deploy.template.yml

name: Deploy ${template:app_name}
on:
  push:
    branches:
      - dry-run-deploy
  workflow_dispatch:
    inputs:
      cluster:
        description: cluster. Choose from dev/eval/prod.
        default: eval
        required: true
      rfc:
        description: >
          rfc. The RFC number (e.g., '0724') associated with this
          deployment. Required when deploying to prod.
      version:
        description: >
          version. The version to deploy (e.g., '1.2.3'). If not provided,
          the most recent release candidate will be used (eval will source from dev,
          prod will source from eval).

env:
  SLACK_BOT_TOKEN: ${{ secrets.ACTIONS_SLACK_BOT_TOKEN }}
  STEP_SCRIPTS: ${{ github.workspace }}/.github/steps/deploy
  target_cluster: dev

jobs:
  deploy:
    runs-on: ubuntu-latest
    strategy:
      max-parallel: 1
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - name: Install and configure poetry
        run: |
          pipx install poetry

      - if: github.event.inputs.cluster == 'prod'
        run: |
          if ! test -n "${{ github.event.inputs.rfc }}"
          then
            echo "::error::An RFC must be referenced when deploying to prod!"
            exit 1
          fi

      - name: Install package
        run: poetry install

      - name: Update env with promotion version that was provided
        if: github.event.inputs.version
        run: echo "target_version=${{ github.event.inputs.version }}" >> $GITHUB_ENV

      - name: Update env with promotion version if not provided
        if: '! env.target_version'
        shell: bash
        run: |
          # $1 will be package name, $2 will be current version
          set $(poetry version)

          case "${{ github.event.inputs.cluster }}" in
            dev)
              version="$2"
              echo "Would set version to '$version' (from poetry version)"
              ;;
            eval)
              # substitute '_' for '-' in APP_NAME
              url="https://${1//_/-}.iamdev.s.uw.edu/status"
              version=$(curl --silent $url | python -c "import json, sys; print(json.load(sys.stdin)['version'])")
              echo "After consulting dev the eval version will be ${version}"
              ;;
            prod)
              # substitute '_' for '-' in APP_NAME
              url="https://${1//_/-}.iameval.s.uw.edu/status"
              version=$(curl --silent $url | python -c "import json, sys; print(json.load(sys.stdin)['version'])")
              echo "After consulting eval the prod version will be ${version}"
              ;;
            *)
              echo "Invalid cluster! Pick one of dev|eval|prod"
              exit 1
              ;;
          esac
          echo "target_version=${version}" >> $GITHUB_ENV

      - name: Auth to Google Cloud
        # important! this 'auth' is referenced as `steps.auth` on the next job
        id: auth
        # https://github.com/google-github-actions/auth#authenticating-via-service-account-key-json-1
        uses: 'google-github-actions/auth@v1'
        with:
          credentials_json: '${{ secrets.MCI_GCLOUD_AUTH_JSON }}'
          token_format: 'access_token'

      - name: Auth to Google Artifact Registry
        # https://github.com/google-github-actions/auth#authenticating-to-container-registry-and-artifact-registry
        # requires role: roles/iam.serviceAccountTokenCreator
        run: |-
          echo '${{ steps.auth.outputs.access_token }}' | docker login -u oauth2accesstoken --password-stdin https://us-docker.pkg.dev

      - name: Tag version ${{ env.target_version }} for ${{ github.event.inputs.cluster }}
        id: deploy
        run: |
          # timestamp and deploy_tag are not DRY - see also release-on-push-to-main.yaml
          timestamp=$(date --utc +%Y.%m.%d.%H.%M.%S)
          deploy_tag="deploy-${{ github.event.inputs.cluster }}.${timestamp}.v${{ env.target_version }}"
          echo "::notice::Deploying appid version ${{ env.target_version }} to ${{ github.event.inputs.cluster }} as ${deploy_tag}"
          # this will create a new tag (deploy_tag) on an existing tag (env.target_version)
          docker buildx imagetools create \
            --tag us-docker.pkg.dev/uwit-mci-iam/containers/${template:app_name_hyphen}:${deploy_tag} \
            us-docker.pkg.dev/uwit-mci-iam/containers/${template:app_name_hyphen}:${{ env.target_version }}