deploy-to-prod.yml

name: Deploy to AWS Production

on:
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  tests:
    uses: ./.github/workflows/ci.yml
  deploy:
    name: deploy
    needs: ["tests"]
    environment: production
    runs-on: ubuntu-latest
    env:
      ECR_REPOSITORY: efiler-api-production-web
      IMAGE_TAG: ${{ github.sha }}
      INFRA_REPO: tax-benefits-backend
    steps:
      - run: echo 'Tests passed.'

      - run: echo 'Starting the production deploy'

      - name: Check out code
        uses: actions/checkout@v7

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6.2.3
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Log in to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2.1.6
      - name: Build and push Docker image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        run: |
          printf "${{ secrets.GYR_EFILER_RELEASES_AWS_ACCESS_KEY_ID  }}" >> ${{ github.workspace }}/GYR_EFILER_RELEASES_AWS_ACCESS_KEY_ID
          printf "${{ secrets.GYR_EFILER_RELEASES_AWS_SECRET_ACCESS_KEY  }}" >> ${{ github.workspace }}/GYR_EFILER_RELEASES_AWS_SECRET_ACCESS_KEY
          printf "${{ secrets.RAILS_SECRET_KEY_BASE  }}" >> ${{ github.workspace }}/RAILS_SECRET_KEY_BASE
          docker build --build-arg DEPLOY_ENV=production --secret id=GYR_EFILER_RELEASES_AWS_ACCESS_KEY_ID,src=${{ github.workspace }}/GYR_EFILER_RELEASES_AWS_ACCESS_KEY_ID --secret id=GYR_EFILER_RELEASES_AWS_SECRET_ACCESS_KEY,src=${{ github.workspace }}/GYR_EFILER_RELEASES_AWS_SECRET_ACCESS_KEY --secret id=SECRET_KEY_BASE,src=${{ github.workspace }}/RAILS_SECRET_KEY_BASE -t 300080618842.dkr.ecr.us-east-1.amazonaws.com/efiler-api-production-web:${{env.IMAGE_TAG}} --platform linux/amd64 .
          docker push 300080618842.dkr.ecr.us-east-1.amazonaws.com/efiler-api-production-web:${{env.IMAGE_TAG}}

      - name: Update SSM Version Parameter
        run: |
          echo "tag:$IMAGE_TAG"
          aws ssm put-parameter \
            --name  /efiler-api/production/web/version \
            --value "$IMAGE_TAG" \
            --overwrite

      - name: Get a deployment token
        uses: actions/create-github-app-token@v3
        id: token
        with:
          app-id: ${{ secrets.DEPLOYMENT_APP_ID }}
          private-key: ${{ secrets.DEPLOYMENT_APP_KEY }}
          owner: codeforamerica
          repositories: tax-benefits-backend

      - name: Trigger infrastructure deployment
        uses: codex-/return-dispatch@v4
        id: dispatch
        with:
          token: ${{ steps.token.outputs.token }}
          # Update this to match the reference (branch, tag, or
          # commit SHA) you want to deploy.
          ref: main
          # Replace this with the name of the target repository.
          repo: tax-benefits-backend
          owner: codeforamerica
          # Replace this with the name of the workflow to call.
          workflow: deploy.yaml
          # Workflow inputs should be formatted as JSON. You can
          # pass additional inputs as needed.
          workflow_inputs: |
            {
              "environment": "efiler-api-prod",
              "config": "efiler-api.fileyourstatetaxes.org"
            }

      - name: Wait on Workflow
        uses: lucasssvaz/wait-on-workflow@v1
        id: waiter
        with:
          github-token: ${{ steps.token.outputs.token }}
          repository: codeforamerica/${{ env.INFRA_REPO }}
          workflow: ${{ steps.dispatch.outputs.run_id }}

      - name: Fail unless the workflow succeeded
        if: ${{ steps.waiter.outputs.conclusion != 'success' }}
        uses: actions/github-script@v9
        with:
          script: |
            core.setFailed('Deployment workflow completed with status: ${{ steps.waiter.outputs.conclusion }}')

      - name: Notify deploy failure on Slack
        uses: 8398a7/action-slack@v3
        if: failure()
        with:
          text: "<!subteam^S06P99RGJDS> E-filer production deploy ${{ job.status }} :angry_smiling_crying_sweating_face:"
          status: ${{ job.status }}
          fields: message,commit,author,workflow,took
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}