copilot_deploy.yml

name: Deploy to AWS
on:
  workflow_dispatch:
    inputs:
      environment:
        description:  Which AWS Account to use
        type: choice
        required: true
        options:
        - dev
        - test
        - uat
        - production
      run_performance_tests:
        required: false
        default: false
        type: boolean
        description: Run performance tests
      run_e2e_tests:
        required: false
        default: true
        type: boolean
        description: Run e2e tests
  push:
    # Ignore README markdown
    # Only automatically deploy when something in the app or tests folder has changed
    paths:
      - '!**/README.md'
      - 'app/**'
      - 'tests/**'
      - 'requirements-dev.in'
      - 'requirements-dev.txt'
      - 'requirements.in'
      - 'requirements.txt'
      - '.github/workflows/copilot_deploy.yml'

jobs:
  tag_version:
    runs-on: ubuntu-latest
    outputs:
      version_to_tag: ${{ steps.account_store_tagging.outputs.tag_value }}
    steps:
      - id: account_store_tagging
        run: |
          echo "tag_value=$(echo '${{ github.ref }}' | sed -e 's,.*/\(.*\),\1,')" >> $GITHUB_OUTPUT

  pre_deploy_tests:
    uses: communitiesuk/funding-service-design-workflows/.github/workflows/pre-deploy.yml@main
    with:
      # Note - no db-name, so defaults to postgres_db
      postgres_unit_testing: true

  paketo_build:
    needs: [ tag_version ]
    concurrency: build-account-store-pack
    permissions:
      packages: write
    uses: communitiesuk/funding-service-design-workflows/.github/workflows/package.yml@main
    with:
      version_to_build: ${{ needs.tag_version.outputs.version_to_tag }}
      owner: ${{ github.repository_owner }}
      application: funding-service-design-account-store

  copilot_environments_workflow_setup:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.copilot_env_matrix.outputs.env_list }}
      pre_matrix: ${{ steps.copilot_env_matrix.outputs.pre_deploy_list }}
      post_matrix: ${{ steps.copilot_env_matrix.outputs.post_deploy_list }}
    steps:
      - id: copilot_env_matrix
        run: |
          if [ "${{ inputs.environment }}" != "" ]; then
            echo "env_list=[\"${{ inputs.environment }}\"]" >> $GITHUB_OUTPUT
          elif [ "${{ github.ref }}" == 'refs/heads/main' ]; then
            echo "pre_deploy_list=[\"dev\", \"test\"]" >> $GITHUB_OUTPUT
            echo "post_deploy_list=[\"uat\", \"production\"]" >> $GITHUB_OUTPUT
          else
            echo "pre_deploy_list=[\"dev\", \"test\"]" >> $GITHUB_OUTPUT
          fi

  individual_deploy:
    if: inputs.environment != ''
    concurrency:
      group: 'fsd-preaward-copilot-individual-${{ matrix.value }}'
      cancel-in-progress: false
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read  # This is required for actions/checkout
    needs: [ tag_version, pre_deploy_tests, paketo_build, copilot_environments_workflow_setup ]
    runs-on: ubuntu-latest
    continue-on-error: true
    strategy:
      max-parallel: 1
      matrix:
        value: ${{ fromJSON(needs.copilot_environments_workflow_setup.outputs.matrix) }}
      fail-fast: false
    environment: ${{ matrix.value }}
    steps:
    - name: Git clone the repository
      uses: actions/checkout@v4

    - name: Get current date
      shell: bash
      id: currentdatetime
      run: echo "datetime=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT

    - name: configure aws credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/GithubCopilotDeploy
        role-session-name: ACCOUNT_STORE_${{ matrix.value }}_COPILOT_${{ steps.currentdatetime.outputs.datetime }}
        aws-region: eu-west-2

    - name: Install AWS Copilot CLI
      shell: bash
      run: |
        curl -Lo aws-copilot https://github.com/aws/copilot-cli/releases/latest/download/copilot-linux && chmod +x aws-copilot && sudo mv aws-copilot /usr/local/bin/copilot

    - name: confirm copilot env
      shell: bash
      run: |
        if [ $(copilot env ls) != "${{ matrix.value }}" ]; then
          echo $(copilot env ls)
          exit 1
        fi

    - name: Inject Git SHA into manifest
      run: |
        yq -i '.variables.GITHUB_SHA = "${{ github.sha }}"'  copilot/fsd-account-store/manifest.yml

    - name: Inject replacement image into manifest
      run: |
        yq -i '.image.location = "ghcr.io/communitiesuk/funding-service-design-account-store:${{ needs.tag_version.outputs.version_to_tag }}"'  copilot/fsd-account-store/manifest.yml

    - name: Run database migrations
      run: scripts/migration-task-script.py ${{ matrix.value }} fsd-account-store

