build.yml

name: Build

on:
  push:
    branches: [ "main" ]

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

env:
  AWS_REGION: "us-east-2"                     # set this to your preferred AWS region, e.g. us-west-1
  ECR_REPOSITORY: "oclmap"                   # set this to your Amazon ECR repository name
  ECS_SERVICE_DEV: "dev-map"                      # set this to your Amazon ECS service name
  ECS_SERVICE_QA: "qa-map"                      # set this to your Amazon ECS service name
  ECS_CLUSTER_QA: "ocl-qa-demo"                  # set this to your Amazon ECS cluster name
  ECS_SERVICE_STAGING: "staging-map"                      # set this to your Amazon ECS service name
  ECS_CLUSTER_STAGING_PRODUCTION: "ocl-staging-production"                  # set this to your Amazon ECS cluster name
  ECS_SERVICE_PRODUCTION: "production-map"                      # set this to your Amazon ECS service name


jobs:
  lint-and-test:
    name: Lint and test
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Fail if start-prod.sh writes a secret-shaped variable into env-config.js
      run: |
        ALLOWLIST="RECAPTCHA_SITE_KEY|ERRBIT_KEY"
        LEAKS=$(grep -oE 'var [A-Za-z_]+' start-prod.sh | awk '{print $2}' | grep -E 'SECRET|PASSWORD|_KEY' | grep -vE "^(${ALLOWLIST})$" || true)
        if [ -n "$LEAKS" ]; then
          echo "::error::start-prod.sh writes secret-shaped variable(s) into the publicly-served env-config.js: $LEAKS"
          echo "If this is intentionally public (like a DSN-style key), add it to ALLOWLIST above. Otherwise remove it."
          exit 1
        fi
    - name: Setup Node
      uses: actions/setup-node@v3
      with:
        node-version: 22
        cache: 'npm'
    - run: npm ci
    - name: Eslint
      run: ./node_modules/eslint/bin/eslint.js src --ext .jsx,.js
    - name: Test
      run: npm run test:all

  build:
    needs: [lint-and-test]
    name: Build and push image
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repo
      uses: actions/checkout@v3
    - name: Compute version and short sha
      id: version
      run: |
        echo "tag=$(bash release_version.sh full-version)" >> $GITHUB_OUTPUT
        echo "sha=$(bash release_version.sh sha)" >> $GITHUB_OUTPUT
    - name: Log in to Docker Hub
      uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
    #- name: Log in to the Container registry
    #  uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
    #  with:
    #    registry: ghcr.io
    #    username: ${{ github.actor }}
    #    password: ${{ secrets.GITHUB_TOKEN }}
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Build and push Docker image
      uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
      with:
        context: .
        push: true
        tags: openconceptlab/oclmap:nightly, openconceptlab/oclmap:${{ steps.version.outputs.tag }}
        build-args: SOURCE_COMMIT=${{ steps.version.outputs.sha }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

  # The image the deploy jobs below run: the open build plus a private UI
  # package, pushed only to the private ECR repository. Docker Hub gets the
  # open image above. The private-packages environment holds the deploy key
  # and PRIVATE_PACKAGES_GIT, and only main may use it. No cache is written,
  # so no layer with the package lands in this repo's Actions cache.
  build-private:
    needs: [lint-and-test]
    name: Build and push deploy image
    runs-on: ubuntu-latest
    environment: private-packages

    steps:
    - name: Checkout repo
      uses: actions/checkout@v3
    - name: Compute version and short sha
      id: version
      run: |
        echo "tag=$(bash release_version.sh full-version)" >> $GITHUB_OUTPUT
        echo "sha=$(bash release_version.sh sha)" >> $GITHUB_OUTPUT
    - name: Fail without the private package settings
      env:
        HAS_KEY: ${{ secrets.PRIVATE_GIT_PACKAGES_DEPLOY_KEY != '' }}
        HAS_SPEC: ${{ secrets.PRIVATE_PACKAGES_GIT != '' }}
      run: |
        if [ "$HAS_KEY" != "true" ] || [ "$HAS_SPEC" != "true" ]; then
          echo "::error::Set PRIVATE_GIT_PACKAGES_DEPLOY_KEY and PRIVATE_PACKAGES_GIT in the private-packages environment."
          exit 1
        fi
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ env.AWS_REGION }}
    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v1
    - name: Setup SSH agent
      uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
      with:
        ssh-private-key: ${{ secrets.PRIVATE_GIT_PACKAGES_DEPLOY_KEY }}
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Build and push deploy image
      uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
      with:
        context: .
        push: true
        ssh: default
        provenance: false
        tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ steps.version.outputs.tag }}
        build-args: |
          SOURCE_COMMIT=${{ steps.version.outputs.sha }}
          PRIVATE_PACKAGES_GIT=${{ secrets.PRIVATE_PACKAGES_GIT }}
        cache-from: type=gha

  release:
    needs: [build, build-private]
    runs-on: ubuntu-latest
    name: Release
    environment: rc
    permissions:
      contents: write
    steps:
      - name: Checkout repo
        uses: actions/checkout@v3
        with:
          fetch-depth: 0
          token: ${{ secrets.RELEASE_TOKEN }}
      - name: Publish release and bump version
        run: bash release_version.sh publish
        env:
          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}

  deploy-dev:
    needs: [release]
    name: Deploy to DEV
    runs-on: ubuntu-latest
    environment: dev

