review-app.yml

# inspired from https://github.com/dokku/github-action/blob/master/example-workflows/review-app.yaml

name: Deploy review app

on:
  workflow_dispatch:
    inputs:
      site:
        description: 'Site to deploy in preview'
        required: true
        default: 'ecospheres'
        type: choice
        options:
          - ecospheres
          - meteo-france
          - logistique
          - defis
          - hackathon
          - simplifions
          - culture
      pr_number:
        description: 'Pull Request number to deploy'
        required: true
        type: string
  pull_request:
    types: [synchronize, closed]

jobs:
  deploy_review_app:
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.site }}
      cancel-in-progress: false
    strategy:
      max-parallel: 2
      matrix:
        site:
          - ecospheres
          - meteo-france
          - logistique
          - defis
          - hackathon
          - simplifions
          - culture
    permissions:
      deployments: write
    # Run for all PRs including forks and for manual triggers
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    steps:
      - name: Check if review app exists
        id: check_app
        continue-on-error: true
        uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
        with:
          host: ${{ secrets.REVIEW_APP_SSH_HOST }}
          username: dokku
          key: ${{ secrets.REVIEW_APP_SSH_PRIVATE_KEY }}
          port: 22
          script: apps:exists deploy-preview-${{ github.event.pull_request.number }}--${{ matrix.site }}

      - name: Set APP_EXISTS variable
        run: |
          if [ ${{ steps.check_app.outcome }} == 'success' ]; then
            echo "APP_EXISTS=true" >> $GITHUB_ENV
          else
            echo "APP_EXISTS=false" >> $GITHUB_ENV
          fi

      - name: Determine deployment strategy
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            # For manual deployment, only process the selected site
            if [ "${{ matrix.site }}" != "${{ github.event.inputs.site }}" ]; then
              echo "Skipping site ${{ matrix.site }} (not selected for manual deployment)"
              exit 0
            fi
            echo "SITE=${{ github.event.inputs.site }}" >> $GITHUB_ENV
            echo "PR_NUMBER=${{ github.event.inputs.pr_number }}" >> $GITHUB_ENV
            echo "EVENT_ACTION=manual" >> $GITHUB_ENV
            echo "SHOULD_DEPLOY=true" >> $GITHUB_ENV
            echo "SHOULD_CREATE=true" >> $GITHUB_ENV
          else
            echo "SITE=${{ matrix.site }}" >> $GITHUB_ENV
            echo "PR_NUMBER=${{ github.event.pull_request.number }}" >> $GITHUB_ENV
            echo "EVENT_ACTION=${{ github.event.action }}" >> $GITHUB_ENV
            # Set defaults (no deployment, no creation)
            echo "SHOULD_DEPLOY=false" >> $GITHUB_ENV
            echo "SHOULD_CREATE=false" >> $GITHUB_ENV

            # Override defaults based on event type
            if [ "${{ github.event.action }}" = "synchronize" ]; then
              if [ "$APP_EXISTS" = "true" ]; then
                echo "SHOULD_DEPLOY=true" >> $GITHUB_ENV
                echo "SHOULD_CREATE=false" >> $GITHUB_ENV
                echo "Review app exists, will redeploy"
              else
                echo "Review app does not exist, manual creation required"
              fi
            elif [ "${{ github.event.action }}" = "closed" ]; then
              if [ "$APP_EXISTS" = "true" ]; then
                echo "Will cleanup existing review app"
                echo "SHOULD_DESTROY=true" >> $GITHUB_ENV
              else
                echo "SHOULD_DESTROY=false" >> $GITHUB_ENV
                echo "No cleanup needed"
                exit 0
              fi
            fi
          fi

      - name: Debug event
        run: |
          echo "Event name: ${{ github.event_name }}"
          echo "Site: ${{ env.SITE }}"
          echo "PR number: ${{ env.PR_NUMBER }}"
          echo "Event action: ${{ env.EVENT_ACTION }}"
          echo "App exists: ${{ env.APP_EXISTS }}"
          echo "Should deploy: ${{ env.SHOULD_DEPLOY }}"
          echo "Should create: ${{ env.SHOULD_CREATE }}"
          echo "Should destroy: ${{ env.SHOULD_DESTROY }}"

