ci: automated GHCR + EC2 deployment with QA gating

.github/workflows/deploy.yml

@@ -0,0 +1,115 @@
+name: Deploy
+
+# Build the image, push it to GHCR, deploy to the target EC2 host over SSH, and
+# (on dev) run the QA smoke suite against the freshly deployed dev environment.
+#
+#   push to dev  -> environment "development" -> tag :dev  -> dev EC2 host  -> smoke gate
+#   push to main -> environment "production"  -> tag :prod -> prod EC2 host
+#
+# NEXT_PUBLIC_* values are baked into the image at build time, so the dev and
+# prod images differ; the values come from the selected environment's secrets.
+# The host already has a docker-compose.yml whose service image points at
+# ghcr.io/<repo>:<dev|prod>; this workflow only pulls and restarts it.
+
+on:
+  push:
+    branches: [dev, main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build-and-push:
+    name: Build & push image
+    runs-on: ubuntu-latest
+    environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'development' }}
+    steps:
+      - uses: actions/checkout@v6.0.3
+
+      - name: Clone branding repo
+        run: git clone https://github.com/CivicDataLab/ids-drr-india-branding.git ../ids-drr-india-branding
+
+      # ghcr.io image paths must be lowercase; the repo slug is mixed-case.
+      - id: meta
+        run: |
+          echo "name=${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+          echo "env_tag=${{ github.ref == 'refs/heads/main' && 'prod' || 'dev' }}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v4
+
+      - uses: docker/build-push-action@v7
+        with:
+          push: true
+          context: ..
+          file: IDS-DRR-Frontend/Dockerfile
+          target: runner
+          build-args: |
+            CONTEXT_SUBDIR=IDS-DRR-Frontend
+            BRANDING_PACKAGE=ids-drr-india-branding
+            NEXT_PUBLIC_DATA_MANAGEMENT_LAYER_URL=${{ secrets.NEXT_PUBLIC_DATA_MANAGEMENT_LAYER_URL }}
+            NEXT_PUBLIC_BACKEND_URL=${{ secrets.NEXT_PUBLIC_BACKEND_URL }}
+            NEXT_PUBLIC_TIME_PERIOD=${{ secrets.NEXT_PUBLIC_TIME_PERIOD }}
+            NEXT_PUBLIC_GOOGLE_ANALYTICS_APP_ID=${{ secrets.NEXT_PUBLIC_GOOGLE_ANALYTICS_APP_ID }}
+            NEXT_PUBLIC_GOOGLE_TRANSLATE_KEY=${{ secrets.NEXT_PUBLIC_GOOGLE_TRANSLATE_KEY }}
+            NEXT_PUBLIC_DOWNLOAD_REPORT_LINK=${{ secrets.NEXT_PUBLIC_DOWNLOAD_REPORT_LINK }}
+          tags: |
+            ghcr.io/${{ steps.meta.outputs.name }}:${{ steps.meta.outputs.env_tag }}
+            ghcr.io/${{ steps.meta.outputs.name }}:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    name: Deploy to EC2
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'development' }}
+    steps:
+      - name: Pull & restart on host
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ${{ secrets.EC2_USER }}
+          key: ${{ secrets.EC2_SSH_KEY }}
+          envs: TOKEN,REG_USER,DEPLOY_PATH,SERVICE
+          script: |
+            set -euo pipefail
+            echo "$TOKEN" | docker login ghcr.io -u "$REG_USER" --password-stdin
+            cd "$DEPLOY_PATH"
+            docker compose pull "$SERVICE"
+            docker compose up -d "$SERVICE"
+            docker image prune -f
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REG_USER: ${{ github.actor }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          SERVICE: ${{ vars.COMPOSE_SERVICE }}
+
+  dev-smoke:
+    name: Smoke (dev)
+    needs: deploy
+    if: github.ref == 'refs/heads/dev'
+    runs-on: ubuntu-latest
+    steps:
+      # Triggers IDS-DRR-QA-Automation's dispatch.yml and blocks until it
+      # finishes; this job (and its check) is green only if smoke passes.
+      - uses: convictional/trigger-workflow-and-wait@f69fa9eedd3c62a599220f4d5745230e237904be # v1.6.5
+        with:
+          owner: CivicDataLab
+          repo: IDS-DRR-QA-Automation
+          github_token: ${{ secrets.QA_REPO_PAT }}
+          workflow_file_name: dispatch.yml
+          ref: main
+          wait_interval_seconds: 30
+          client_payload: '{"scope":"smoke","target_env":"dev"}'

