deploy.yml

name: Deploy

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - "cmd/**"
      - "internal/**"
      - "config/**"
      - "template.yaml"
      - "Makefile"
      - "go.mod"
      - "go.sum"
      - ".github/workflows/deploy.yml"

concurrency:
  group: weles-deploy
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: "1.24.x"
          cache: true

      - name: Install SAM CLI
        run: pip install aws-sam-cli

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Validate apps config and SES identities
        env:
          APPS_CONFIG: ${{ secrets.APPS_CONFIG }}
          SES_IDENTITIES: ${{ vars.SES_IDENTITIES }}
          SES_IDENTITY: ${{ vars.SES_IDENTITY }}
          AWS_REGION: ${{ vars.AWS_REGION }}
        run: |
          set -euo pipefail
          IDENTITIES="${SES_IDENTITIES:-${SES_IDENTITY:-}}"
          if [[ -z "${IDENTITIES}" ]]; then
            echo "SES_IDENTITIES (or SES_IDENTITY) GitHub variable is required — comma-separated SES domains/emails for IAM" >&2
            exit 1
          fi
          REGION="${AWS_REGION:?AWS_REGION is required}"
          ACCOUNT="$(aws sts get-caller-identity --query Account --output text)"
          APPS_FILE="$(mktemp)"
          printf '%s' "$APPS_CONFIG" > "$APPS_FILE"
          # Fails if YAML is invalid, emails missing, or fromEmail is outside SES identities.
          JOINED_ARNS="$(go run ./cmd/deploycheck -apps "$APPS_FILE" -identities "$IDENTITIES" -region "$REGION" -account "$ACCOUNT" -print-arns)"
          rm -f "$APPS_FILE"
          {
            echo "IDENTITIES<<EOF"
            echo "$IDENTITIES"
            echo "EOF"
            echo "JOINED_ARNS<<EOF"
            echo "$JOINED_ARNS"
            echo "EOF"
          } >> "$GITHUB_ENV"

      - name: Publish secrets and allowlist to SSM
        env:
          APPS_CONFIG: ${{ secrets.APPS_CONFIG }}
          TURNSTILE_SECRET: ${{ secrets.TURNSTILE_SECRET }}
          APPS_PARAMETER_NAME: ${{ vars.APPS_PARAMETER_NAME }}
          TURNSTILE_PARAMETER_NAME: ${{ vars.TURNSTILE_PARAMETER_NAME }}
        run: |
          normalize() {
            local n="$1"
            if [[ "$n" != /* ]]; then
              n="/$n"
            fi
            printf '%s' "$n"
          }
          APPS_PARAM="$(normalize "${APPS_PARAMETER_NAME:-/weles/prod/apps}")"
          TURNSTILE_PARAM="$(normalize "${TURNSTILE_PARAMETER_NAME:-/weles/prod/turnstile-secret}")"
          echo "APPS_PARAM=$APPS_PARAM" >> "$GITHUB_ENV"
          echo "TURNSTILE_PARAM=$TURNSTILE_PARAM" >> "$GITHUB_ENV"

          aws ssm put-parameter \
            --name "$APPS_PARAM" \
            --type String \
            --value "$APPS_CONFIG" \
            --overwrite

          aws ssm put-parameter \
            --name "$TURNSTILE_PARAM" \
            --type SecureString \
            --value "$TURNSTILE_SECRET" \
            --overwrite

      - name: SAM build
        run: sam build

      - name: SAM deploy
        env:
          SES_CONFIGURATION_SET: ${{ vars.SES_CONFIGURATION_SET }}
        run: |
          set -euo pipefail
          OVERRIDES=(
            "SesIdentityArns=${JOINED_ARNS}"
            "AppsParameterName=${APPS_PARAM}"
            "TurnstileParameterName=${TURNSTILE_PARAM}"
          )
          if [[ -n "${SES_CONFIGURATION_SET:-}" ]]; then
            OVERRIDES+=("SesConfigurationSet=${SES_CONFIGURATION_SET}")
          fi
          sam deploy \
            --no-confirm-changeset \
            --no-fail-on-empty-changeset \
            --stack-name weles \
            --capabilities CAPABILITY_IAM \
            --resolve-s3 \
            --parameter-overrides "${OVERRIDES[@]}"