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      - name: Checkout repo
        uses: actions/checkout@v3
      - name: Compute version and short sha
        id: version
        run: echo "tag=$(bash release_version.sh full-version)" >> $GITHUB_OUTPUT
      - name: Push image to Amazon ECR
        id: push-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Tag the image build-private pushed to ECR
          # for this environment, so that it can
          # be deployed to ECS.
          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:dev
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:dev
          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
      - name: Download task definition
        run: |
          aws ecs describe-task-definition --task-definition $ECS_SERVICE_DEV --query taskDefinition > task-definition.json
      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: "task-definition.json"
          container-name: ${{ env.ECS_SERVICE_DEV }}
          image: ${{ steps.push-image.outputs.image }}

      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: ${{ env.ECS_SERVICE_DEV }}
          cluster: ${{ env.ECS_CLUSTER_QA }}
  deploy-qa:
    needs: [release]
    name: Deploy to QA
    runs-on: ubuntu-latest
    environment: qa

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      - name: Checkout repo
        uses: actions/checkout@v3
      - name: Compute version and short sha
        id: version
        run: echo "tag=$(bash release_version.sh full-version)" >> $GITHUB_OUTPUT
      - name: Push image to Amazon ECR
        id: push-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Tag the image build-private pushed to ECR
          # for this environment, so that it can
          # be deployed to ECS.
          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:qa
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:qa
          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
      - name: Download task definition
        run: |
          aws ecs describe-task-definition --task-definition $ECS_SERVICE_QA --query taskDefinition > task-definition.json
      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: "task-definition.json"
          container-name: ${{ env.ECS_SERVICE_QA }}
          image: ${{ steps.push-image.outputs.image }}

      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: ${{ env.ECS_SERVICE_QA }}
          cluster: ${{ env.ECS_CLUSTER_QA }}
  deploy-staging:
    needs: [deploy-qa]
    name: Deploy to Staging
    runs-on: ubuntu-latest
    environment: staging

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      - name: Checkout repo
        uses: actions/checkout@v3
      - name: Compute version and short sha
        id: version
        run: echo "tag=$(bash release_version.sh full-version)" >> $GITHUB_OUTPUT
      - name: Push image to Amazon ECR
        id: push-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Tag the image build-private pushed to ECR
          # for this environment, so that it can
          # be deployed to ECS.
          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:staging
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:staging
          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
      - name: Download task definition
        run: |
          aws ecs describe-task-definition --task-definition $ECS_SERVICE_STAGING --query taskDefinition > task-definition.json
      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: "task-definition.json"
          container-name: ${{ env.ECS_SERVICE_STAGING }}
          image: ${{ steps.push-image.outputs.image }}

      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: ${{ env.ECS_SERVICE_STAGING }}
          cluster: ${{ env.ECS_CLUSTER_STAGING_PRODUCTION }}
  deploy-production:
    needs: [deploy-staging]
    name: Deploy to Production
    runs-on: ubuntu-latest
    environment: production

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v1
      - name: Checkout repo
        uses: actions/checkout@v3
      - name: Compute version and short sha
        id: version
        run: echo "tag=$(bash release_version.sh full-version)" >> $GITHUB_OUTPUT
      - name: Push image to Amazon ECR
        id: push-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          IMAGE_TAG: ${{ steps.version.outputs.tag }}
        run: |
          # Tag the image build-private pushed to ECR
          # for this environment, so that it can
          # be deployed to ECS.
          docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker tag $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:production
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:production
          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
      - name: Download task definition
        run: |
          aws ecs describe-task-definition --task-definition $ECS_SERVICE_PRODUCTION --query taskDefinition > task-definition.json
      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: "task-definition.json"
          container-name: ${{ env.ECS_SERVICE_PRODUCTION }}
          image: ${{ steps.push-image.outputs.image }}

      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: ${{ env.ECS_SERVICE_PRODUCTION }}
          cluster: ${{ env.ECS_CLUSTER_STAGING_PRODUCTION }}
          wait-for-service-stability: true
          wait-for-minutes: 15