    - name: Copilot ${{ matrix.value }} deploy
      id: deploy_build
      run: |
        copilot svc deploy --env ${{ matrix.value }} --app pre-award

  sandbox_deploy:
    if: ${{ needs.copilot_environments_workflow_setup.outputs.pre_matrix != '' && toJson(fromJson(needs.copilot_environments_workflow_setup.outputs.pre_matrix)) != '[]' }}
    concurrency:
      group: 'fsd-preaward-copilot-sandbox-${{ matrix.value }}'
      cancel-in-progress: false
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read  # This is required for actions/checkout
    needs: [ tag_version, pre_deploy_tests, paketo_build, copilot_environments_workflow_setup ]
    runs-on: ubuntu-latest
    continue-on-error: true
    strategy:
      max-parallel: 1
      matrix:
        value: ${{ fromJSON(needs.copilot_environments_workflow_setup.outputs.pre_matrix) }}
      fail-fast: false
    environment: ${{ matrix.value }}
    steps:
    - name: Git clone the repository
      uses: actions/checkout@v4

    - name: Get current date
      shell: bash
      id: currentdatetime
      run: echo "datetime=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT

    - name: configure aws credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/GithubCopilotDeploy
        role-session-name: ACCOUNT_STORE_${{ matrix.value }}_COPILOT_${{ steps.currentdatetime.outputs.datetime }}
        aws-region: eu-west-2

    - name: Install AWS Copilot CLI
      shell: bash
      run: |
        curl -Lo aws-copilot https://github.com/aws/copilot-cli/releases/latest/download/copilot-linux && chmod +x aws-copilot && sudo mv aws-copilot /usr/local/bin/copilot

    - name: confirm copilot env
      shell: bash
      run: |
        if [ $(copilot env ls) != "${{ matrix.value }}" ]; then
          echo $(copilot env ls)
          exit 1
        fi

    - name: Inject Git SHA into manifest
      run: |
        yq -i '.variables.GITHUB_SHA = "${{ github.sha }}"'  copilot/fsd-account-store/manifest.yml

    - name: Inject replacement image into manifest
      run: |
        yq -i '.image.location = "ghcr.io/communitiesuk/funding-service-design-account-store:${{ needs.tag_version.outputs.version_to_tag }}"'  copilot/fsd-account-store/manifest.yml

    - name: Run database migrations
      run: scripts/migration-task-script.py ${{ matrix.value }} fsd-account-store

    - name: Copilot ${{ matrix.value }} deploy
      id: deploy_build
      run: |
        copilot svc deploy --env ${{ matrix.value }} --app pre-award

  # Can we realistically run E2E at this stage, or just plump for application on the grounds it checks account-store is operational?
  post_deploy_tests:
      needs: sandbox_deploy
      if: inputs.environment == 'test' || inputs.environment == 'dev' || inputs.environment == ''
      secrets:
        FSD_GH_APP_ID: ${{ secrets.FSD_GH_APP_ID }}
        FSD_GH_APP_KEY: ${{ secrets.FSD_GH_APP_KEY }}
      uses: communitiesuk/funding-service-design-workflows/.github/workflows/post-deploy.yml@main
      with:
        run_performance_tests: ${{ inputs.run_performance_tests || false }}
        run_e2e_tests: ${{ inputs.run_e2e_tests || true }}
        app_name: application
        environment: ${{ inputs.environment == '' && 'test' || inputs.environment }}

  release_deploy:
    if: ${{ needs.copilot_environments_workflow_setup.outputs.post_matrix != '' && toJson(fromJson(needs.copilot_environments_workflow_setup.outputs.post_matrix)) != '[]' }}
    concurrency:
      group: 'fsd-preaward-copilot-release-${{ matrix.value }}'
      cancel-in-progress: false
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read  # This is required for actions/checkout
    needs: [ tag_version, post_deploy_tests, paketo_build, copilot_environments_workflow_setup ]
    runs-on: ubuntu-latest
    continue-on-error: true
    strategy:
      max-parallel: 1
      matrix:
        value: ${{ fromJSON(needs.copilot_environments_workflow_setup.outputs.post_matrix) }}
      fail-fast: false
    environment: ${{ matrix.value }}
    steps:
    - name: Git clone the repository
      uses: actions/checkout@v4

    - name: Get current date
      shell: bash
      id: currentdatetime
      run: echo "datetime=$(date +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT

    - name: configure aws credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT }}:role/GithubCopilotDeploy
        role-session-name: ACCOUNT_STORE_${{ matrix.value }}_COPILOT_${{ steps.currentdatetime.outputs.datetime }}
        aws-region: eu-west-2

    - name: Install AWS Copilot CLI
      shell: bash
      run: |
        curl -Lo aws-copilot https://github.com/aws/copilot-cli/releases/latest/download/copilot-linux && chmod +x aws-copilot && sudo mv aws-copilot /usr/local/bin/copilot

    - name: confirm copilot env
      shell: bash
      run: |
        if [ $(copilot env ls) != "${{ matrix.value }}" ]; then
          echo $(copilot env ls)
          exit 1
        fi

    - name: Inject Git SHA into manifest
      run: |
        yq -i '.variables.GITHUB_SHA = "${{ github.sha }}"'  copilot/fsd-account-store/manifest.yml

    - name: Inject replacement image into manifest
      run: |
        yq -i '.image.location = "ghcr.io/communitiesuk/funding-service-design-account-store:${{ needs.tag_version.outputs.version_to_tag }}"'  copilot/fsd-account-store/manifest.yml

    - name: Run database migrations
      run: scripts/migration-task-script.py ${{ matrix.value }} fsd-account-store

    - name: Copilot ${{ matrix.value }} deploy
      id: deploy_build
      run: |
        copilot svc deploy --env ${{ matrix.value }} --app pre-award