deploy.yml

on:
  workflow_call:
    inputs:
      sentry_release:
        description: 'Submit a release to Sentry'
        required: false
        default: false
        type: boolean
      skip_deploy:
        description: 'Do not update deployment repo'
        required: false
        default: false
        type: boolean
      docker_build_args:
        description: 'Docker build arguments, e.g. "--build-arg ARG1=VALUE1 --build-arg ARG2=VALUE2"'
        required: false
        default: ''
        type: string

name: Deploy to Amazon ECR
env:
  ECR_REGISTRY: ${{ vars.AWS_ECR_REGISTRY }}
  SENTRY_ORG: "outfunnel"
  HUSKY: 0

jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-latest
    outputs:
      image_tag: ${{ steps.tag.outputs.image_tag }}
      repository_name: ${{ steps.repo.outputs.repository_name }}
      commit_title: ${{ steps.commit.outputs.commit_title }}
    steps:
    - name: Parse repository name
      id: repo
      run: echo "repository_name=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_OUTPUT

    - name: Determine image tag
      id: tag
      run: echo "image_tag=$(date +'%Y-%m-%d')-$GITHUB_RUN_NUMBER-$GITHUB_RUN_ATTEMPT" >> $GITHUB_OUTPUT

    - name: Parse commit title
      id: commit
      run: |
        echo "commit_title=$(echo $COMMIT_MESSAGE \
          | sed -E 's/^\"|\"$//g' \
          | awk -F '\\\\n' '{print $1}')" >> $GITHUB_OUTPUT
      env:
        COMMIT_MESSAGE: ${{ toJSON(github.event.head_commit.message) }}

  build-amd64:
    name: Build AMD64
    needs: prepare
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}

    - name: Login to Outfunnel NPM Registry
      run: |
        echo "@outfunnel:registry=https://${{ secrets.OF_REGISTRY_HOST }}/" > .npmrc
        echo "//${{ secrets.OF_REGISTRY_HOST }}/:_authToken=${{ secrets.OF_REGISTRY_TOKEN }}" >> .npmrc

    - name: Login to Amazon ECR public
      if: startsWith(env.ECR_REGISTRY, 'public.ecr.aws/')
      run: |
        aws ecr-public get-login-password --region ${{ vars.AWS_REGION }} | docker login --username AWS --password-stdin $ECR_REGISTRY

    - name: Login to Amazon ECR private
      if: ${{ !startsWith(env.ECR_REGISTRY, 'public.ecr.aws/') }}
      run: |
        aws ecr get-login-password --region ${{ vars.AWS_REGION }} | docker login --username AWS --password-stdin $ECR_REGISTRY

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build and push AMD64 image
      uses: docker/build-push-action@v6
      with:
        context: .
        platforms: linux/amd64
        push: true
        tags: ${{ env.ECR_REGISTRY }}/${{ needs.prepare.outputs.repository_name }}:${{ needs.prepare.outputs.image_tag }}-amd64
        build-args: |
          HUSKY=0
          ${{ inputs.docker_build_args }}
        cache-from: type=gha,scope=amd64
        cache-to: type=gha,mode=max,scope=amd64

  build-arm64:
    name: Build ARM64
    needs: prepare
    runs-on: ubuntu-24.04-arm
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}

    - name: Login to Outfunnel NPM Registry
      run: |
        echo "@outfunnel:registry=https://${{ secrets.OF_REGISTRY_HOST }}/" > .npmrc
        echo "//${{ secrets.OF_REGISTRY_HOST }}/:_authToken=${{ secrets.OF_REGISTRY_TOKEN }}" >> .npmrc

    - name: Login to Amazon ECR public
      if: startsWith(env.ECR_REGISTRY, 'public.ecr.aws/')
      run: |
        aws ecr-public get-login-password --region ${{ vars.AWS_REGION }} | docker login --username AWS --password-stdin $ECR_REGISTRY

    - name: Login to Amazon ECR private
      if: ${{ !startsWith(env.ECR_REGISTRY, 'public.ecr.aws/') }}
      run: |
        aws ecr get-login-password --region ${{ vars.AWS_REGION }} | docker login --username AWS --password-stdin $ECR_REGISTRY

