: Ref to check out in the server deploy directory
        required: true
        default: master
        type: string
      configure_runtime_env:
        description: Write runtime env files from GitHub Environment secrets
        required: true
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  group: dicebot-deploy-${{ inputs.environment }}
  cancel-in-progress: false

jobs:
  authorize:
    name: Authorize deployment actor
    runs-on: ubuntu-latest

    steps:
      - name: Require maintainer permission
        uses: actions/github-script@v8
        with:
          script: |
            const allowedPermissions = new Set(["maintain", "admin"]);
            const { owner, repo } = context.repo;
            const username = context.actor;
            let permission = "none";

            try {
              const response = await github.rest.repos.getCollaboratorPermissionLevel({
                owner,
                repo,
                username,
              });
              permission = response.data.permission;
            } catch (error) {
              if (error.status !== 404) {
                throw error;
              }
            }

            if (!allowedPermissions.has(permission)) {
              core.setFailed(
                `Deployment requires maintain or admin permission, but ${username} has ${permission}.`
              );
              return;
            }

            core.info(`Deployment authorized for ${username} with ${permission} permission.`);

  deploy:
    name: Deploy ${{ inputs.component }} to ${{ inputs.environment }}
    needs: authorize
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}

    steps:
      - name: Validate deployment secrets
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          test -n "${DEPLOY_HOST}" || { echo "DEPLOY_HOST secret is required" >&2; exit 1; }
          test -n "${DEPLOY_USER}" || { echo "DEPLOY_USER secret is required" >&2; exit 1; }
          test -n "${DEPLOY_SSH_PRIVATE_KEY}" || { echo "DEPLOY_SSH_PRIVATE_KEY secret is required" >&2; exit 1; }
          test -n "${DEPLOY_KNOWN_HOSTS}" || { echo "DEPLOY_KNOWN_HOSTS secret is required" >&2; exit 1; }

      - name: Configure SSH
        env:
          DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}
          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "${DEPLOY_SSH_PRIVATE_KEY}" > ~/.ssh/dicebot_deploy_key
          chmod 600 ~/.ssh/dicebot_deploy_key
          printf '%s\n' "${DEPLOY_KNOWN_HOSTS}" > ~/.ssh/known_hosts

      - name: Provision runtime configuration
        if: ${{ inputs.configure_runtime_env }}
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_ENVIRONMENT: ${{ inputs.environment }}
          DICEBOT_CONFIG_DIR: ${{ secrets.DICEBOT_CONFIG_DIR }}
          DICEBOT_RELEASE_REPO: ${{ github.repository }}
          DICEBOT_RELEASE_RETENTION: ${{ secrets.DICEBOT_RELEASE_RETENTION }}
          DICEBOT_APP_SERVICE_NAME: ${{ secrets.DICEBOT_APP_SERVICE_NAME }}
          DICEBOT_APP_RELEASES_DIR: ${{ secrets.DICEBOT_APP_RELEASES_DIR }}
          DICEBOT_APP_CURRENT_LINK: ${{ secrets.DICEBOT_APP_CURRENT_LINK }}
          DICEBOT_GATEWAY_SERVICE_NAME: ${{ secrets.DICEBOT_GATEWAY_SERVICE_NAME }}
          DICEBOT_GATEWAY_RELEASES_DIR: ${{ secrets.DICEBOT_GATEWAY_RELEASES_DIR }}
          DICEBOT_GATEWAY_CURRENT_LINK: ${{ secrets.DICEBOT_GATEWAY_CURRENT_LINK }}
          DICEBOT_SYSTEMD_ENABLE_SERVICES: ${{ secrets.DICEBOT_SYSTEMD_ENABLE_SERVICES }}
          DICEBOT_APP_WORK_DIR: ${{ secrets.DICEBOT_APP_WORK_DIR }}
          DICEBOT_GATEWAY_WORK_DIR: ${{ secrets.DICEBOT_GATEWAY_WORK_DIR }}
          DICEBOT_APP_SERVER_PORT: ${{ secrets.DICEBOT_APP_SERVER_PORT }}
          DICEBOT_SQLITE_PATH: ${{ secrets.DICEBOT_SQLITE_PATH }}
          DICEBOT_SQLITE_BACKUP_ENABLED: ${{ secrets.DICEBOT_SQLITE_BACKUP_ENABLED }}
          DICEBOT_SQLITE_BACKUP_DIR: ${{ secrets.DICEBOT_SQLITE_BACKUP_DIR }}
          DICEBOT_SQLITE_BACKUP_RETENTION: ${{ secrets.DICEBOT_SQLITE_BACKUP_RETENTION }}
          DICEBOT_GOOGLE_CREDENTIALS: ${{ secrets.DICEBOT_GOOGLE_CREDENTIALS }}
          DICEBOT_GOOGLE_CREDENTIALS_BASE64: ${{ secrets.DICEBOT_GOOGLE_CREDENTIALS_BASE64 }}
          DICEBOT_COMMAND_TEXT_LOCALE: ${{ secrets.DICEBOT_COMMAND_TEXT_LOCALE }}
          DICEBOT_SHEET_HOT_CACHE_SIZE: ${{ secrets.DICEBOT_SHEET_HOT_CACHE_SIZE }}
          DICEBOT_LOG_RAW_OPTIONS: ${{ secrets.DICEBOT_LOG_RAW_OPTIONS }}
          DICEBOT_ENVIRONMENT: ${{ secrets.DICEBOT_ENVIRONMENT }}
          DICEBOT_APP_JAVA_TOOL_OPTIONS: ${{ secrets.DICEBOT_APP_JAVA_TOOL_OPTIONS }}
          DICEBOT_GATEWAY_JAVA_TOOL_OPTIONS: ${{ secrets.DICEBOT_GATEWAY_JAVA_TOOL_OPTIONS }}
          DICEBOT_NEW_RELIC_ENABLED: ${{ secrets.DICEBOT_NEW_RELIC_ENABLED }}
          DICEBOT_APP_NEW_RELIC_ENABLED: ${{ secrets.DICEBOT_APP_NEW_RELIC_ENABLED }}
          DICEBOT_GATEWAY_NEW_RELIC_ENABLED: ${{ secrets.DICEBOT_GATEWAY_NEW_RELIC_ENABLED }}
          DICEBOT_NEW_RELIC_INSTALL_ENABLED: ${{ secrets.DICEBOT_NEW_RELIC_INSTALL_ENABLED }}
          DICEBOT_NEW_RELIC_AGENT_PATH: ${{ secrets.DICEBOT_NEW_RELIC_AGENT_PATH }}
          DICEBOT_NEW_RELIC_DOWNLOAD_URL: ${{ secrets.DICEBOT_NEW_RELIC_DOWNLOAD_URL }}
          DICEBOT_NEW_RELIC_LICENSE_KEY: ${{ secrets.DICEBOT_NEW_RELIC_LICENSE_KEY }}
          DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED: ${{ secrets.DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED }}
          DICEBOT_NEW_RELIC_LOG_FILE_PATH: ${{ secrets.DICEBOT_NEW_RELIC_LOG_FILE_PATH }}
          DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME: ${{ secrets.DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME }}
          DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME: ${{ secrets.DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME }}
          DICEBOT_APP_NEW_RELIC_APP_NAME: ${{ secrets.DICEBOT_APP_NEW_RELIC_APP_NAME }}
          DICEBOT_GATEWAY_NEW_RELIC_APP_NAME: ${{ secrets.DICEBOT_GATEWAY_NEW_RELIC_APP_NAME }}
          DICEBOT_APP_NEW_RELIC_LABELS: ${{ secrets.DICEBOT_APP_NEW_RELIC_LABELS }}
          DICEBOT_GATEWAY_NEW_RELIC_LABELS: ${{ secrets.DICEBOT_GATEWAY_NEW_RELIC_LABELS }}
          DICEBOT_TOKEN: ${{ secrets.DICEBOT_TOKEN }}
          DICEBOT_DISCORD_BOT_ID: ${{ secrets.DICEBOT_DISCORD_BOT_ID }}
          DICEBOT_SHARDS: ${{ secrets.DICEBOT_SHARDS }}
          DICEBOT_COMMAND_PARALLELISM: ${{ secrets.DICEBOT_COMMAND_PARALLELISM }}
          DICEBOT_COMMAND_QUEUE_CAPACITY: ${{ secrets.DICEBOT_COMMAND_QUEUE_CAPACITY }}
          DICEBOT_APP_SERVER_BASE_URL: ${{ secrets.DICEBOT_APP_SERVER_BASE_URL }}
          DICEBOT_APP_READY_URL: ${{ secrets.DICEBOT_APP_READY_URL }}
          DICEBOT_HEALTH_PUBLISH_ENABLED: ${{ secrets.DICEBOT_HEALTH_PUBLISH_ENABLED }}
          DICEBOT_HEALTH_PUBLISH_INTERVAL_SECONDS: ${{ secrets.DICEBOT_HEALTH_PUBLISH_INTERVAL_SECONDS }}
          DICEBOT_HEALTH_PUBLISH_TIMEOUT_SECONDS: ${{ secrets.DICEBOT_HEALTH_PUBLISH_TIMEOUT_SECONDS }}
          DICEBOT_HEALTH_EVENT_TYPE: ${{ secrets.DICEBOT_HEALTH_EVENT_TYPE }}
          DICEBOT_HEALTH_ATTEMPTS: ${{ secrets.DICEBOT_HEALTH_ATTEMPTS }}
          DICEBOT_HEALTH_DELAY_SECONDS: ${{ secrets.DICEBOT_HEALTH_DELAY_SECONDS }}
          DICEBOT_HEALTH_TIMEOUT_SECONDS: ${{ secrets.DICEBOT_HEALTH_TIMEOUT_SECONDS }}
          DEPLOY_REF: ${{ inputs.deploy_ref }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          test -n "${DICEBOT_TOKEN}" || { echo "DICEBOT_TOKEN secret is required when configure_runtime_env is true" >&2; exit 1; }
          test -n "${DICEBOT_GOOGLE_CREDENTIALS_BASE64}" || { echo "DICEBOT_GOOGLE_CREDENTIALS_BASE64 secret is required when configure_runtime_env is true" >&2; exit 1; }
          DICEBOT_DISCORD_BOT_ID="${DICEBOT_DISCORD_BOT_ID:-}"

