synth.yml

name: Synth NineChronicles.IAP CDK Stack

# environment secrets cannot be inherited from caller workflow to reusable workflow.
#  I think this is HORRIBLE design
#  https://github.com/actions/runner/issues/1490
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
    secrets:
      ACCOUNT_ID:
        required: true
      AWS_ACCESS_KEY_ID:
        required: true
      AWS_SECRET_ACCESS_KEY:
        required: true
      KMS_KEY_ID:
        required: true
      ADHOC_KMS_KEY_ID:
        required: true
      GOOGLE_CREDENTIAL:
        required: true
      APPLE_CREDENTIAL:
        required: true
      APPLE_KEY_ID:
        required: true
      APPLE_ISSUER_ID:
        required: true
      SLACK_WEBHOOK_URL:
        required: true
      IAP_GARAGE_WEBHOOK_URL:
        required: true
      IAP_ALERT_WEBHOOK_URL:
        required: true
      GOLDEN_DUST_REQUEST_SHEET_ID:
        required: true
      GOLDEN_DUST_WORK_SHEET_ID:
        required: true
      SEASON_PASS_JWT_SECRET:
        required: true
      VOUCHER_URL:
        required: true
      VOUCHER_JWT_SECRET:
        required: true
      BRIDGE_DATA:
        required: true
      REFUND_SHEET_ID:
        required: true
      HEADLESS_GQL_JWT_SECRET:
        required: true

jobs:
  synth:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    outputs:
      url: ${{ steps.deployment.outputs.SERVICE_HOST }}
    steps:
      - uses: actions/checkout@v3

      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.10"

      - name: Setup Node.JS
        uses: actions/setup-node@v3
        with:
          node-version: 18

      - name: Install Poetry
        uses: snok/install-poetry@v1
        with:
          version: 1.8.4
          virtualenvs-in-project: true

      - name: Cache Poetry
        id: cache-poetry
        uses: actions/cache@v3
        with:
          path: .venv
          key: poetry-${{ runner.os }}-${{ hashFiles('poetry.lock') }}

      - name: Cache node_modules
        id: cache-node
        uses: actions/cache@v3
        with:
          path: iap/frontend/node_modules
          key: poetry-${{ runner.os }}-${{ hashFiles('iap/frontend/yarn.lock') }}

      - name: Install dependencies
        run: |
          poetry install
          pushd iap/frontend
          yarn install
          popd
          yarn add aws-cdk

      - name: Build IAP Layer
        run: |
          pushd iap
          poetry export --with=iap --without-hashes -o requirements.txt
          pip install -r requirements.txt -t layer/python/lib/python3.10/site-packages/
          pip install --platform manylinux2014_x86_64 --only-binary=:all: cryptography -t layer/python/lib/python3.10/site-packages/ --upgrade
          popd

      - name: Build Worker Layer
        run: |
          pushd worker
          poetry export --with=worker --without-hashes -o requirements.txt
          pip install -r requirements.txt -t layer/python/lib/python3.10/site-packages/
          popd

      - name: Synth stack
        env:
          STAGE: ${{ github.ref == 'refs/heads/preview' && 'preview' || vars.STAGE }}
          REGION_NAME: ${{ vars.REGION_NAME }}
          ACCOUNT_ID: ${{ secrets.ACCOUNT_ID }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          HEADLESS: ${{ vars.HEADLESS }}
          ODIN_GQL_URL: ${{ vars.ODIN_GQL_URL }}
          HEIMDALL_GQL_URL: ${{ vars.HEIMDALL_GQL_URL }}
          THOR_GQL_URL: ${{ vars.THOR_GQL_URL }}
          KMS_KEY_ID: ${{ secrets.KMS_KEY_ID }}
          ADHOC_KMS_KEY_ID: ${{ secrets.ADHOC_KMS_KEY_ID }}
          GOOGLE_CREDENTIAL: ${{ secrets.GOOGLE_CREDENTIAL }}
          GOOGLE_PACKAGE_NAME: ${{ vars.GOOGLE_PACKAGE_NAME }}
          APPLE_BUNDLE_ID: ${{ vars.APPLE_BUNDLE_ID }}
          APPLE_VALIDATION_URL: ${{ vars.APPLE_VALIDATION_URL }}
          APPLE_CREDENTIAL: ${{ secrets.APPLE_CREDENTIAL }}
          APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
          APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}
          IAP_GARAGE_WEBHOOK_URL: ${{ secrets.IAP_GARAGE_WEBHOOK_URL }}
          IAP_ALERT_WEBHOOK_URL: ${{ secrets.IAP_ALERT_WEBHOOK_URL }}
          GOLDEN_DUST_REQUEST_SHEET_ID: ${{ secrets.GOLDEN_DUST_REQUEST_SHEET_ID }}
          GOLDEN_DUST_WORK_SHEET_ID: ${{ secrets.GOLDEN_DUST_WORK_SHEET_ID }}
          FORM_SHEET: ${{ vars.FORM_SHEET }}
          CDN_HOST: ${{ vars.CDN_HOST }}
          CDN_HOST_K: ${{ vars.CDN_HOST_K }}
          PLANET_URL: ${{ vars.PLANET_URL }}
          SEASON_PASS_JWT_SECRET: ${{ secrets.SEASON_PASS_JWT_SECRET }}
          VOUCHER_URL: ${{ secrets.VOUCHER_URL }}
          VOUCHER_JWT_SECRET: ${{ secrets.VOUCHER_JWT_SECRET }}
          BRIDGE_DATA: ${{ secrets.BRIDGE_DATA }}
          REFUND_SHEET_ID : ${{ secrets.REFUND_SHEET_ID }}
          HEADLESS_GQL_JWT_SECRET: ${{ secrets.HEADLESS_GQL_JWT_SECRET }}
        run: |
          source $VENV
          yarn cdk synth

  slack_notification:
    uses: ./.github/workflows/slack_message.yml
    needs: synth
    if: ${{ failure() }}
    with:
      environment: ${{ inputs.environment }}
    secrets:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}