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build and push ARM64 image
      uses: docker/build-push-action@v6
      with:
        context: .
        platforms: linux/arm64
        push: true
        tags: ${{ env.ECR_REGISTRY }}/${{ needs.prepare.outputs.repository_name }}:${{ needs.prepare.outputs.image_tag }}-arm64
        build-args: |
          HUSKY=0
          ${{ inputs.docker_build_args }}
        cache-from: type=gha,scope=arm64
        cache-to: type=gha,mode=max,scope=arm64

  merge-and-deploy:
    name: Merge manifests and deploy
    needs: [prepare, build-amd64, build-arm64]
    runs-on: ubuntu-latest
    env:
      REPOSITORY_NAME: ${{ needs.prepare.outputs.repository_name }}
      IMAGE_TAG: ${{ needs.prepare.outputs.image_tag }}
      COMMIT_TITLE: ${{ needs.prepare.outputs.commit_title }}
    steps:
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ vars.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ vars.AWS_REGION }}

    - name: Login to Amazon ECR public
      if: startsWith(env.ECR_REGISTRY, 'public.ecr.aws/')
      run: |
        aws ecr-public get-login-password --region ${{ vars.AWS_REGION }} | docker login --username AWS --password-stdin $ECR_REGISTRY

    - name: Login to Amazon ECR private
      if: ${{ !startsWith(env.ECR_REGISTRY, 'public.ecr.aws/') }}
      run: |
        aws ecr get-login-password --region ${{ vars.AWS_REGION }} | docker login --username AWS --password-stdin $ECR_REGISTRY

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Create and push multi-arch manifest
      run: |
        docker buildx imagetools create \
          --tag $ECR_REGISTRY/$REPOSITORY_NAME:$IMAGE_TAG \
          --tag $ECR_REGISTRY/$REPOSITORY_NAME:latest \
          $ECR_REGISTRY/$REPOSITORY_NAME:$IMAGE_TAG-amd64 \
          $ECR_REGISTRY/$REPOSITORY_NAME:$IMAGE_TAG-arm64

    - name: Clone outfunnel-application repo
      if: ${{ !inputs.skip_deploy }}
      uses: actions/checkout@v4
      with:
        repository: outfunnel/outfunnel-application
        ref: master
        path: ./outfunnel-application
        token: ${{ secrets.PAT }}

    - name: Update version in the yaml file
      if: ${{ !inputs.skip_deploy }}
      run: |
        sed -i -Ee "s/value\: (.*?\/$REPOSITORY_NAME)\:.*/value: \1:$IMAGE_TAG/g" "./outfunnel-application/${{ env.REPOSITORY_NAME }}.yaml"

    - name: Push to @outfunnel/outfunnel-application
      if: ${{ !inputs.skip_deploy }}
      uses: dmnemec/copy_file_to_another_repo_action@main
      env:
        API_TOKEN_GITHUB: ${{ secrets.PAT }}
      with:
        source_file: "./outfunnel-application/${{ env.REPOSITORY_NAME }}.yaml"
        destination_repo: "outfunnel/outfunnel-application"
        user_email: "deploy@outfunnel.com"
        user_name: "Deployment Bot"
        commit_message: |
          Deploying ${{ env.REPOSITORY_NAME }}:${{ env.IMAGE_TAG }}

          Triggered by ${{ github.event.head_commit.author.name }}
          "${{ github.event.head_commit.message }}"
          https://github.com/${{ github.repository }}/commit/${{ github.sha }}
        destination_branch: "master"

    - name: Post a message to Slack
      if: ${{ !inputs.skip_deploy }}
      uses: slackapi/slack-github-action@v1
      with:
        payload: |
          {
            "channel": "${{ vars.SLACK_DEPLOY_CHANNEL }}",
            "username": "GH Action",
            "text": "${{ github.event.head_commit.author.name }} deployed *${{ env.REPOSITORY_NAME }}* to *live*\n_${{ env.COMMIT_TITLE }}_",
            "icon_emoji": ":github:"
          }
      env:
        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

    - name: Create Sentry release
      if: ${{ inputs.sentry_release }}
      uses: getsentry/action-release@v1
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        SENTRY_ORG: "${{ env.SENTRY_ORG }}"
        SENTRY_PROJECT: ${{ env.REPOSITORY_NAME }}
      with:
        environment: live
        ignore_empty: true

    - name: Post failure message to Slack
      if: ${{ failure() && !inputs.skip_deploy }}
      uses: slackapi/slack-github-action@v1
      with:
        payload: |
          {
            "channel": "${{ vars.SLACK_DEPLOY_CHANNEL }}",
            "username": "GH Action",
            "text": "<!subteam^SL980R597> ${{ github.event.head_commit.author.name }} failed to deploy *${{ env.REPOSITORY_NAME }}* to *live*\n_${{ env.COMMIT_TITLE }}_ \n${{ github.event.head_commit.url }}",
            "icon_emoji": ":github:"
          }
      env:
        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}