          deploy_port="${DEPLOY_PORT:-22}"
          deploy_path="${DEPLOY_PATH:-/opt/dicebot/deploy}"
          DICEBOT_CONFIG_DIR="${DICEBOT_CONFIG_DIR:-/etc/dicebot}"
          DICEBOT_RELEASE_RETENTION="${DICEBOT_RELEASE_RETENTION:-5}"
          DICEBOT_APP_SERVER_PORT="${DICEBOT_APP_SERVER_PORT:-8080}"
          DICEBOT_SQLITE_PATH="${DICEBOT_SQLITE_PATH:-/var/lib/dicebot/app-server/dicebot.db}"
          DICEBOT_SQLITE_BACKUP_ENABLED="${DICEBOT_SQLITE_BACKUP_ENABLED:-true}"
          DICEBOT_SQLITE_BACKUP_DIR="${DICEBOT_SQLITE_BACKUP_DIR:-/var/lib/dicebot/app-server/backups}"
          DICEBOT_SQLITE_BACKUP_RETENTION="${DICEBOT_SQLITE_BACKUP_RETENTION:-10}"
          if [[ -z "${DICEBOT_SYSTEMD_ENABLE_SERVICES}" ]]; then
            if [[ "${DEPLOY_ENVIRONMENT}" == "production" ]]; then
              DICEBOT_SYSTEMD_ENABLE_SERVICES="true"
            else
              DICEBOT_SYSTEMD_ENABLE_SERVICES="false"
            fi
          fi
          DICEBOT_APP_WORK_DIR="${DICEBOT_APP_WORK_DIR:-$(dirname -- "${DICEBOT_SQLITE_PATH}")}"
          if [[ -z "${DICEBOT_GATEWAY_WORK_DIR}" && "${DEPLOY_ENVIRONMENT}" != "production" ]]; then
            DICEBOT_GATEWAY_WORK_DIR="/var/lib/dicebot-${DEPLOY_ENVIRONMENT}/gateway"
          fi
          DICEBOT_GATEWAY_WORK_DIR="${DICEBOT_GATEWAY_WORK_DIR:-/var/lib/dicebot/gateway}"
          DICEBOT_GOOGLE_CREDENTIALS="${DICEBOT_GOOGLE_CREDENTIALS:-${DICEBOT_CONFIG_DIR}/google-service-account.json}"
          DICEBOT_COMMAND_TEXT_LOCALE="${DICEBOT_COMMAND_TEXT_LOCALE:-ko_kr}"
          DICEBOT_SHEET_HOT_CACHE_SIZE="${DICEBOT_SHEET_HOT_CACHE_SIZE:-128}"
          DICEBOT_SHARDS="${DICEBOT_SHARDS:-3}"
          if [[ ! "${DICEBOT_SHARDS}" =~ ^[0-9]+$ || "${DICEBOT_SHARDS}" -lt 3 ]]; then
            echo "DICEBOT_SHARDS must be an integer greater than or equal to 3" >&2
            exit 1
          fi
          DICEBOT_COMMAND_PARALLELISM="${DICEBOT_COMMAND_PARALLELISM:-4}"
          DICEBOT_COMMAND_QUEUE_CAPACITY="${DICEBOT_COMMAND_QUEUE_CAPACITY:-256}"
          DICEBOT_APP_SERVER_BASE_URL="${DICEBOT_APP_SERVER_BASE_URL:-http://127.0.0.1:${DICEBOT_APP_SERVER_PORT}}"
          DICEBOT_ENVIRONMENT="${DICEBOT_ENVIRONMENT:-${DEPLOY_ENVIRONMENT}}"
          if [[ "${DICEBOT_ENVIRONMENT}" != "${DEPLOY_ENVIRONMENT}" ]]; then
            echo "DICEBOT_ENVIRONMENT must match the selected GitHub Environment (${DEPLOY_ENVIRONMENT})" >&2
            exit 1
          fi
          DICEBOT_APP_READY_URL="${DICEBOT_APP_READY_URL:-${DICEBOT_APP_SERVER_BASE_URL%/}/internal/v1/health/ready}"
          DICEBOT_HEALTH_PUBLISH_ENABLED="${DICEBOT_HEALTH_PUBLISH_ENABLED:-}"
          DICEBOT_HEALTH_PUBLISH_INTERVAL_SECONDS="${DICEBOT_HEALTH_PUBLISH_INTERVAL_SECONDS:-60}"
          DICEBOT_HEALTH_PUBLISH_TIMEOUT_SECONDS="${DICEBOT_HEALTH_PUBLISH_TIMEOUT_SECONDS:-2}"
          DICEBOT_HEALTH_EVENT_TYPE="${DICEBOT_HEALTH_EVENT_TYPE:-DicebotHealthCheck}"
          DICEBOT_NEW_RELIC_ENABLED="${DICEBOT_NEW_RELIC_ENABLED:-false}"
          DICEBOT_APP_NEW_RELIC_ENABLED="${DICEBOT_APP_NEW_RELIC_ENABLED:-${DICEBOT_NEW_RELIC_ENABLED}}"
          DICEBOT_GATEWAY_NEW_RELIC_ENABLED="${DICEBOT_GATEWAY_NEW_RELIC_ENABLED:-${DICEBOT_NEW_RELIC_ENABLED}}"
          DICEBOT_ANY_NEW_RELIC_ENABLED="false"
          if [[ "${DICEBOT_APP_NEW_RELIC_ENABLED}" == "true" || "${DICEBOT_GATEWAY_NEW_RELIC_ENABLED}" == "true" ]]; then
            DICEBOT_ANY_NEW_RELIC_ENABLED="true"
          fi
          DICEBOT_HEALTH_PUBLISH_ENABLED="${DICEBOT_HEALTH_PUBLISH_ENABLED:-${DICEBOT_GATEWAY_NEW_RELIC_ENABLED}}"
          DICEBOT_NEW_RELIC_INSTALL_ENABLED="${DICEBOT_NEW_RELIC_INSTALL_ENABLED:-true}"
          DICEBOT_NEW_RELIC_AGENT_PATH="${DICEBOT_NEW_RELIC_AGENT_PATH:-/opt/newrelic/newrelic.jar}"
          DICEBOT_NEW_RELIC_DOWNLOAD_URL="${DICEBOT_NEW_RELIC_DOWNLOAD_URL:-https://download.newrelic.com/newrelic/java-agent/newrelic-agent/current/newrelic-java.zip}"
          DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED="${DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED:-false}"
          DICEBOT_NEW_RELIC_AGENT_DIR="$(dirname -- "${DICEBOT_NEW_RELIC_AGENT_PATH}")"
          DICEBOT_NEW_RELIC_LOG_FILE_PATH="${DICEBOT_NEW_RELIC_LOG_FILE_PATH:-${DICEBOT_NEW_RELIC_AGENT_DIR}/logs}"
          DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME="${DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME:-newrelic_app_server_agent.log}"
          DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME="${DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME:-newrelic_gateway_agent.log}"

