deploy.yml

name: Deploy to demo server

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
  workflow_dispatch:
    inputs:
      environment:
        description: Environment to deploy
        type: environment
        required: true

jobs:
  build:
    name: Build or fetch and upload
    runs-on: ubuntu-latest
    steps:
      - name: Check out
        uses: actions/checkout@v4
      - name: Use Node.js 24.x
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: yarn
      - name: Install
        if: inputs.environment == 'staging'
        run: yarn --immutable
      - name: Build plugin
        if: inputs.environment == 'staging'
        run: |
          JB_NPM=false yarn build
          cp dist/jbrowse-plugin-apollo.umd.development.js dist/apollo.js
        working-directory: packages/jbrowse-plugin-apollo
      - name: Fetch plugin
        if: inputs.environment == 'prod'
        working-directory: packages/jbrowse-plugin-apollo
        run: |
          mkdir --parents dist
          cd dist/
          wget --output-document=- --quiet https://registry.npmjs.org/@apollo-annotation/jbrowse-plugin-apollo/ > jpa.json
          LATEST_VERSION=$(jq --raw-output '."dist-tags".latest' jpa.json)
          TARBALL=$(jq --raw-output ".versions.\"${LATEST_VERSION}\".dist.tarball" jpa.json)
          wget --output-document=- --quiet ${TARBALL} | \
            tar --extract --gzip --file=- --strip=2 package/dist/jbrowse-plugin-apollo.umd.production.min.js
          cp jbrowse-plugin-apollo.umd.production.min.js apollo.js
      - name: Upload built plugin files
        uses: actions/upload-artifact@v4
        with:
          name: plugin
          path: packages/jbrowse-plugin-apollo/dist/apollo.js
  deploy:
    name: Deploy to ${{ inputs.environment }} demo server
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    needs: [build]
    steps:
      - name: Check out
        uses: actions/checkout@v4
      - name: Download built plugin files
        uses: actions/download-artifact@v4
        with:
          name: plugin
          path: .github/workflows/deploy/
      - name: Download JBrowse ZIP
        run: |
          if [[ ${{ inputs.environment }} == prod ]]; then
            curl -fsSL https://s3.amazonaws.com/jbrowse.org/code/jb2/latest/jbrowse-web-latest.zip > jbrowse-web.zip
          else
            curl -fsSL https://s3.amazonaws.com/jbrowse.org/code/jb2/main/jbrowse-web-main.zip > jbrowse-web.zip
          fi
        working-directory: .github/workflows/deploy
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1
      - name: Get instance address
        id: ec2-describe-instances
        run: |
          INSTANCE_ADDRESS=$(aws ec2 describe-instances \
            --instance-ids ${{ vars.INSTANCE_ID }} \
            --query "Reservations[*].Instances[*].[PublicDnsName]" \
            --output text)
          echo "INSTANCE_ADDRESS=$INSTANCE_ADDRESS" >> "$GITHUB_OUTPUT"
      - name: Set up SSH
        run: |
          mkdir --parents ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY  }}" >  ~/.ssh/${{ inputs.environment }}
          chmod 600 ~/.ssh/${{ inputs.environment }}
          cat >>~/.ssh/config <<END
          Host ${{ inputs.environment }}
            HostName ${{ steps.ec2-describe-instances.outputs.INSTANCE_ADDRESS }}
            User ec2-user
            IdentityFile ~/.ssh/${{ inputs.environment }}
          END
          ssh-keyscan -H ${{ steps.ec2-describe-instances.outputs.INSTANCE_ADDRESS }} >> ~/.ssh/known_hosts
      - name: Create Docker context
        run: |
          docker context create ${{ inputs.environment }} \
            --docker host=ssh://${{ inputs.environment }} \
            --description "${{ inputs.environment }} server"
      - name: Log in to the GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Deploy
        env:
          JWT_SECRET: ${{ secrets.JWT_SECRET }}
          SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
          GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
          GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
          ROOT_USER_PASSWORD: ${{ secrets.ROOT_USER_PASSWORD }}
          URL: ${{ vars.URL }}
          DOCKER_TAG: ${{ vars.DOCKER_TAG }}
          ENVIRONMENT: ${{ inputs.environment }}
          PORT: ${{ vars.PORT }}
        working-directory: .github/workflows/deploy
        run: |
          docker --context ${{ inputs.environment }} compose --project-name apollo-demo-${{ inputs.environment }}-site down
          docker --context ${{ inputs.environment }} compose --project-name apollo-demo-${{ inputs.environment }}-site pull
          docker --context ${{ inputs.environment }} compose --project-name apollo-demo-${{ inputs.environment }}-site up --build --detach --wait --wait-timeout 120