release-pr-deploy.yml

name: Release PR Flow

on:
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened]

concurrency:
  group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: read
  pull-requests: write

jobs:
  notify-start:
    if: startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/')
    runs-on: ubuntu-latest
    outputs:
      slack-ts: ${{ steps.ts.outputs.ts }}
    steps:
      - name: Load secrets
        id: secrets
        uses: 1password/load-secrets-action@v4.0.0
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: '${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}'
          SLACK_BOT_TOKEN: op://kv_app_infra/SLACK_BOT_TOKEN/credential
          SLACK_CHANNEL_ID: op://kv_app_infra/SLACK_CHANNEL_ID/credential

      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 1
          sparse-checkout: |
            .github/actions/extract-slack-ts
            .github/actions/gh-pr-get-body
            .github/actions/slack-notify
            .github/workflows/scripts/slackNotify.js

      - name: Read PR body
        id: pr
        uses: ./.github/actions/gh-pr-get-body
        with:
          pr_number: ${{ github.event.pull_request.number }}
          token: ${{ github.token }}

      - name: Extract Slack TS from PR body
        id: ts
        uses: ./.github/actions/extract-slack-ts
        with:
          body: ${{ steps.pr.outputs.body }}

      - name: Notify Slack - Staging Deployment Started
        if: steps.ts.outputs.ts && steps.secrets.outputs.SLACK_BOT_TOKEN
        uses: ./.github/actions/slack-notify
        with:
          slack_bot_token: ${{ steps.secrets.outputs.SLACK_BOT_TOKEN }}
          slack_channel_id: ${{ steps.secrets.outputs.SLACK_CHANNEL_ID }}
          thread_ts: ${{ steps.ts.outputs.ts }}
          message: |
            ⏳ *Staging build & deploy started...*

  test:
    if: startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/')
    needs: notify-start
    runs-on: ubuntu-latest
    steps:
      - name: Checkout actions
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 1
          sparse-checkout: .github/actions/setup

      - name: Setup
        uses: ./.github/actions/setup
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Check types
        run: pnpm type-check

      - name: Check linter with formatter
        run: pnpm lint:check

      - name: Run tests with coverage
        run: pnpm test:coverage

  deploy:
    if: startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/')
    needs: test
    uses: ./.github/workflows/shared-deploy.yml
    secrets: inherit
    with:
      domain: 'stg.app.aragon.org'
      env: 'staging'
      ref: ${{ github.event.pull_request.head.sha }}

  notify:
    if: startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/')
    needs: [notify-start, deploy]
    runs-on: ubuntu-latest
    outputs:
      slack-ts: ${{ steps.ts.outputs.ts }}
    steps:
      - name: Load secrets
        id: secrets
        uses: 1password/load-secrets-action@v4.0.0
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: '${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}'
          SLACK_BOT_TOKEN: op://kv_app_infra/SLACK_BOT_TOKEN/credential
          SLACK_CHANNEL_ID: op://kv_app_infra/SLACK_CHANNEL_ID/credential
          ARABOT_PAT: op://kv_app_infra/ARABOT_PAT/credential
          LINEAR_API_TOKEN: op://kv_app_infra/LINEAR_API_TOKEN/credential

      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 1
          sparse-checkout: .github/actions/setup

      - name: Setup
        uses: ./.github/actions/setup
        with:
          token: ${{ github.token }}
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Generate Release Summary
        id: summary
        uses: ./.github/actions/generate-release-summary
        with:
          linear_api_token: ${{ steps.secrets.outputs.LINEAR_API_TOKEN }}

      - name: Read current PR body for latest Slack TS
        id: pr
        uses: ./.github/actions/gh-pr-get-body
        with:
          pr_number: ${{ github.event.pull_request.number }}
          token: ${{ github.token }}

      - name: Extract Slack TS
        id: ts
        uses: ./.github/actions/extract-slack-ts
        with:
          body: ${{ steps.pr.outputs.body }}

      - name: Update PR Description
        uses: ./.github/actions/gh-pr-edit-body
        with:
          pr_number: ${{ github.event.pull_request.number }}
          token: ${{ steps.secrets.outputs.ARABOT_PAT }}
          body: |
            ${{ steps.summary.outputs.summary }}

            <!-- slack_ts: ${{ steps.ts.outputs.ts }} -->

      - name: Notify Slack
        if: steps.ts.outputs.ts && steps.secrets.outputs.SLACK_BOT_TOKEN
        uses: ./.github/actions/slack-notify
        with:
          slack_bot_token: ${{ steps.secrets.outputs.SLACK_BOT_TOKEN }}
          slack_channel_id: ${{ steps.secrets.outputs.SLACK_CHANNEL_ID }}
          thread_ts: ${{ steps.ts.outputs.ts }}
          message: |
            ✅ *Staging Deployed*

            *Staging:* <https://stg.app.aragon.org|stg.app.aragon.org>
            *Commit:* <https://github.com/aragon/app/commit/${{ github.event.pull_request.head.sha }}|${{ github.event.pull_request.head.sha }}>

            Ready for testing! 🧪
            • Found bugs? Create a PR with fixes to <https://github.com/aragon/app/tree/${{ github.event.pull_request.head.ref }}|${{ github.event.pull_request.head.ref }}>
            • All good? Approve the PR and add label `release:ready` → <${{ github.event.pull_request.html_url }}|PR>

  e2e:
    if: startsWith(github.head_ref, 'release/') || startsWith(github.head_ref, 'hotfix/')
    needs: deploy
    uses: ./.github/workflows/shared-e2e.yml
    secrets: inherit
    with:
      deployment-url: https://stg.app.aragon.org
      environment: staging

  e2e-notify:
    needs: [notify, e2e]
    if: ${{ always() && needs.e2e.result != 'skipped' }}
    runs-on: ubuntu-latest
    steps:
      - name: Load secrets
        id: secrets
        uses: 1password/load-secrets-action@v4.0.0
        with:
          export-env: false
        env:
          OP_SERVICE_ACCOUNT_TOKEN: '${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}'
          SLACK_BOT_TOKEN: op://kv_app_infra/SLACK_BOT_TOKEN/credential
          SLACK_CHANNEL_ID: op://kv_app_infra/SLACK_CHANNEL_ID/credential

      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 1
          sparse-checkout: |
            .github/workflows/scripts/slackNotify.js
            .github/actions/slack-notify

      - name: Notify Slack — E2E results
        if: steps.secrets.outputs.SLACK_BOT_TOKEN && needs.notify.outputs.slack-ts
        uses: ./.github/actions/slack-notify
        with:
          slack_bot_token: ${{ steps.secrets.outputs.SLACK_BOT_TOKEN }}
          slack_channel_id: ${{ steps.secrets.outputs.SLACK_CHANNEL_ID }}
          thread_ts: ${{ needs.notify.outputs.slack-ts }}
          message: |
            ${{ needs.e2e.outputs.result == 'passed' && '✅ Smoke tests on *staging* passed' || needs.e2e.outputs.result == 'flaky' && '⚠️ Smoke tests on *staging* completed with flaky tests' || needs.e2e.outputs.result == 'failed' && '❌ Smoke tests on *staging* failed' || '⏹️ Smoke tests on *staging* were cancelled' }}
            ${{ needs.e2e.outputs.summary }}
            <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View report>