deploy-oneid-core.yml

name: Deploy Oneid Core

on:
  push:
    branches:
      - "main"
    paths:
      - ".github/workflows/deploy-oneid-core.yml"
      - "**/src/oneid/oneid-ecs-core/**/CHANGELOG.md"
      - "**/src/oneid/oneid-common/**/CHANGELOG.md"
  workflow_dispatch:
    inputs:
      environment:
        description: "Choose environment"
        type: choice
        required: true
        default: dev
        options:
          - dev
          - uat
          - prod
jobs:
  setup:
    runs-on: ubuntu-22.04
    outputs:
      matrix: ${{ steps.setmatrix.outputs.matrix }}

    steps:
      - name: Set Dynamic Env Matrix
        id: setmatrix
        run: |
          echo "github.ref $GITHUB_REF"
          echo "event name $EVENT_NAME"


          if [ "$EVENT_NAME" == "workflow_dispatch" ]; then
            if [ "$INPUTS_ENVIRONMENT" == "prod" ]; then
              matrixStringifiedObject="{\"include\":[{\"environment\":\"prod\", \"region\":\"eu-south-1\"}, {\"environment\":\"prod\", \"region\":\"eu-central-1\"}]}"
            else
              matrixStringifiedObject="{\"include\":[{\"environment\":\"$INPUTS_ENVIRONMENT\", \"region\":\"eu-south-1\"}]}"
            fi
          else
            matrixStringifiedObject="{\"include\":[{\"environment\":\"dev\", \"region\":\"eu-south-1\"}, {\"environment\":\"uat\", \"region\":\"eu-south-1\"}, {\"environment\":\"prod\", \"region\":\"eu-south-1\"}, {\"environment\":\"prod\", \"region\":\"eu-central-1\"}]}"
          fi

          echo "matrix=$matrixStringifiedObject" >> $GITHUB_OUTPUT
        env:
          GITHUB_REF: ${{ github.ref }}
          EVENT_NAME: ${{ github.event_name }}
          INPUTS_ENVIRONMENT: ${{ github.event.inputs.environment }}

  deploy:
    name: Deploy on ECS ${{ matrix.environment }}-${{ matrix.region }}
    if: ${{ needs.setup.outputs.matrix != '' }}
    needs: setup
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: read
    strategy:
      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}

    continue-on-error: false
    environment: ${{ matrix.environment == 'prod' && format('{0}/{1}', matrix.environment, matrix.region) || matrix.environment }}
    env:
      AWS_REGION: ${{ matrix.region }}
      ENV_SHORT: ${{ fromJSON('{"dev":"d","uat":"u","prod":"p"}')[matrix.environment] }}
      REGION_SHORT: ${{ fromJSON('{"eu-south-1":"es-1","eu-central-1":"ec-1"}')[matrix.region] }}

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 https://github.com/actions/checkout/releases/tag/v4.2.2

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 https://github.com/aws-actions/configure-aws-credentials/releases/tag/v4.0.2
        with:
          role-to-assume: ${{ vars.IAM_ROLE_DEPLOY_ECS }}
          aws-region: ${{ matrix.region }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1 https://github.com/aws-actions/amazon-ecr-login/releases/tag/v2.0.1

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1 https://github.com/docker/setup-buildx-action/releases/tag/v3.7.1

      - name: Cache Docker layers
        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 https://github.com/actions/cache/releases/tag/v4.2.0
        id: cache
        with:
          path: build-cache-core
          key: buildx-${{ env.ENV_SHORT }}-${{ hashFiles('src/oneid/oneid-ecs-core/pom.xml', 'src/oneid/oneid-common/pom.xml', 'src/oneid/pom.xml') }}
          restore-keys: |
            buildx-${{ env.ENV_SHORT }}-

      - name: inject buildx-qgs into docker
        uses: reproducible-containers/buildkit-cache-dance@5b6db76d1da5c8b307d5d2e0706d266521b710de # v3.1.2 https://github.com/reproducible-containers/buildkit-cache-dance/releases/tag/v3.1.2
        with:
          cache-map: |
            {
              "build-cache-core": {"target": "/tmp/.build-cache", "uid": "1001", "gid": "1001"}
            }
          skip-extraction: ${{ steps.cache.outputs.cache-hit }}

      - name: Set up Maven settings.xml
        shell: bash
        env:
          GH_TOKEN_READ_PACKAGES: ${{ secrets.GH_TOKEN_READ_PACKAGES }}
          GH_TOKEN_READ_PACKAGES_USER: ${{ secrets.GH_TOKEN_READ_PACKAGES_USER }}
        run: |
          echo "<settings><servers><server><id>github</id><username>${GH_TOKEN_READ_PACKAGES_USER}</username><password>${GH_TOKEN_READ_PACKAGES}</password></server></servers></settings>" >> src/oneid/settings.xml

      - name: Build, tag, and push image to Amazon ECR
        id: build-image
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0 https://github.com/docker/build-push-action/releases/tag/v6.9.0
        with:
          context: ./src/oneid/

          provenance: false
          push: true
          tags: |
            ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }}:${{ github.sha }}
            ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }}:latest
          file: src/oneid/oneid-ecs-core/Dockerfile
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Download task definition
        run: |
          aws ecs describe-task-definition \
          --task-definition oneid-$REGION_SHORT-$ENV_SHORT-core  \
          --query taskDefinition > ./task-definition.json
          echo $(cat ./task-definition.json | jq 'del(
                  .taskDefinitionArn,
                  .requiresAttributes,
                  .compatibilities,
                  .revision,
                  .status,
                  .registeredAt,
                  .registeredBy
              )') > ./task-definition.json
        env:
          REGION_SHORT: ${{ env.REGION_SHORT }}
          ENV_SHORT: ${{ env.ENV_SHORT }}

      - name: Fill in the new image ID in the Amazon ECS task definition
        id: task-def
        uses: aws-actions/amazon-ecs-render-task-definition@4225e0b507142a2e432b018bc3ccb728559b437a # v1.2.0 https://github.com/aws-actions/amazon-ecs-render-task-definition/releases/tag/v1.2.0
        with:
          task-definition: ./task-definition.json
          container-name: oneid-core
          image: "${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }}:${{ github.sha }}"

      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@0e82244a9c6dac43d70151a94c67ebc4bab18fc5 # v2.2.0 https://github.com/aws-actions/amazon-ecs-deploy-task-definition/releases/tag/v2.2.0
        with:
          task-definition: ${{ steps.task-def.outputs.task-definition }}
          service: oneid-${{ env.REGION_SHORT }}-${{ env.ENV_SHORT }}-core
          cluster: oneid-${{ env.REGION_SHORT }}-${{ env.ENV_SHORT }}-ecs
          wait-for-service-stability: true

  # release:
  #   name: "Create Release"
  #   if: ${{ needs.build.outputs.matrix != '' }}
  #   needs: [build, deploy]
  #   runs-on: ubuntu-22.04
  #   strategy:
  #     matrix: ${{ fromJson(needs.build.outputs.matrix) }}
  #   environment: ${{ matrix.environment }}

  #   steps:
  #     - action: actions/checkout@v4
  #     - name: Release
  #       if: ${{ matrix.environment == 'prod' }}
  #       id: release
  #       # from https://github.com/cycjimmy/semantic-release-action/commits/main
  #       action: cycjimmy/semantic-release-action@v4.1.0
  #       with:
  #         semantic_version: 18.0.0
  #         extra_plugins: |
  #           @semantic-release/release-notes-generator@10.0.3
  #           @semantic-release/git@10.0.1
  #       env:
  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}