          require_non_default() {
            local key="$1"
            local value="$2"
            local default_value="$3"
            if [[ -z "${value}" || "${value}" == "${default_value}" ]]; then
              echo "${key} must be set to a non-production value for ${DEPLOY_ENVIRONMENT}" >&2
              exit 1
            fi
          }

          if [[ "${DEPLOY_ENVIRONMENT}" != "production" ]]; then
            require_non_default DEPLOY_PATH "${deploy_path}" "/opt/dicebot/deploy"
            require_non_default DICEBOT_CONFIG_DIR "${DICEBOT_CONFIG_DIR}" "/etc/dicebot"
            require_non_default DICEBOT_APP_SERVICE_NAME "${DICEBOT_APP_SERVICE_NAME}" "dicebot-app.service"
            require_non_default DICEBOT_APP_RELEASES_DIR "${DICEBOT_APP_RELEASES_DIR}" "/opt/dicebot/app-server/releases"
            require_non_default DICEBOT_APP_CURRENT_LINK "${DICEBOT_APP_CURRENT_LINK}" "/opt/dicebot/app-server/current"
            require_non_default DICEBOT_GATEWAY_SERVICE_NAME "${DICEBOT_GATEWAY_SERVICE_NAME}" "dicebot-gateway.service"
            require_non_default DICEBOT_GATEWAY_RELEASES_DIR "${DICEBOT_GATEWAY_RELEASES_DIR}" "/opt/dicebot/gateway/releases"
            require_non_default DICEBOT_GATEWAY_CURRENT_LINK "${DICEBOT_GATEWAY_CURRENT_LINK}" "/opt/dicebot/gateway/current"
            require_non_default DICEBOT_APP_WORK_DIR "${DICEBOT_APP_WORK_DIR}" "/var/lib/dicebot/app-server"
            require_non_default DICEBOT_GATEWAY_WORK_DIR "${DICEBOT_GATEWAY_WORK_DIR}" "/var/lib/dicebot/gateway"
            require_non_default DICEBOT_APP_SERVER_PORT "${DICEBOT_APP_SERVER_PORT}" "8080"
            require_non_default DICEBOT_SQLITE_PATH "${DICEBOT_SQLITE_PATH}" "/var/lib/dicebot/app-server/dicebot.db"
            require_non_default DICEBOT_SQLITE_BACKUP_DIR "${DICEBOT_SQLITE_BACKUP_DIR}" "/var/lib/dicebot/app-server/backups"
            require_non_default DICEBOT_DISCORD_BOT_ID "${DICEBOT_DISCORD_BOT_ID}" ""
          fi

          validate_discord_token_identity() {
            if [[ -z "${DICEBOT_DISCORD_BOT_ID}" ]]; then
              return 0
            fi
            if [[ ! "${DICEBOT_DISCORD_BOT_ID}" =~ ^[0-9]+$ ]]; then
              echo "DICEBOT_DISCORD_BOT_ID must be a numeric Discord bot user id" >&2
              exit 1
            fi
            for command_name in curl python3; do
              if ! command -v "${command_name}" >/dev/null 2>&1; then
                echo "${command_name} is required to validate DICEBOT_TOKEN identity" >&2
                exit 1
              fi
            done

            local response actual_bot_id
            response="$(curl -fsS --retry 3 --connect-timeout 10 --max-time 15 \
              -H "Authorization: Bot ${DICEBOT_TOKEN}" \
              https://discord.com/api/v10/users/@me)"
            actual_bot_id="$(DISCORD_ME_JSON="${response}" python3 - <<'PY'
          import json
          import os

          print(json.loads(os.environ["DISCORD_ME_JSON"]).get("id", ""))
          PY
            )"
            if [[ -z "${actual_bot_id}" || "${actual_bot_id}" != "${DICEBOT_DISCORD_BOT_ID}" ]]; then
              echo "DICEBOT_TOKEN does not match DICEBOT_DISCORD_BOT_ID" >&2
              exit 1
            fi
          }
          validate_discord_token_identity

          require_boolean() {
            local key="$1"
            local value="$2"
            case "${value}" in
              true|false) ;;
              *)
                echo "${key} must be true or false" >&2
                exit 1
                ;;
            esac
          }
          require_boolean DICEBOT_HEALTH_PUBLISH_ENABLED "${DICEBOT_HEALTH_PUBLISH_ENABLED}"
          require_boolean DICEBOT_NEW_RELIC_ENABLED "${DICEBOT_NEW_RELIC_ENABLED}"
          require_boolean DICEBOT_APP_NEW_RELIC_ENABLED "${DICEBOT_APP_NEW_RELIC_ENABLED}"
          require_boolean DICEBOT_GATEWAY_NEW_RELIC_ENABLED "${DICEBOT_GATEWAY_NEW_RELIC_ENABLED}"
          require_boolean DICEBOT_NEW_RELIC_INSTALL_ENABLED "${DICEBOT_NEW_RELIC_INSTALL_ENABLED}"
          require_boolean DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED "${DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED}"
          require_boolean DICEBOT_SYSTEMD_ENABLE_SERVICES "${DICEBOT_SYSTEMD_ENABLE_SERVICES}"

          require_positive_int_if_set() {
            local key="$1"
            local value="$2"
            if [[ -n "${value}" && (! "${value}" =~ ^[0-9]+$ || "${value}" -le 0) ]]; then
              echo "${key} must be a positive integer" >&2
              exit 1
            fi
          }
          require_positive_int_if_set DICEBOT_HEALTH_ATTEMPTS "${DICEBOT_HEALTH_ATTEMPTS}"
          require_positive_int_if_set DICEBOT_HEALTH_DELAY_SECONDS "${DICEBOT_HEALTH_DELAY_SECONDS}"
          require_positive_int_if_set DICEBOT_HEALTH_TIMEOUT_SECONDS "${DICEBOT_HEALTH_TIMEOUT_SECONDS}"

          if [[ "${DICEBOT_ANY_NEW_RELIC_ENABLED}" == "true" ]]; then
            test -n "${DICEBOT_NEW_RELIC_LICENSE_KEY}" || { echo "DICEBOT_NEW_RELIC_LICENSE_KEY secret is required when New Relic is enabled" >&2; exit 1; }
            test -n "${DICEBOT_NEW_RELIC_AGENT_PATH}" || { echo "DICEBOT_NEW_RELIC_AGENT_PATH must not be empty when New Relic is enabled" >&2; exit 1; }
            test -n "${DICEBOT_NEW_RELIC_DOWNLOAD_URL}" || { echo "DICEBOT_NEW_RELIC_DOWNLOAD_URL must not be empty when New Relic is enabled" >&2; exit 1; }
          fi
          if [[ "${DICEBOT_APP_NEW_RELIC_ENABLED}" == "true" ]]; then
            DICEBOT_APP_NEW_RELIC_APP_NAME="${DICEBOT_APP_NEW_RELIC_APP_NAME:-dicebot-app-${DICEBOT_ENVIRONMENT}}"
            DICEBOT_APP_NEW_RELIC_LABELS="${DICEBOT_APP_NEW_RELIC_LABELS:-environment:${DICEBOT_ENVIRONMENT};service:dicebot;component:app-server}"
            DICEBOT_APP_JAVA_TOOL_OPTIONS="-javaagent:${DICEBOT_NEW_RELIC_AGENT_PATH}${DICEBOT_APP_JAVA_TOOL_OPTIONS:+ ${DICEBOT_APP_JAVA_TOOL_OPTIONS}}"
          fi
          if [[ "${DICEBOT_GATEWAY_NEW_RELIC_ENABLED}" == "true" ]]; then
            DICEBOT_GATEWAY_NEW_RELIC_APP_NAME="${DICEBOT_GATEWAY_NEW_RELIC_APP_NAME:-dicebot-gateway-${DICEBOT_ENVIRONMENT}}"
            DICEBOT_GATEWAY_NEW_RELIC_LABELS="${DICEBOT_GATEWAY_NEW_RELIC_LABELS:-environment:${DICEBOT_ENVIRONMENT};service:dicebot;component:gateway}"
            DICEBOT_GATEWAY_JAVA_TOOL_OPTIONS="-javaagent:${DICEBOT_NEW_RELIC_AGENT_PATH}${DICEBOT_GATEWAY_JAVA_TOOL_OPTIONS:+ ${DICEBOT_GATEWAY_JAVA_TOOL_OPTIONS}}"
          fi

