deploy-staging.yml

name: deploy-staging

concurrency:
  group: deploy-staging
  cancel-in-progress: true

on:
  push:
    branches:
      - main
      - add-tf-iac

permissions:
  id-token: write   # This is required for requesting the JWT
  contents: read    # This is required for actions/checkout

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    environment: staging
    outputs:
      deploy-iac: ${{ steps.check.outputs.deploy-iac }}
      deploy-app: ${{ steps.check.outputs.deploy-app }}
    steps:
      - uses: actions/checkout@v4

      - uses: dorny/paths-filter@v3
        id: check
        with:
          filters: |
            deploy-iac:
              - 'tofu/modules/**'
              - 'tofu/environments/stage/**'
              - '.github/workflows/deploy-staging.yml'
            deploy-app:
              - 'backend/**'
              - 'tofu/modules/services/backend-service/**'
              - 'tofu/environments/stage/services/backend-service/**'
              - 'frontend/**'
              - 'tofu/modules/services/frontend-infra/**'
              - 'tofu/environments/stage/services/frontend-infra/**'
              - '.github/workflows/deploy-staging.yml'

  deploy-iac:
    needs: detect-changes
    if: needs.detect-changes.outputs.deploy-iac == 'true'
    environment: staging
    runs-on: ubuntu-latest
    outputs:
      bucket: ${{ steps.output-bucket-name.outputs.bucket }}
    env:
      TF_VAR_region: ${{ vars.AWS_REGION }}
      TF_VAR_environment: ${{ vars.ENV_SHORT_NAME }}
      TF_VAR_name_prefix: "tb-${{ vars.PROJECT_SHORT_NAME }}-${{ vars.ENV_SHORT_NAME }}"
      TF_VAR_app_env: ${{ vars.APP_ENV }}
      TF_VAR_db_enc_secret: ${{ vars.DB_ENCRYPTED_SECRET }}
      TF_VAR_frontend_url: ${{ vars.FRONTEND_URL }}
      TF_VAR_fxa_secret: ${{ vars.FXA_SECRET }}
      TF_VAR_google_oauth_secret: ${{ vars.GOOGLE_OAUTH_SECRET }}
      TF_VAR_log_level: ${{ vars.LOG_LEVEL }}
      TF_VAR_short_base_url: ${{ vars.SHORT_BASE_URL }}
      TF_VAR_smtp_secret: ${{ vars.SMTP_SECRET }}
      TF_VAR_zoom_callback: ${{ vars.ZOOM_CALLBACK }}
      TF_VAR_zoom_secret: ${{ vars.zoom_secret }}
      TF_VAR_sentry_dsn: ${{ vars.SENTRY_DSN }}
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.IAM_ROLE }}
          role-session-name: Appointment_GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ vars.AWS_REGION }}

      - name: install opentofu
        uses: opentofu/setup-opentofu@v1
        with: 
          tofu_version: ${{ vars.TF_VERSION }}
          tofu_wrapper: false

      - name: install terragrunt
        run: |
          sudo wget -q -O /bin/terragrunt "https://github.com/gruntwork-io/terragrunt/releases/download/v${{ vars.TG_VERSION }}/terragrunt_linux_amd64"
          sudo chmod +x /bin/terragrunt
          terragrunt -v

      - name: vpc
        working-directory: ./tofu/environments/stage/network/vpc
        run: |
          terragrunt init -upgrade
          terragrunt validate
          terragrunt plan -out tfplan
          terragrunt apply tfplan

      - name: backend-infra
        working-directory: ./tofu/environments/stage/services/backend-infra
        run: |
          terragrunt init -upgrade
          terragrunt validate
          terragrunt plan -out tfplan
          terragrunt apply tfplan

      - name: cache
        working-directory: ./tofu/environments/stage/data-store/cache
        run: |
          terragrunt init -upgrade
          terragrunt validate
          terragrunt plan -out tfplan
          terragrunt apply tfplan

      - name: database
        working-directory: ./tofu/environments/stage/data-store/database
        run: |
          terragrunt init -upgrade
          terragrunt validate
          terragrunt plan -out tfplan
          terragrunt apply tfplan
          
      - name: frontend-infra
        working-directory: ./tofu/environments/stage/services/frontend-infra
        run: |
          terragrunt init -upgrade
          terragrunt validate
          terragrunt plan -out tfplan
          terragrunt apply tfplan

      - name: output-bucket-name
        id: output-bucket-name
        working-directory: ./tofu/environments/stage/services/frontend-infra
        run: |
          output=$(terragrunt output bucket_name | tr -d '"')
          echo bucket=$output >> $GITHUB_OUTPUT

  deploy-frontend:
    needs:
      - detect-changes
      - deploy-iac
    if: needs.detect-changes.outputs.deploy-app == 'true'
    environment: staging
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup NPM
        uses: actions/setup-node@v4
        with:
          node-version: '18.x'

