feat: only run all seeds on first startup

lib/mv/release.ex

@@ -6,8 +6,8 @@ defmodule Mv.Release do
   ## Tasks
 
   - `migrate/0` - Runs all pending Ecto migrations.
-  - `run_seeds/0` - Runs bootstrap seeds (fee types, custom fields, roles, settings).
-    In production, set `RUN_DEV_SEEDS=true` to also run dev seeds (members, groups, sample data).
+  - `bootstrap_seeds_applied?/0` - Returns whether bootstrap was already applied (admin user exists). Used to skip re-running seeds.
+  - `run_seeds/0` - If bootstrap already applied, skips; otherwise runs bootstrap seeds (fee types, custom fields, roles, settings). In production, set `RUN_DEV_SEEDS=true` to also run dev seeds (members, groups, sample data).
   - `seed_admin/0` - Ensures an admin user exists from ENV (ADMIN_EMAIL, ADMIN_PASSWORD
     or ADMIN_PASSWORD_FILE). Idempotent; can be run on every deployment or via shell
     to update the admin password without redeploying.
@@ -28,13 +28,35 @@ defmodule Mv.Release do
     end
   end
 
+  @doc """
+  Returns whether bootstrap seeds have already been applied (admin user exists).
+
+  We check for the admin user (from ADMIN_EMAIL or default), not the Admin role,
+  because migrations may create the Admin role for the system actor. Only seeds
+  create the admin (login) user. Used to skip re-running seeds on subsequent starts.
+  Call only when the application is already started.
+  """
+  def bootstrap_seeds_applied? do
+    admin_email = get_env("ADMIN_EMAIL", "admin@localhost")
+
+    case User
+         |> Ash.Query.filter(email == ^admin_email)
+         |> Ash.read_one(authorize?: false, domain: Mv.Accounts) do
+      {:ok, %User{}} -> true
+      _ -> false
+    end
+  rescue
+    _ -> false
+  end
+
   @doc """
   Runs seed scripts so the database has required bootstrap data (and optionally dev data).
 
-  - Always runs bootstrap seeds (fee types, custom fields, roles, system user, settings).
-  - If `RUN_DEV_SEEDS` env is set to `"true"`, also runs dev seeds (members, groups, sample data).
+  - Skips if bootstrap was already applied (Admin role exists); otherwise runs bootstrap seeds.
+  - If `RUN_DEV_SEEDS` env is set to `"true"`, also runs dev seeds (members, groups, sample data)
+    when bootstrap is run.
 
-  Uses paths from the application's priv dir so it works in releases (no Mix). Idempotent.
+  Uses paths from the application's priv dir so it works in releases (no Mix).
   """
   def run_seeds do
     case Application.ensure_all_started(@app) do
@@ -42,23 +64,27 @@ defmodule Mv.Release do
       {:error, {app, reason}} -> raise "Failed to start #{inspect(app)}: #{inspect(reason)}"
     end
 
-    priv = :code.priv_dir(@app)
-    bootstrap_path = Path.join(priv, "repo/seeds_bootstrap.exs")
-    dev_path = Path.join(priv, "repo/seeds_dev.exs")
+    if bootstrap_seeds_applied?() do
+      IO.puts("Seeds already applied (admin user exists). Skipping.")
+    else
+      priv = :code.priv_dir(@app)
+      bootstrap_path = Path.join(priv, "repo/seeds_bootstrap.exs")
+      dev_path = Path.join(priv, "repo/seeds_dev.exs")
 
-    prev = Code.compiler_options()
-    Code.compiler_options(ignore_module_conflict: true)
+      prev = Code.compiler_options()
+      Code.compiler_options(ignore_module_conflict: true)
 
-    try do
-      Code.eval_file(bootstrap_path)
-      IO.puts("✅ Bootstrap seeds completed.")
+      try do
+        Code.eval_file(bootstrap_path)
+        IO.puts("✅ Bootstrap seeds completed.")
 
-      if System.get_env("RUN_DEV_SEEDS") == "true" do
-        Code.eval_file(dev_path)
-        IO.puts("✅ Dev seeds completed.")
+        if System.get_env("RUN_DEV_SEEDS") == "true" do
+          Code.eval_file(dev_path)
+          IO.puts("✅ Dev seeds completed.")
+        end
+      after
+        Code.compiler_options(prev)
       end
-    after
-      Code.compiler_options(prev)
     end
   end