          tmp_dir="$(mktemp -d)"
          cleanup() {
            rm -rf "${tmp_dir}"
          }
          trap cleanup EXIT
          umask 077

          cat > "${tmp_dir}/deploy.env" <<EOF
          DICEBOT_RELEASE_REPO=${DICEBOT_RELEASE_REPO}
          DICEBOT_RELEASE_RETENTION=${DICEBOT_RELEASE_RETENTION}
          EOF
          write_optional_deploy_env() {
            local key="$1"
            local value="$2"
            if [[ -n "${value}" ]]; then
              printf '%s=%s\n' "${key}" "${value}" >> "${tmp_dir}/deploy.env"
            fi
          }
          write_optional_deploy_env DICEBOT_APP_SERVICE_NAME "${DICEBOT_APP_SERVICE_NAME}"
          write_optional_deploy_env DICEBOT_APP_RELEASES_DIR "${DICEBOT_APP_RELEASES_DIR}"
          write_optional_deploy_env DICEBOT_APP_CURRENT_LINK "${DICEBOT_APP_CURRENT_LINK}"
          write_optional_deploy_env DICEBOT_GATEWAY_SERVICE_NAME "${DICEBOT_GATEWAY_SERVICE_NAME}"
          write_optional_deploy_env DICEBOT_GATEWAY_RELEASES_DIR "${DICEBOT_GATEWAY_RELEASES_DIR}"
          write_optional_deploy_env DICEBOT_GATEWAY_CURRENT_LINK "${DICEBOT_GATEWAY_CURRENT_LINK}"
          write_optional_deploy_env DICEBOT_SYSTEMD_ENABLE_SERVICES "${DICEBOT_SYSTEMD_ENABLE_SERVICES}"
          write_optional_deploy_env DICEBOT_APP_WORK_DIR "${DICEBOT_APP_WORK_DIR}"
          write_optional_deploy_env DICEBOT_GATEWAY_WORK_DIR "${DICEBOT_GATEWAY_WORK_DIR}"
          write_optional_deploy_env DICEBOT_HEALTH_ATTEMPTS "${DICEBOT_HEALTH_ATTEMPTS}"
          write_optional_deploy_env DICEBOT_HEALTH_DELAY_SECONDS "${DICEBOT_HEALTH_DELAY_SECONDS}"
          write_optional_deploy_env DICEBOT_HEALTH_TIMEOUT_SECONDS "${DICEBOT_HEALTH_TIMEOUT_SECONDS}"

          write_optional_runtime_env() {
            local path="$1"
            local key="$2"
            local value="$3"
            if [[ -n "${value}" ]]; then
              printf '%s=%q\n' "${key}" "${value}" >> "${path}"
            fi
          }

          cat > "${tmp_dir}/app.env" <<EOF
          DICEBOT_APP_SERVER_PORT=${DICEBOT_APP_SERVER_PORT}
          DICEBOT_GOOGLE_CREDENTIALS=${DICEBOT_GOOGLE_CREDENTIALS}
          DICEBOT_SQLITE_PATH=${DICEBOT_SQLITE_PATH}
          DICEBOT_SQLITE_BACKUP_ENABLED=${DICEBOT_SQLITE_BACKUP_ENABLED}
          DICEBOT_SQLITE_BACKUP_DIR=${DICEBOT_SQLITE_BACKUP_DIR}
          DICEBOT_SQLITE_BACKUP_RETENTION=${DICEBOT_SQLITE_BACKUP_RETENTION}
          DICEBOT_COMMAND_TEXT_LOCALE=${DICEBOT_COMMAND_TEXT_LOCALE}
          DICEBOT_SHEET_HOT_CACHE_SIZE=${DICEBOT_SHEET_HOT_CACHE_SIZE}
          DICEBOT_ENVIRONMENT=${DICEBOT_ENVIRONMENT}
          EOF
          write_optional_runtime_env "${tmp_dir}/app.env" DICEBOT_LOG_RAW_OPTIONS "${DICEBOT_LOG_RAW_OPTIONS}"
          write_optional_runtime_env "${tmp_dir}/app.env" JAVA_TOOL_OPTIONS "${DICEBOT_APP_JAVA_TOOL_OPTIONS}"
          if [[ "${DICEBOT_APP_NEW_RELIC_ENABLED}" == "true" ]]; then
            write_optional_runtime_env "${tmp_dir}/app.env" NEW_RELIC_LICENSE_KEY "${DICEBOT_NEW_RELIC_LICENSE_KEY}"
            write_optional_runtime_env "${tmp_dir}/app.env" NEW_RELIC_APP_NAME "${DICEBOT_APP_NEW_RELIC_APP_NAME}"
            write_optional_runtime_env "${tmp_dir}/app.env" NEW_RELIC_LABELS "${DICEBOT_APP_NEW_RELIC_LABELS}"
            write_optional_runtime_env "${tmp_dir}/app.env" NEW_RELIC_LOG_FILE_PATH "${DICEBOT_NEW_RELIC_LOG_FILE_PATH}"
            write_optional_runtime_env "${tmp_dir}/app.env" NEW_RELIC_LOG_FILE_NAME "${DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME}"
            write_optional_runtime_env "${tmp_dir}/app.env" NEW_RELIC_APPLICATION_LOGGING_ENABLED "${DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED}"
            write_optional_runtime_env "${tmp_dir}/app.env" NEW_RELIC_APPLICATION_LOGGING_FORWARDING_ENABLED "${DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED}"
            write_optional_runtime_env "${tmp_dir}/app.env" NEW_RELIC_APPLICATION_LOGGING_LOCAL_DECORATING_ENABLED false
          fi

