deploy-feature.yml

name: Deploy Feature Environment

on:
    workflow_dispatch:
        inputs:
            target:
                description: 'App to deploy'
                required: true
                type: choice
                options:
                    - userweb
                    - vendorweb
                    - API
                    - EventHandler
                default: 'userweb'
            useprbackend:
                description: 'Use deployed PR backend api. (userweb/vendorweb only)'
                required: true
                type: boolean
                default: false

env:
    AWS_DEFAULT_REGION: us-east-1
    BRANCH_NAME: ${{ github.head_ref || github.ref_name }}

permissions:
    id-token: write
    contents: read
    pull-requests: write

jobs:
    deploy:
        runs-on: self-hosted
        steps:
            - name: Ensure non-main branch
              run: |
                  if [ "${{ env.BRANCH_NAME }}" == "main" ]; then
                    echo "Deploying main branch to feature environment is redundant."
                    exit 1
                  fi
            - uses: actions/checkout@v4
              with:
                  ref: ${{env.BRANCH_NAME}}

            - name: Find associated PR
              id: find-pr
              run: |
                  PR_NUMBER=$(gh pr list \
                    --head ${{ env.BRANCH_NAME }} \
                    --json number \
                    --limit 1 \
                    --jq '.[0].number'
                  )

                  if [ -z "$PR_NUMBER" ]; then
                    echo "No PR found for branch: ${{ env.BRANCH_NAME }}"
                    exit 1
                  fi

                  echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

            - name: Comment on PR
              id: create_comment
              run: |
                  COMMENT_ID=$(gh api \
                    repos/${{ github.repository }}/issues/${{ steps.find-pr.outputs.PR_NUMBER }}/comments \
                    -X POST \
                    -f body="Deployment to feature environment for app \`${{ github.event.inputs.target }}\` has [started](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for branch \`${{ env.BRANCH_NAME }}\`." \
                    --jq '.id'
                  )

                  echo "COMMENT_ID=$COMMENT_ID" >> $GITHUB_OUTPUT
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

            - uses: actions/setup-node@v4
              with:
                node-version: 20

            - uses: MasterworksIO/action-local-cache@2
              id: local-cache
              with:
                path: node_modules
                key: ${{ hashFiles('package-lock.json') }}

            - run: npm i
              # if: steps.local-cache.outputs.cache-hit != 'true'

            - name: Build
              run: |
                  PRNUMBER="${{ steps.find-pr.outputs.PR_NUMBER }}"
                  USEPRBACKEND="${{ github.event.inputs.useprbackend }}"
                  if [ "$USEPRBACKEND" = "true" ]; then
                    echo "Using PR backend"
                    NX_PUBLIC_APP_BUILD=$(node scripts/CreateBuildIdent.js)-pr$PRNUMBER NX_PUBLIC_API_BASEURL=https://api.pr$PRNUMBER.dev.opentix.co npx nx run-many -t build --no-cloud
                  else
                    NX_PUBLIC_APP_BUILD=$(node scripts/CreateBuildIdent.js)-pr$PRNUMBER npx nx run-many -t build --no-cloud
                  fi

            - run: npm ci --legacy-peer-deps
              working-directory: ./infra

            - name: configure aws credentials
              uses: aws-actions/configure-aws-credentials@v4
              with:
                  role-to-assume: ${{ secrets.AWS_PRIMARY_ACCT_ROLE }}
                  role-session-name: GitHub_to_AWS_via_FederatedOIDC
                  aws-region: 'us-east-1'

            - name: assume dev executor role credentials
              uses: aws-actions/configure-aws-credentials@v4
              with:
                  aws-access-key-id: ${{ env.AWS_ACCESS_KEY_ID }}
                  aws-secret-access-key: ${{ env.AWS_SECRET_ACCESS_KEY }}
                  aws-session-token: ${{ env.AWS_SESSION_TOKEN }}
                  role-to-assume: ${{ secrets.AWS_DEV_ACCT_ROLE }}
                  role-session-name: GitHub_to_AWS_via_FederatedOIDC
                  role-duration-seconds: 3600
                  role-skip-session-tagging: true
                  aws-region: 'us-east-1'

            - name: Deploy
              working-directory: ./infra
              run: |
                  PRNUMBER="${{ steps.find-pr.outputs.PR_NUMBER }}"
                  DEPLOYENV="feature"
                  HOSTEDZONENAME="dev.opentix.co"
                  TARGETAPP="${{ github.event.inputs.target }}"

                  TARGETAPP_CAPITALIZED=$(echo "${TARGETAPP^}")
                  TARGETSTACK="pr${PRNUMBER}-${TARGETAPP_CAPITALIZED}Stack"

                  DEPLOYENV=$DEPLOYENV HOSTEDZONENAME=$HOSTEDZONENAME PRNUMBER=$PRNUMBER npx cdk deploy "$TARGETSTACK" --account ${{ secrets.AWS_DEV_ACCT_NUM }} --region us-east-1 --require-approval never

            - name: Update comment with SUCCESS
              if: success()
              run: |
                  PRNUMBER="${{ steps.find-pr.outputs.PR_NUMBER }}"
                  if [ "${{ github.event.inputs.target }}" == "userweb" ]; then
                      URL="https://client.pr${PRNUMBER}.dev.opentix.co"
                  elif [ "${{ github.event.inputs.target }}" == "vendorweb" ]; then
                      URL="https://vendor.pr${PRNUMBER}.dev.opentix.co"
                  elif [ "${{ github.event.inputs.target }}" == "API" ]; then
                      URL="https://api.pr${PRNUMBER}.dev.opentix.co"
                  elif [ "${{ github.event.inputs.target }}" == "EventHandler" ]; then
                      URL="https://opentix.co"
                  else
                      echo "Invalid target: ${{ github.event.inputs.target }}"
                      exit 1
                  fi

                  gh api \
                    repos/${{ github.repository }}/issues/comments/${{ steps.create_comment.outputs.COMMENT_ID }} \
                    -X PATCH \
                    -F body="✅ \`${{ github.event.inputs.target }}\` deployment [succeeded](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for branch \`${{ env.BRANCH_NAME }}\`! [View deployment](${URL})."
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

            - name: Update comment with FAILURE
              if: failure()
              run: |
                  gh api \
                    repos/${{ github.repository }}/issues/comments/${{ steps.create_comment.outputs.COMMENT_ID }} \
                    -X PATCH \
                    -F body="❌ \`${{ github.event.inputs.target }}\` deployment [failed](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for branch \`${{ env.BRANCH_NAME }}\`."
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}