cd-analytics.yml

name: Deploy Analytics
run-name: Deploy ${{ inputs.version || 'main' }} to Analytics ${{ inputs.environment || 'nonprod' }}

on:
  push:
    branches:
      - "main"
    paths:
      - "analytics/**"
      - "infra/analytics/**"
      - "infra/modules/**"
  # Release deployments are handled by cd-release.yml to enforce deployment order
  # (API -> Frontend -> NOFOs -> Analytics)
  workflow_dispatch:
    inputs:
      environment:
        description: Environment to deploy to
        required: true
        default: "dev"
        type: choice
        options:
          - dev
          - staging
          - training
          - grantee1
          - prod
      version:
        required: true
        default: "main"
        description: Tag or branch or SHA to deploy

jobs:
  analytics-checks:
    name: Run Analytics Checks
    uses: ./.github/workflows/ci-analytics.yml
    secrets: inherit

  vulnerability-scans:
    name: Vulnerability Scans
    uses: ./.github/workflows/vulnerability-scans.yml
    with:
      app_name: analytics
      fail_on_vulns: ${{ ! contains(fromJSON(inputs.environment != null && format('["{0}"]', inputs.environment) || github.ref_name == 'main' && '["staging"]' || '["dev"]'), 'staging') }}

  deploy:
    name: Deploy
    needs: [analytics-checks, vulnerability-scans]
    uses: ./.github/workflows/deploy.yml
    strategy:
      max-parallel: 1
      fail-fast: false
      matrix:
        envs: ${{ fromJSON(inputs.environment != null && format('["{0}"]', inputs.environment) || github.ref_name == 'main' && '["staging"]' || '["dev"]')  }}
    with:
      app_name: "analytics"
      environment: ${{ matrix.envs }}
      version: ${{ inputs.version || github.ref }}

  send-slack-notification:
    if: failure() && (github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/main'))
    needs: [analytics-checks, vulnerability-scans, deploy]
    uses: ./.github/workflows/send-slack-notification.yml
    secrets: inherit