          cat > "${tmp_dir}/gateway.env" <<EOF
          DICEBOT_TOKEN=${DICEBOT_TOKEN}
          DICEBOT_SHARDS=${DICEBOT_SHARDS}
          DICEBOT_COMMAND_PARALLELISM=${DICEBOT_COMMAND_PARALLELISM}
          DICEBOT_COMMAND_QUEUE_CAPACITY=${DICEBOT_COMMAND_QUEUE_CAPACITY}
          DICEBOT_APP_SERVER_BASE_URL=${DICEBOT_APP_SERVER_BASE_URL}
          DICEBOT_ENVIRONMENT=${DICEBOT_ENVIRONMENT}
          DICEBOT_APP_READY_URL=${DICEBOT_APP_READY_URL}
          DICEBOT_HEALTH_PUBLISH_ENABLED=${DICEBOT_HEALTH_PUBLISH_ENABLED}
          DICEBOT_HEALTH_PUBLISH_INTERVAL_SECONDS=${DICEBOT_HEALTH_PUBLISH_INTERVAL_SECONDS}
          DICEBOT_HEALTH_PUBLISH_TIMEOUT_SECONDS=${DICEBOT_HEALTH_PUBLISH_TIMEOUT_SECONDS}
          DICEBOT_HEALTH_EVENT_TYPE=${DICEBOT_HEALTH_EVENT_TYPE}
          EOF
          write_optional_runtime_env "${tmp_dir}/gateway.env" DICEBOT_LOG_RAW_OPTIONS "${DICEBOT_LOG_RAW_OPTIONS}"
          write_optional_runtime_env "${tmp_dir}/gateway.env" JAVA_TOOL_OPTIONS "${DICEBOT_GATEWAY_JAVA_TOOL_OPTIONS}"
          if [[ "${DICEBOT_GATEWAY_NEW_RELIC_ENABLED}" == "true" ]]; then
            write_optional_runtime_env "${tmp_dir}/gateway.env" NEW_RELIC_LICENSE_KEY "${DICEBOT_NEW_RELIC_LICENSE_KEY}"
            write_optional_runtime_env "${tmp_dir}/gateway.env" NEW_RELIC_APP_NAME "${DICEBOT_GATEWAY_NEW_RELIC_APP_NAME}"
            write_optional_runtime_env "${tmp_dir}/gateway.env" NEW_RELIC_LABELS "${DICEBOT_GATEWAY_NEW_RELIC_LABELS}"
            write_optional_runtime_env "${tmp_dir}/gateway.env" NEW_RELIC_LOG_FILE_PATH "${DICEBOT_NEW_RELIC_LOG_FILE_PATH}"
            write_optional_runtime_env "${tmp_dir}/gateway.env" NEW_RELIC_LOG_FILE_NAME "${DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME}"
            write_optional_runtime_env "${tmp_dir}/gateway.env" NEW_RELIC_APPLICATION_LOGGING_ENABLED "${DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED}"
            write_optional_runtime_env "${tmp_dir}/gateway.env" NEW_RELIC_APPLICATION_LOGGING_FORWARDING_ENABLED "${DICEBOT_NEW_RELIC_LOG_FORWARDING_ENABLED}"
            write_optional_runtime_env "${tmp_dir}/gateway.env" NEW_RELIC_APPLICATION_LOGGING_LOCAL_DECORATING_ENABLED false
          fi

          printf '%s' "${DICEBOT_GOOGLE_CREDENTIALS_BASE64}" | base64 -d > "${tmp_dir}/google-service-account.json"
          test -s "${tmp_dir}/google-service-account.json" || { echo "Decoded Google credentials file is empty" >&2; exit 1; }

          ssh_base=(
            ssh
            -i ~/.ssh/dicebot_deploy_key
            -p "${deploy_port}"
            -o IdentitiesOnly=yes
            -o StrictHostKeyChecking=yes
            "${DEPLOY_USER}@${DEPLOY_HOST}"
          )
          scp_base=(
            scp
            -i ~/.ssh/dicebot_deploy_key
            -P "${deploy_port}"
            -o IdentitiesOnly=yes
            -o StrictHostKeyChecking=yes
          )

          remote_tmp="$("${ssh_base[@]}" 'mktemp -d "${TMPDIR:-/tmp}/dicebot-config.XXXXXXXXXX"')"
          "${scp_base[@]}" \
            "${tmp_dir}/deploy.env" \
            "${tmp_dir}/app.env" \
            "${tmp_dir}/gateway.env" \
            "${tmp_dir}/google-service-account.json" \
            "${DEPLOY_USER}@${DEPLOY_HOST}:${remote_tmp}/"

          quote() {
            printf '%q' "$1"
          }

          "${ssh_base[@]}" "REMOTE_CONFIG_TMP=$(quote "${remote_tmp}") DICEBOT_CONFIG_DIR=$(quote "${DICEBOT_CONFIG_DIR}") DICEBOT_DEPLOY_PATH=$(quote "${deploy_path}") DICEBOT_DEPLOY_REF=$(quote "${DEPLOY_REF}") DICEBOT_GITHUB_REPOSITORY=$(quote "${DICEBOT_RELEASE_REPO}") GH_TOKEN=$(quote "${GH_TOKEN}") DICEBOT_SYSTEMD_ENABLE_SERVICES=$(quote "${DICEBOT_SYSTEMD_ENABLE_SERVICES}") DICEBOT_NEW_RELIC_ENABLED=$(quote "${DICEBOT_ANY_NEW_RELIC_ENABLED}") DICEBOT_APP_NEW_RELIC_ENABLED=$(quote "${DICEBOT_APP_NEW_RELIC_ENABLED}") DICEBOT_GATEWAY_NEW_RELIC_ENABLED=$(quote "${DICEBOT_GATEWAY_NEW_RELIC_ENABLED}") DICEBOT_NEW_RELIC_INSTALL_ENABLED=$(quote "${DICEBOT_NEW_RELIC_INSTALL_ENABLED}") DICEBOT_NEW_RELIC_AGENT_PATH=$(quote "${DICEBOT_NEW_RELIC_AGENT_PATH}") DICEBOT_NEW_RELIC_DOWNLOAD_URL=$(quote "${DICEBOT_NEW_RELIC_DOWNLOAD_URL}") DICEBOT_NEW_RELIC_LOG_FILE_PATH=$(quote "${DICEBOT_NEW_RELIC_LOG_FILE_PATH}") DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME=$(quote "${DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME}") DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME=$(quote "${DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME}") bash -s" <<'REMOTE'
          set -euo pipefail

          sudo install -d -m 0755 -o root -g root "${DICEBOT_CONFIG_DIR}"
          sudo install -m 0600 -o "$(id -un)" -g "$(id -gn)" "${REMOTE_CONFIG_TMP}/deploy.env" "${DICEBOT_CONFIG_DIR}/deploy.env"
          sudo install -m 0640 -o root -g dicebot "${REMOTE_CONFIG_TMP}/app.env" "${DICEBOT_CONFIG_DIR}/app.env"
          sudo install -m 0640 -o root -g dicebot "${REMOTE_CONFIG_TMP}/gateway.env" "${DICEBOT_CONFIG_DIR}/gateway.env"
          sudo install -m 0640 -o root -g dicebot "${REMOTE_CONFIG_TMP}/google-service-account.json" "${DICEBOT_CONFIG_DIR}/google-service-account.json"
          rm -rf "${REMOTE_CONFIG_TMP}"

          set -a
          # shellcheck disable=SC1091
          source "${DICEBOT_CONFIG_DIR}/deploy.env"
          # shellcheck disable=SC1091
          source "${DICEBOT_CONFIG_DIR}/app.env"
          # shellcheck disable=SC1091
          source "${DICEBOT_CONFIG_DIR}/gateway.env"
          set +a

          app_service_name="${DICEBOT_APP_SERVICE_NAME:-dicebot-app.service}"
          gateway_service_name="${DICEBOT_GATEWAY_SERVICE_NAME:-dicebot-gateway.service}"
          app_current_link="${DICEBOT_APP_CURRENT_LINK:-/opt/dicebot/app-server/current}"
          gateway_current_link="${DICEBOT_GATEWAY_CURRENT_LINK:-/opt/dicebot/gateway/current}"
          app_work_dir="${DICEBOT_APP_WORK_DIR:-$(dirname -- "${DICEBOT_SQLITE_PATH:-/var/lib/dicebot/app-server/dicebot.db}")}"
          gateway_work_dir="${DICEBOT_GATEWAY_WORK_DIR:-/var/lib/dicebot/gateway}"

          case "${app_service_name}" in
            ""|*/*) echo "Invalid app service name: ${app_service_name}" >&2; exit 1 ;;
          esac
          case "${gateway_service_name}" in
            ""|*/*) echo "Invalid gateway service name: ${gateway_service_name}" >&2; exit 1 ;;
          esac

          for command_name in git systemctl; do
            if ! command -v "${command_name}" >/dev/null 2>&1; then
              echo "${command_name} is required to provision deployment runtime" >&2
              exit 1
            fi
          done

          git_with_auth=(git)
          if [[ -n "${GH_TOKEN}" ]]; then
            git_auth_header="$(printf 'x-access-token:%s' "${GH_TOKEN}" | base64 | tr -d '\n')"
            git_with_auth=(git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${git_auth_header}")
          fi