      - name: Exit if no deployment needed (except for cleanup)
        if: env.SHOULD_DEPLOY != 'true' && env.EVENT_ACTION != 'closed'
        run: |
          echo "No deployment needed for this event, exiting"
          exit 0

      - name: Cloning repo
        if: env.SHOULD_DEPLOY == 'true'
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          fetch-depth: 0

      - name: Start deployment
        if: env.SHOULD_DEPLOY == 'true'
        uses: chrnorm/deployment-action@55729fcebec3d284f60f5bcabbd8376437d696b1 # v2.0.7
        id: deployment
        with:
          token: ${{ github.token }}
          environment: ${{ env.SITE }}-preview
          initial-status: in_progress
          transient-environment: true

      - name: Create the review app
        if: env.SHOULD_CREATE == 'true'
        uses: dokku/github-action@823c08b33e974704528c7c7f3d3d8002426e7634 # v1.9.0
        with:
          command: review-apps:create
          git_remote_url: ${{ secrets.REVIEW_APP_SSH_URL }}
          review_app_name: deploy-preview-${{ env.PR_NUMBER }}--${{ env.SITE }}
          ssh_private_key: ${{ secrets.REVIEW_APP_SSH_PRIVATE_KEY }}
          # omitting this will prevent the app from being built (which is what we want)
          # branch: 'main'

      - name: Set site id as build arg
        if: env.SHOULD_DEPLOY == 'true'
        uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
        with:
          host: ${{ secrets.REVIEW_APP_SSH_HOST }}
          username: dokku
          key: ${{ secrets.REVIEW_APP_SSH_PRIVATE_KEY }}
          port: 22
          script: |
            docker-options:add deploy-preview-${{ env.PR_NUMBER }}--${{ env.SITE }} build "--build-arg VITE_SITE_ID=${{ env.SITE }}"

      - name: Push to dokku
        if: env.SHOULD_DEPLOY == 'true'
        uses: dokku/github-action@823c08b33e974704528c7c7f3d3d8002426e7634 # v1.9.0
        with:
          git_remote_url: ${{ secrets.REVIEW_APP_SSH_URL }}
          review_app_name: deploy-preview-${{ env.PR_NUMBER }}--${{ env.SITE }}
          ssh_private_key: ${{ secrets.REVIEW_APP_SSH_PRIVATE_KEY }}
          git_push_flags: '--force'
          branch: 'main'

      - name: Enable SSL with Let's Encrypt
        if: env.SHOULD_CREATE == 'true'
        uses: appleboy/ssh-action@823bd89e131d8d508129f9443cad5855e9ba96f0 # v1.2.4
        with:
          host: ${{ secrets.REVIEW_APP_SSH_HOST }}
          username: dokku
          key: ${{ secrets.REVIEW_APP_SSH_PRIVATE_KEY }}
          port: 22
          script: |
            letsencrypt:enable deploy-preview-${{ env.PR_NUMBER }}--${{ env.SITE }}

      - name: Destroy the review app
        if: github.event.action == 'closed' && env.SHOULD_DESTROY == 'true'
        uses: dokku/github-action@823c08b33e974704528c7c7f3d3d8002426e7634 # v1.9.0
        with:
          command: review-apps:destroy
          git_remote_url: ${{ secrets.REVIEW_APP_SSH_URL }}
          review_app_name: deploy-preview-${{ env.PR_NUMBER }}--${{ env.SITE }}
          ssh_private_key: ${{ secrets.REVIEW_APP_SSH_PRIVATE_KEY }}

      - name: Update deployment status
        if: env.SHOULD_DEPLOY == 'true'
        uses: chrnorm/deployment-status@9a72af4586197112e0491ea843682b5dc280d806 # v2.0.3
        with:
          token: ${{ github.token }}
          environment-url: https://deploy-preview-${{ env.PR_NUMBER }}--${{ env.SITE }}.sandbox.data.developpement-durable.gouv.fr
          state: ${{ job.status == 'success' && 'success' || 'failure' }}
          deployment-id: ${{ steps.deployment.outputs.deployment_id }}