.github/workflows/qa-gate.yml

@@ -0,0 +1,32 @@
+name: QA Gate
+
+# Gate for promoting dev -> main. On a PR targeting main, run the full QA
+# regression suite against the dev environment and block the merge until it
+# passes. Mark the "qa-gate" check as a required status check on the main
+# branch (Settings -> Branches) so the PR cannot be merged while it is red.
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: qa-gate-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  qa-gate:
+    name: Full regression (dev)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: convictional/trigger-workflow-and-wait@f69fa9eedd3c62a599220f4d5745230e237904be # v1.6.5
+        with:
+          owner: CivicDataLab
+          repo: IDS-DRR-QA-Automation
+          github_token: ${{ secrets.QA_REPO_PAT }}
+          workflow_file_name: dispatch.yml
+          ref: main
+          wait_interval_seconds: 60
+          client_payload: '{"scope":"regression","target_env":"dev"}'

.gitignore

@@ -27,6 +27,8 @@ npm-debug.log*
 # local env files
 .env*.local
 .env
+.env.development
+.env.production
 
 # vercel
 .vercel

Dockerfile

@@ -55,8 +55,16 @@ COPY ${BRANDING_PACKAGE}/ ./branding-stub/
 
 ARG NEXT_PUBLIC_DATA_MANAGEMENT_LAYER_URL
 ARG NEXT_PUBLIC_BACKEND_URL
+ARG NEXT_PUBLIC_TIME_PERIOD
+ARG NEXT_PUBLIC_GOOGLE_ANALYTICS_APP_ID
+ARG NEXT_PUBLIC_GOOGLE_TRANSLATE_KEY
+ARG NEXT_PUBLIC_DOWNLOAD_REPORT_LINK
 ENV NEXT_PUBLIC_DATA_MANAGEMENT_LAYER_URL=$NEXT_PUBLIC_DATA_MANAGEMENT_LAYER_URL
 ENV NEXT_PUBLIC_BACKEND_URL=$NEXT_PUBLIC_BACKEND_URL
+ENV NEXT_PUBLIC_TIME_PERIOD=$NEXT_PUBLIC_TIME_PERIOD
+ENV NEXT_PUBLIC_GOOGLE_ANALYTICS_APP_ID=$NEXT_PUBLIC_GOOGLE_ANALYTICS_APP_ID
+ENV NEXT_PUBLIC_GOOGLE_TRANSLATE_KEY=$NEXT_PUBLIC_GOOGLE_TRANSLATE_KEY
+ENV NEXT_PUBLIC_DOWNLOAD_REPORT_LINK=$NEXT_PUBLIC_DOWNLOAD_REPORT_LINK
 
 RUN npm run build
 

docker-compose.yml

@@ -0,0 +1,57 @@
+# docker-compose.yml — IDS-DRR-Frontend
+#
+# Prerequisites:
+#   Clone the India branding repo as a sibling directory:
+#     git clone https://github.com/CivicDataLab/ids-drr-india-branding.git ../ids-drr-india-branding
+#
+# Env files (gitignored — create these on the server):
+#   .env.development  — dev values
+#   .env.production   — prod values
+#
+# Usage:
+#   Dev:   docker compose --env-file .env.development up dev --build
+#   Prod:  docker compose --env-file .env.production  up prod --build
+#
+# --env-file feeds ${VAR} substitutions used in build args below.
+
+x-build-common: &build-common
+  context: ..
+  dockerfile: IDS-DRR-Frontend/Dockerfile
+  args:
+    CONTEXT_SUBDIR: IDS-DRR-Frontend
+    BRANDING_PACKAGE: ids-drr-india-branding
+    NEXT_PUBLIC_DATA_MANAGEMENT_LAYER_URL: ${NEXT_PUBLIC_DATA_MANAGEMENT_LAYER_URL}
+    NEXT_PUBLIC_BACKEND_URL: ${NEXT_PUBLIC_BACKEND_URL:-}
+    NEXT_PUBLIC_TIME_PERIOD: ${NEXT_PUBLIC_TIME_PERIOD:-}
+    NEXT_PUBLIC_GOOGLE_ANALYTICS_APP_ID: ${NEXT_PUBLIC_GOOGLE_ANALYTICS_APP_ID:-}
+    NEXT_PUBLIC_GOOGLE_TRANSLATE_KEY: ${NEXT_PUBLIC_GOOGLE_TRANSLATE_KEY:-}
+    NEXT_PUBLIC_DOWNLOAD_REPORT_LINK: ${NEXT_PUBLIC_DOWNLOAD_REPORT_LINK:-}
+
+services:
+  dev:
+    build:
+      <<: *build-common
+      target: dev
+    image: ids-drr-frontend:dev
+    ports:
+      - "${PORT:-3000}:3000"
+    volumes:
+      - .:/app
+      - ../ids-drr-india-branding:/app/branding-stub
+      - /app/node_modules
+      - /app/.next
+    working_dir: /app
+    env_file:
+      - .env.development
+    command: npm run dev
+
+  prod:
+    build:
+      <<: *build-common
+      target: runner
+    image: ${GHCR_IMAGE:-ghcr.io/civicdatalab/ids-drr-frontend}:${IMAGE_TAG:-prod}
+    ports:
+      - "${PORT:-3000}:3000"
+    env_file:
+      - .env.production
+    restart: unless-stopped