          sudo install -d -m 0755 -o "$(id -un)" -g "$(id -gn)" "$(dirname -- "${DICEBOT_DEPLOY_PATH}")"
          if [[ ! -d "${DICEBOT_DEPLOY_PATH}/.git" ]]; then
            if [[ -e "${DICEBOT_DEPLOY_PATH}" ]]; then
              echo "Deploy path exists but is not a git checkout: ${DICEBOT_DEPLOY_PATH}" >&2
              exit 1
            fi
            test -n "${GH_TOKEN}" || { echo "GH_TOKEN is required to bootstrap deploy checkout" >&2; exit 1; }
            "${git_with_auth[@]}" clone "https://github.com/${DICEBOT_GITHUB_REPOSITORY}.git" "${DICEBOT_DEPLOY_PATH}"
          fi

          git -C "${DICEBOT_DEPLOY_PATH}" remote set-url origin "https://github.com/${DICEBOT_GITHUB_REPOSITORY}.git"
          "${git_with_auth[@]}" -C "${DICEBOT_DEPLOY_PATH}" fetch --all --tags --prune
          if git -C "${DICEBOT_DEPLOY_PATH}" show-ref --verify --quiet "refs/remotes/origin/${DICEBOT_DEPLOY_REF}"; then
            git -C "${DICEBOT_DEPLOY_PATH}" checkout --force "refs/remotes/origin/${DICEBOT_DEPLOY_REF}"
          else
            git -C "${DICEBOT_DEPLOY_PATH}" checkout --force "${DICEBOT_DEPLOY_REF}"
          fi

          sudo install -d -m 0755 -o dicebot -g dicebot "${app_work_dir}" "${gateway_work_dir}"
          sudo install -d -m 0770 -o dicebot -g dicebot "$(dirname -- "${DICEBOT_SQLITE_PATH}")" "${DICEBOT_SQLITE_BACKUP_DIR}"

          unit_tmp="$(mktemp -d "${TMPDIR:-/tmp}/dicebot-systemd.XXXXXXXXXX")"
          cleanup_unit_tmp() {
            rm -rf "${unit_tmp}"
          }
          trap cleanup_unit_tmp EXIT

          cat > "${unit_tmp}/${app_service_name}" <<UNIT
          [Unit]
          Description=Discord Dicebot App Server (${DICEBOT_ENVIRONMENT})
          After=network-online.target
          Wants=network-online.target
          StartLimitIntervalSec=60
          StartLimitBurst=5

          [Service]
          Type=simple
          User=dicebot
          Group=dicebot
          WorkingDirectory=${app_work_dir}
          EnvironmentFile=${DICEBOT_CONFIG_DIR}/app.env
          ExecStart=/usr/bin/java -jar ${app_current_link}/app-server.jar
          Restart=on-failure
          RestartSec=5
          TimeoutStopSec=30
          SuccessExitStatus=143
          StandardOutput=journal
          StandardError=journal

          [Install]
          WantedBy=multi-user.target
          UNIT

          cat > "${unit_tmp}/${gateway_service_name}" <<UNIT
          [Unit]
          Description=Discord Dicebot Gateway (${DICEBOT_ENVIRONMENT})
          After=network-online.target
          Wants=network-online.target ${app_service_name}
          StartLimitIntervalSec=60
          StartLimitBurst=5

          [Service]
          Type=simple
          User=dicebot
          Group=dicebot
          WorkingDirectory=${gateway_work_dir}
          EnvironmentFile=${DICEBOT_CONFIG_DIR}/gateway.env
          ExecStart=/usr/bin/java -jar ${gateway_current_link}/gateway.jar
          Restart=on-failure
          RestartSec=5
          TimeoutStopSec=30
          SuccessExitStatus=143
          StandardOutput=journal
          StandardError=journal

          [Install]
          WantedBy=multi-user.target
          UNIT

          sudo install -m 0644 -o root -g root "${unit_tmp}/${app_service_name}" "/etc/systemd/system/${app_service_name}"
          sudo install -m 0644 -o root -g root "${unit_tmp}/${gateway_service_name}" "/etc/systemd/system/${gateway_service_name}"
          sudo systemctl daemon-reload
          if [[ "${DICEBOT_SYSTEMD_ENABLE_SERVICES}" == "true" ]]; then
            sudo systemctl enable "${app_service_name}" "${gateway_service_name}"
          else
            sudo systemctl disable "${app_service_name}" "${gateway_service_name}" >/dev/null || true
          fi
          rm -rf "${unit_tmp}"
          trap - EXIT

          if [[ "${DICEBOT_NEW_RELIC_ENABLED}" == "true" ]]; then
            if [[ "${DICEBOT_NEW_RELIC_INSTALL_ENABLED}" == "true" ]]; then
              for command_name in curl unzip java; do
                if ! command -v "${command_name}" >/dev/null 2>&1; then
                  echo "${command_name} is required to install the New Relic Java agent" >&2
                  exit 1
                fi
              done

              agent_dir="$(dirname -- "${DICEBOT_NEW_RELIC_AGENT_PATH}")"
              sudo install -d -m 0755 -o root -g root "${agent_dir}"
              if [[ ! -f "${DICEBOT_NEW_RELIC_AGENT_PATH}" || ! -f "${agent_dir}/newrelic.yml" ]]; then
                newrelic_tmp="$(mktemp -d "${TMPDIR:-/tmp}/dicebot-newrelic.XXXXXXXXXX")"
                cleanup_newrelic() {
                  rm -rf "${newrelic_tmp}"
                }
                trap cleanup_newrelic EXIT

                curl -fsSL --retry 3 --connect-timeout 10 "${DICEBOT_NEW_RELIC_DOWNLOAD_URL}" -o "${newrelic_tmp}/newrelic-java.zip"
                unzip -q "${newrelic_tmp}/newrelic-java.zip" -d "${newrelic_tmp}"
                test -f "${newrelic_tmp}/newrelic/newrelic.jar" || { echo "Downloaded New Relic archive did not contain newrelic.jar" >&2; exit 1; }
                if [[ ! -f "${DICEBOT_NEW_RELIC_AGENT_PATH}" ]]; then
                  sudo install -m 0644 -o root -g root "${newrelic_tmp}/newrelic/newrelic.jar" "${DICEBOT_NEW_RELIC_AGENT_PATH}"
                fi
                if [[ -f "${newrelic_tmp}/newrelic/newrelic.yml" && ! -f "${agent_dir}/newrelic.yml" ]]; then
                  sudo install -m 0644 -o root -g root "${newrelic_tmp}/newrelic/newrelic.yml" "${agent_dir}/newrelic.yml"
                fi
                rm -rf "${newrelic_tmp}"
                trap - EXIT
              fi

              sudo install -d -m 0775 -o dicebot -g dicebot "${DICEBOT_NEW_RELIC_LOG_FILE_PATH}"
              prepare_newrelic_log_file() {
                local enabled="$1"
                local log_file_name="$2"
                if [[ "${enabled}" != "true" || -z "${log_file_name}" ]]; then
                  return 0
                fi
                case "${log_file_name}" in
                  */*|.*)
                    echo "Invalid New Relic log file name: ${log_file_name}" >&2
                    exit 1
                    ;;
                esac
                local log_file="${DICEBOT_NEW_RELIC_LOG_FILE_PATH%/}/${log_file_name}"
                if [[ ! -e "${log_file}" ]]; then
                  sudo install -m 0664 -o dicebot -g dicebot /dev/null "${log_file}"
                fi
                sudo chown dicebot:dicebot "${log_file}"
                sudo chmod 0664 "${log_file}"
              }
              prepare_newrelic_log_file "${DICEBOT_APP_NEW_RELIC_ENABLED}" "${DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME}"
              prepare_newrelic_log_file "${DICEBOT_GATEWAY_NEW_RELIC_ENABLED}" "${DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME}"
            fi

            test -r "${DICEBOT_NEW_RELIC_AGENT_PATH}" || { echo "New Relic Java agent is not readable: ${DICEBOT_NEW_RELIC_AGENT_PATH}" >&2; exit 1; }
            env -u JAVA_TOOL_OPTIONS -u _JAVA_OPTIONS -u JDK_JAVA_OPTIONS java -jar "${DICEBOT_NEW_RELIC_AGENT_PATH}" -v >/dev/null
          fi
          REMOTE

