deploy-mainnet.yml

name: Deploy to Mainnet

on:
  workflow_dispatch:
    inputs:
      confirm:
        description: 'Type "deploy-mainnet" to confirm'
        required: true
      audit_complete:
        description: 'Security audit complete? (yes/no)'
        required: true

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: us-east-1
  NETWORK: mainnet

jobs:
  validate-prerequisites:
    name: Validate Prerequisites
    runs-on: ubuntu-latest
    steps:
      - name: Validate confirmation
        if: github.event.inputs.confirm != 'deploy-mainnet'
        run: |
          echo "❌ Confirmation required"
          exit 1

      - name: Validate security audit
        if: github.event.inputs.audit_complete != 'yes'
        run: |
          echo "❌ Security audit must be complete"
          exit 1

      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.0

      - name: Install dependencies
        run: bun install

      - name: Run security checks (CRITICAL for mainnet)
        env:
          DEPLOYER_PRIVATE_KEY: ${{ secrets.DEPLOYER_PRIVATE_KEY }}
        run: bun run packages/deployment/scripts/verify/security-checks.ts mainnet

      - name: Validate configurations
        run: bun run infra:validate

  deploy-infrastructure:
    name: Deploy Infrastructure
    runs-on: ubuntu-latest
    needs: validate-prerequisites
    environment: mainnet
    outputs:
      eks-cluster: ${{ steps.output.outputs.eks_cluster_name }}
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2
      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.6.0

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_MAINNET }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Install dependencies
        run: bun install

      - name: Terraform Plan
        run: |
          cd packages/deployment
          NETWORK=mainnet bun run infra:plan

      - name: Terraform Apply
        run: |
          cd packages/deployment
          NETWORK=mainnet bun run infra:apply

      - name: Get outputs
        id: output
        run: |
          cd packages/deployment/terraform/environments/mainnet
          echo "eks_cluster_name=$(terraform output -raw eks_cluster_name)" >> $GITHUB_OUTPUT

  build-and-push:
    name: Build Images
    runs-on: ubuntu-latest
    needs: validate-prerequisites
    strategy:
      matrix:
        app: [bazaar, gateway, documentation, indexer, compute, monitoring, storage]
    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_MAINNET }}
          aws-region: ${{ env.AWS_REGION }}

      - uses: aws-actions/amazon-ecr-login@v2
        id: login-ecr

      - uses: docker/setup-buildx-action@v3

      - name: Build and push ${{ matrix.app }}
        uses: docker/build-push-action@v5
        with:
          context: ./apps/${{ matrix.app }}
          file: ./apps/${{ matrix.app }}/Dockerfile
          push: true
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/jeju/${{ matrix.app }}:mainnet-${{ github.sha }}
            ${{ steps.login-ecr.outputs.registry }}/jeju/${{ matrix.app }}:mainnet-latest
          platforms: linux/amd64

  build-sqlit:
    name: Build SQLIT (Multi-Arch)
    runs-on: ubuntu-latest
    needs: validate-prerequisites
    steps:
      - uses: actions/checkout@v4
      
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_MAINNET }}
          aws-region: ${{ env.AWS_REGION }}

      - uses: aws-actions/amazon-ecr-login@v2
        id: login-ecr

      - uses: docker/setup-buildx-action@v3
      
      - name: Set up QEMU for multi-arch
        uses: docker/setup-qemu-action@v3

      - name: Build and push SQLIT
        uses: docker/build-push-action@v5
        with:
          context: ./packages/deployment/docker/sqlit
          file: ./packages/deployment/docker/sqlit/Dockerfile
          push: true
          tags: |
            ${{ steps.login-ecr.outputs.registry }}/jeju/sqlit:mainnet-${{ github.sha }}
            ${{ steps.login-ecr.outputs.registry }}/jeju/sqlit:mainnet-latest
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

  deploy-kubernetes:
    name: Deploy to Kubernetes
    runs-on: ubuntu-latest
    needs: [build-and-push, build-sqlit, deploy-infrastructure]
    environment: mainnet
    steps:
      - uses: actions/checkout@v4
      - uses: oven-sh/setup-bun@v2

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN_MAINNET }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Install dependencies
        run: bun install

      - name: Configure kubectl
        run: |
          aws eks update-kubeconfig \
            --name ${{ needs.deploy-infrastructure.outputs.eks-cluster }} \
            --region ${{ env.AWS_REGION }}

      - name: Install Helmfile
        run: |
          wget -q https://github.com/helmfile/helmfile/releases/download/v0.162.0/helmfile_0.162.0_linux_amd64.tar.gz
          tar -xzf helmfile_0.162.0_linux_amd64.tar.gz
          sudo mv helmfile /usr/local/bin/

      - name: Deploy with Helmfile
        run: |
          cd packages/deployment
          NETWORK=mainnet bun run k8s:deploy

      - name: Wait for rollout
        run: |
          kubectl rollout status deployment/bazaar -n jeju-apps --timeout=15m
          kubectl rollout status deployment/gateway -n jeju-apps --timeout=15m

  verify:
    name: Verify Deployment
    runs-on: ubuntu-latest
    needs: deploy-kubernetes
    steps:
      - uses: actions/checkout@v4
      - uses: foundry-rs/foundry-toolchain@v1

      - name: Health checks
        run: |
          cast block latest --rpc-url https://rpc.jejunetwork.org
          echo "✅ Mainnet RPC responding"

      - name: Notify success
        run: echo "✅ Mainnet deployment complete"