      - name: Install dependencies
        run: cd frontend && yarn install

      - name: Build project
        run: |
          cp frontend/.env.staging.example frontend/.env.staging
          cd frontend && yarn build --mode ${{ vars.APP_ENV }}

      - name: Install AWS CLI
        uses: unfor19/install-aws-cli-action@v1
        with:
          version: 2
          arch: amd64

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.IAM_ROLE }}
          role-session-name: Appointment_GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ vars.AWS_REGION }}

      - name: Build frontend archive
        run: |
          zip -r frontend-${{ github.sha }}.zip frontend/dist
      
      - name: Archive Frontend
        uses: actions/upload-artifact@v4
        with:
          name: frontend-${{ github.sha }}
          path: |
            frontend-${{ github.sha }}.zip

      - name: Deploy frontend to S3
        run: aws s3 sync frontend/dist "s3://${{ needs.deploy-iac.outputs.bucket }}"
        


  deploy-backend:
    needs: 
      - detect-changes
      - deploy-iac
    if: needs.detect-changes.outputs.deploy-app == 'true'
    environment: staging
    runs-on: ubuntu-latest
    env:
      TF_VAR_region: ${{ vars.AWS_REGION }}
      TF_VAR_environment: ${{ vars.ENV_SHORT_NAME }}
      TF_VAR_name_prefix: "tb-${{ vars.PROJECT_SHORT_NAME }}-${{ vars.ENV_SHORT_NAME }}"
      TF_VAR_app_env: ${{ vars.APP_ENV }}
      TF_VAR_db_enc_secret: ${{ vars.DB_ENCRYPTED_SECRET }}
      TF_VAR_frontend_url: ${{ vars.FRONTEND_URL }}
      TF_VAR_fxa_secret: ${{ vars.FXA_SECRET }}
      TF_VAR_google_oauth_secret: ${{ vars.GOOGLE_OAUTH_SECRET }}
      TF_VAR_log_level: ${{ vars.LOG_LEVEL }}
      TF_VAR_short_base_url: ${{ vars.SHORT_BASE_URL }}
      TF_VAR_smtp_secret: ${{ vars.SMTP_SECRET }}
      TF_VAR_zoom_callback: ${{ vars.ZOOM_CALLBACK }}
      TF_VAR_zoom_secret: ${{ vars.ZOOM_SECRET }}
      TF_VAR_sentry_dsn: ${{ vars.SENTRY_DSN }}
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.IAM_ROLE }}
          role-session-name: Appointment_GitHub_to_AWS_via_FederatedOIDC
          aws-region: ${{ vars.AWS_REGION }}

      - name: install opentofu
        uses: opentofu/setup-opentofu@v1
        with: 
          tofu_version: ${{ vars.TF_VERSION }}
          tofu_wrapper: false

      - name: install terragrunt
        run: |
          sudo wget -q -O /bin/terragrunt "https://github.com/gruntwork-io/terragrunt/releases/download/v${{ vars.TG_VERSION }}/terragrunt_linux_amd64"
          sudo chmod +x /bin/terragrunt
          terragrunt -v

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
        with:
          mask-password: 'true'

      - name: Build, tag, and push backend image to Amazon ECR
        id: build-backend
        env:
          ECR_TAG: '${{ steps.login-ecr.outputs.registry }}/${{ vars.PROJECT }}:backend-${{ github.sha }}'
        run: |
          # Build a docker container and
          # push it to ECR so that it can
          # be deployed to ECS.
          docker build -t $ECR_TAG ./backend -f ./backend/deploy.dockerfile
          docker push $ECR_TAG
          echo "image_backend=$ECR_TAG" >> $GITHUB_OUTPUT

      - name: deploy backend-service
        working-directory: ./tofu/environments/stage/services/backend-service
        run: |
          terragrunt init -upgrade
          terragrunt validate
          terragrunt plan -var 'image=${{ steps.build-backend.outputs.image_backend }}' -out tfplan
          terragrunt apply tfplan

  create-release:
    needs:
      - detect-changes
      - deploy-backend
      - deploy-frontend
    if: needs.detect-changes.outputs.deploy-app == 'true'
    environment: staging
    runs-on: ubuntu-latest
    steps:
      - name: download artifact
        uses: actions/download-artifact@v3
        with:
          name: 
            frontend-${{ github.sha }}
          path:
            frontend-${{ github.sha }}.zip

      - name: create release tag
        id: create-release-tag
        run: echo "tag_name=r-$(printf %04d $GITHUB_RUN_NUMBER)" >> $GITHUB_OUTPUT

      - name: create draft release
        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.create-release-tag.outputs.tag_name }}
          name: Release ${{ steps.create-release-tag.outputs.tag_name }}
          body: |
            ## Info
            Commit ${{ github.sha }} was deployed to `staging`. [See code diff](${{ github.event.compare }}).

            It was initialized by [${{ github.event.sender.login }}](${{ github.event.sender.html_url }}).

            ## How to Promote?
            In order to promote this to prod, edit the draft and press **"Publish release"**.
          draft: true
          files: frontend-${{ github.sha }}.zip