      - name: Run remote deployment
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_ENVIRONMENT: ${{ inputs.environment }}
          DICEBOT_CONFIG_DIR: ${{ secrets.DICEBOT_CONFIG_DIR }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          COMPONENT: ${{ inputs.component }}
          DEPLOY_MODE: ${{ inputs.mode }}
          DEPLOY_REF: ${{ inputs.deploy_ref }}
          RELEASE_REPO: ${{ github.repository }}
          DICEBOT_HEALTH_ATTEMPTS: ${{ secrets.DICEBOT_HEALTH_ATTEMPTS }}
          DICEBOT_HEALTH_DELAY_SECONDS: ${{ secrets.DICEBOT_HEALTH_DELAY_SECONDS }}
          DICEBOT_HEALTH_TIMEOUT_SECONDS: ${{ secrets.DICEBOT_HEALTH_TIMEOUT_SECONDS }}
          DICEBOT_DISCORD_BOT_ID: ${{ secrets.DICEBOT_DISCORD_BOT_ID }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail

          deploy_port="${DEPLOY_PORT:-22}"
          deploy_path="${DEPLOY_PATH:-/opt/dicebot/deploy}"
          config_dir="${DICEBOT_CONFIG_DIR:-/etc/dicebot}"

          if [[ "${DEPLOY_ENVIRONMENT}" != "production" ]]; then
            test -n "${DEPLOY_PATH}" || { echo "DEPLOY_PATH secret is required for ${DEPLOY_ENVIRONMENT}" >&2; exit 1; }
            test -n "${DICEBOT_CONFIG_DIR}" || { echo "DICEBOT_CONFIG_DIR secret is required for ${DEPLOY_ENVIRONMENT}" >&2; exit 1; }
          fi

          quote() {
            printf '%q' "$1"
          }

          remote_env=(
            "DICEBOT_RELEASE_TAG=$(quote "${RELEASE_TAG}")"
            "DICEBOT_COMPONENT=$(quote "${COMPONENT}")"
            "DICEBOT_DEPLOY_MODE=$(quote "${DEPLOY_MODE}")"
            "DICEBOT_DEPLOY_REF=$(quote "${DEPLOY_REF}")"
            "DICEBOT_DEPLOY_PATH=$(quote "${deploy_path}")"
            "DICEBOT_CONFIG_DIR=$(quote "${config_dir}")"
            "DICEBOT_DEPLOY_ENVIRONMENT=$(quote "${DEPLOY_ENVIRONMENT}")"
            "DICEBOT_GITHUB_REPOSITORY=$(quote "${RELEASE_REPO}")"
            "DICEBOT_REQUESTED_HEALTH_ATTEMPTS=$(quote "${DICEBOT_HEALTH_ATTEMPTS}")"
            "DICEBOT_REQUESTED_HEALTH_DELAY_SECONDS=$(quote "${DICEBOT_HEALTH_DELAY_SECONDS}")"
            "DICEBOT_REQUESTED_HEALTH_TIMEOUT_SECONDS=$(quote "${DICEBOT_HEALTH_TIMEOUT_SECONDS}")"
            "DICEBOT_REQUESTED_DISCORD_BOT_ID=$(quote "${DICEBOT_DISCORD_BOT_ID}")"
          )

          {
            if [[ -n "${GH_TOKEN}" ]]; then
              printf 'export GH_TOKEN=%q\n' "${GH_TOKEN}"
            fi
            cat <<'REMOTE'
          set -euo pipefail

          requested_release_tag="${DICEBOT_RELEASE_TAG}"
          requested_component="${DICEBOT_COMPONENT}"
          requested_deploy_mode="${DICEBOT_DEPLOY_MODE}"
          requested_deploy_ref="${DICEBOT_DEPLOY_REF}"
          requested_deploy_path="${DICEBOT_DEPLOY_PATH}"
          requested_config_dir="${DICEBOT_CONFIG_DIR}"
          requested_deploy_environment="${DICEBOT_DEPLOY_ENVIRONMENT}"
          requested_gh_token="${GH_TOKEN:-}"
          requested_health_attempts="${DICEBOT_REQUESTED_HEALTH_ATTEMPTS:-}"
          requested_health_delay_seconds="${DICEBOT_REQUESTED_HEALTH_DELAY_SECONDS:-}"
          requested_health_timeout_seconds="${DICEBOT_REQUESTED_HEALTH_TIMEOUT_SECONDS:-}"
          requested_discord_bot_id="${DICEBOT_REQUESTED_DISCORD_BOT_ID:-}"

          cd "${DICEBOT_DEPLOY_PATH}"
          git_with_auth=(git)
          if [[ -n "${requested_gh_token}" ]]; then
            git_auth_header="$(printf 'x-access-token:%s' "${requested_gh_token}" | base64 | tr -d '\n')"
            git_with_auth=(git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${git_auth_header}")
          fi
          "${git_with_auth[@]}" fetch --all --tags --prune
          if git show-ref --verify --quiet "refs/remotes/origin/${DICEBOT_DEPLOY_REF}"; then
            git checkout --force "refs/remotes/origin/${DICEBOT_DEPLOY_REF}"
          else
            git checkout --force "${DICEBOT_DEPLOY_REF}"
          fi

          if [[ -f "${DICEBOT_CONFIG_DIR}/deploy.env" ]]; then
            set -a
            # shellcheck disable=SC1091
            source "${DICEBOT_CONFIG_DIR}/deploy.env"
            set +a
          fi

          if [[ -f "${DICEBOT_CONFIG_DIR}/app.env" ]]; then
            set -a
            # shellcheck disable=SC1091
            source "${DICEBOT_CONFIG_DIR}/app.env"
            set +a
          fi

          if [[ -f "${DICEBOT_CONFIG_DIR}/gateway.env" ]]; then
            set -a
            # shellcheck disable=SC1091
            source "${DICEBOT_CONFIG_DIR}/gateway.env"
            set +a
          fi

          require_non_default() {
            local key="$1"
            local value="$2"
            local default_value="$3"
            if [[ -z "${value}" || "${value}" == "${default_value}" ]]; then
              echo "${key} must be set to a non-production value for ${requested_deploy_environment}" >&2
              exit 1
            fi
          }

          if [[ "${requested_deploy_environment}" != "production" ]]; then
            require_non_default DICEBOT_CONFIG_DIR "${requested_config_dir}" "/etc/dicebot"
            require_non_default DICEBOT_ENVIRONMENT "${DICEBOT_ENVIRONMENT:-}" ""
            require_non_default DICEBOT_APP_SERVICE_NAME "${DICEBOT_APP_SERVICE_NAME:-}" "dicebot-app.service"
            require_non_default DICEBOT_APP_RELEASES_DIR "${DICEBOT_APP_RELEASES_DIR:-}" "/opt/dicebot/app-server/releases"
            require_non_default DICEBOT_APP_CURRENT_LINK "${DICEBOT_APP_CURRENT_LINK:-}" "/opt/dicebot/app-server/current"
            require_non_default DICEBOT_GATEWAY_SERVICE_NAME "${DICEBOT_GATEWAY_SERVICE_NAME:-}" "dicebot-gateway.service"
            require_non_default DICEBOT_GATEWAY_RELEASES_DIR "${DICEBOT_GATEWAY_RELEASES_DIR:-}" "/opt/dicebot/gateway/releases"
            require_non_default DICEBOT_GATEWAY_CURRENT_LINK "${DICEBOT_GATEWAY_CURRENT_LINK:-}" "/opt/dicebot/gateway/current"
            require_non_default DICEBOT_APP_SERVER_PORT "${DICEBOT_APP_SERVER_PORT:-}" "8080"
            require_non_default DICEBOT_SQLITE_PATH "${DICEBOT_SQLITE_PATH:-}" "/var/lib/dicebot/app-server/dicebot.db"
            require_non_default DICEBOT_SQLITE_BACKUP_DIR "${DICEBOT_SQLITE_BACKUP_DIR:-}" "/var/lib/dicebot/app-server/backups"
          fi

          if [[ -n "${DICEBOT_ENVIRONMENT:-}" && "${DICEBOT_ENVIRONMENT}" != "${requested_deploy_environment}" ]]; then
            echo "DICEBOT_ENVIRONMENT must match the selected GitHub Environment (${requested_deploy_environment})" >&2
            exit 1
          fi

          DICEBOT_RELEASE_TAG="${requested_release_tag}"
          DICEBOT_COMPONENT="${requested_component}"
          DICEBOT_DEPLOY_MODE="${requested_deploy_mode}"
          DICEBOT_DEPLOY_REF="${requested_deploy_ref}"
          DICEBOT_DEPLOY_PATH="${requested_deploy_path}"
          DICEBOT_CONFIG_DIR="${requested_config_dir}"
          if [[ -n "${requested_gh_token}" ]]; then
            export GH_TOKEN="${requested_gh_token}"
          fi
          if [[ -n "${requested_health_attempts}" ]]; then
            export DICEBOT_HEALTH_ATTEMPTS="${requested_health_attempts}"
          fi
          if [[ -n "${requested_health_delay_seconds}" ]]; then
            export DICEBOT_HEALTH_DELAY_SECONDS="${requested_health_delay_seconds}"
          fi
          if [[ -n "${requested_health_timeout_seconds}" ]]; then
            export DICEBOT_HEALTH_TIMEOUT_SECONDS="${requested_health_timeout_seconds}"
          fi

          export DICEBOT_RELEASE_REPO="${DICEBOT_RELEASE_REPO:-${DICEBOT_GITHUB_REPOSITORY}}"

          component_uses_gateway() {
            case "${DICEBOT_COMPONENT}" in
              gateway|all) return 0 ;;
              *) return 1 ;;
            esac
          }

          validate_discord_token_identity() {
            local expected_bot_id="$1"
            if [[ -z "${expected_bot_id}" ]]; then
              return 0
            fi
            if [[ ! "${expected_bot_id}" =~ ^[0-9]+$ ]]; then
              echo "DICEBOT_DISCORD_BOT_ID must be a numeric Discord bot user id" >&2
              exit 1
            fi
            test -n "${DICEBOT_TOKEN:-}" || { echo "DICEBOT_TOKEN is required to validate Discord bot identity" >&2; exit 1; }
            for command_name in curl python3; do
              if ! command -v "${command_name}" >/dev/null 2>&1; then
                echo "${command_name} is required to validate DICEBOT_TOKEN identity" >&2
                exit 1
              fi
            done

            local response actual_bot_id
            response="$(curl -fsS --retry 3 --connect-timeout 10 --max-time 15 \
              -H "Authorization: Bot ${DICEBOT_TOKEN}" \
              https://discord.com/api/v10/users/@me)"
            actual_bot_id="$(DISCORD_ME_JSON="${response}" python3 - <<'PY'
          import json
          import os

          print(json.loads(os.environ["DISCORD_ME_JSON"]).get("id", ""))
          PY
            )"
            if [[ -z "${actual_bot_id}" || "${actual_bot_id}" != "${expected_bot_id}" ]]; then
              echo "DICEBOT_TOKEN does not match DICEBOT_DISCORD_BOT_ID" >&2
              exit 1
            fi
          }

          if [[ "${DICEBOT_DEPLOY_MODE}" == "deploy" ]] && component_uses_gateway; then
            if [[ "${requested_deploy_environment}" != "production" && -z "${requested_discord_bot_id}" ]]; then
              echo "DICEBOT_DISCORD_BOT_ID secret is required for non-production gateway deploys" >&2
              exit 1
            fi
            validate_discord_token_identity "${requested_discord_bot_id}"
          fi

          sudo_if_available() {
            if [[ "$(id -u)" -eq 0 ]]; then
              "$@"
            elif command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null; then
              sudo -n "$@"
            else
              "$@"
            fi
          }

          show_http_probe() {
            local label="$1"
            local url="$2"
            echo "::group::${label}"
            if command -v curl >/dev/null 2>&1; then
              curl -sS --max-time 5 -w '\nHTTP_STATUS:%{http_code}\n' "${url}" || true
            else
              echo "curl is not installed"
            fi
            echo "::endgroup::"
          }

          show_recent_journal() {
            local service_name="$1"
            echo "::group::journal ${service_name}"
            sudo_if_available journalctl -u "${service_name}" -n 120 --no-pager -o short-iso 2>&1 || true
            echo "::endgroup::"
          }

          show_newrelic_log() {
            local component="$1"
            local file_name="$2"
            local log_path="${NEW_RELIC_LOG_FILE_PATH:-/opt/newrelic/logs}/${file_name}"
            echo "::group::newrelic ${component}"
            if sudo_if_available test -r "${log_path}"; then
              sudo_if_available tail -n 120 "${log_path}" 2>&1 || true
            else
              echo "New Relic log is not readable: ${log_path}"
            fi
            echo "::endgroup::"
          }

          show_component_status() {
            local component="$1"
            local service_name current_link app_base live_url ready_url newrelic_log_name
            case "${component}" in
              app-server)
                service_name="${DICEBOT_APP_SERVICE_NAME:-dicebot-app.service}"
                current_link="${DICEBOT_APP_CURRENT_LINK:-/opt/dicebot/app-server/current}"
                app_base="${DICEBOT_APP_SERVER_BASE_URL:-http://127.0.0.1:${DICEBOT_APP_SERVER_PORT:-8080}}"
                live_url="${app_base%/}/internal/v1/health/live"
                ready_url="${DICEBOT_APP_READY_URL:-${app_base%/}/internal/v1/health/ready}"
                newrelic_log_name="${DICEBOT_APP_NEW_RELIC_LOG_FILE_NAME:-newrelic_app_server_agent.log}"
                ;;
              gateway)
                service_name="${DICEBOT_GATEWAY_SERVICE_NAME:-dicebot-gateway.service}"
                current_link="${DICEBOT_GATEWAY_CURRENT_LINK:-/opt/dicebot/gateway/current}"
                live_url=""
                ready_url=""
                newrelic_log_name="${DICEBOT_GATEWAY_NEW_RELIC_LOG_FILE_NAME:-newrelic_gateway_agent.log}"
                ;;
              *)
                echo "Unsupported component: ${component}" >&2
                exit 1
                ;;
            esac

            echo "::group::${component} service"
            echo "Service: ${service_name}"
            systemctl is-enabled "${service_name}" 2>&1 || true
            systemctl is-active "${service_name}" 2>&1 || true
            systemctl --no-pager -l status "${service_name}" 2>&1 || true
            if [[ -n "${current_link}" ]]; then
              printf 'Current link: %s -> ' "${current_link}"
              readlink -f "${current_link}" 2>/dev/null || true
            fi
            if command -v ss >/dev/null 2>&1; then
              echo "Listening TCP sockets:"
              sudo_if_available ss -ltnp 2>&1 || true
            fi
            echo "::endgroup::"

            if [[ -n "${live_url}" ]]; then
              show_http_probe "${component} live" "${live_url}"
            fi
            if [[ -n "${ready_url}" ]]; then
              show_http_probe "${component} ready" "${ready_url}"
            fi
            show_recent_journal "${service_name}"
            show_newrelic_log "${component}" "${newrelic_log_name}"
          }

          deploy_component() {
            local component="$1"
            bash scripts/deploy.sh check "${DICEBOT_RELEASE_TAG}" "${component}"
            if [[ "${DICEBOT_DEPLOY_MODE}" == "deploy" ]]; then
              bash scripts/deploy.sh deploy "${DICEBOT_RELEASE_TAG}" "${component}"
            fi
          }

          if [[ "${DICEBOT_DEPLOY_MODE}" == "status" ]]; then
            case "${DICEBOT_COMPONENT}" in
              app-server|gateway)
                show_component_status "${DICEBOT_COMPONENT}"
                ;;
              all)
                show_component_status app-server
                show_component_status gateway
                ;;
              *)
                echo "Unsupported component: ${DICEBOT_COMPONENT}" >&2
                exit 1
                ;;
            esac
            exit 0
          fi

          case "${DICEBOT_COMPONENT}" in
            app-server|gateway)
              deploy_component "${DICEBOT_COMPONENT}"
              ;;
            all)
              deploy_component app-server
              deploy_component gateway
              ;;
            *)
              echo "Unsupported component: ${DICEBOT_COMPONENT}" >&2
              exit 1
              ;;
          esac
          REMOTE
          } | ssh \
            -i ~/.ssh/dicebot_deploy_key \
            -p "${deploy_port}" \
            -o IdentitiesOnly=yes \
            -o StrictHostKeyChecking=yes \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "${remote_env[*]} bash -s"