deploy.yml

name: "Deploy"

concurrency:
  group: ${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  merge_group:

permissions:
  contents: read
  packages: write
  pull-requests: write
  security-events: write

jobs:
  brakeman:
    name: Brakeman
    uses: ./.github/workflows/brakeman.yml

    permissions:
      actions: read
      contents: read
      pull-requests: write
      security-events: write

  lint:
    name: Lint
    uses: ./.github/workflows/lint.yml

  rspec:
    name: RSpec
    uses: ./.github/workflows/rspec.yml

  all-checks-passed:
    name: All checks passed
    needs: [brakeman, lint, rspec]
    runs-on: ubuntu-latest
    steps:
      - run: "echo 'Security checks, linting tests passed, this branch is ready to be merged'"

  docker:
    name: Build and push Docker image
    runs-on: ubuntu-latest
    outputs:
      docker-image-tag: ${{ steps.build-docker-image.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: DFE-Digital/github-actions/build-docker-image@master
        id: build-docker-image
        with:
          docker-repository: ghcr.io/dfe-digital/register-early-career-teachers-public
          github-token: ${{ secrets.GITHUB_TOKEN }}
          snyk-token: ${{ secrets.SNYK_TOKEN }}

  deploy-review:
    name: Deploy review
    concurrency: deploy_review_${{ github.event.pull_request.number }}
    if: github.actor != 'dependabot[bot]' && github.event_name == 'pull_request'
    needs: docker
    runs-on: ubuntu-latest
    environment:
      name: review
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: ./.github/actions/deploy-environment-to-aks
        id: deploy
        with:
          environment: review
          docker-image-tag: ${{ needs.docker.outputs.docker-image-tag }}
          azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
          pull-request-number: ${{ github.event.pull_request.number }}
          commit-sha: ${{ github.event.pull_request.head.sha }}

      - name: Post sticky pull request comment
        if: github.event_name == 'pull_request'
        uses: marocchino/sticky-pull-request-comment@v2
        with:
          message: |
            Review app deployed to ${{ steps.deploy.outputs.url }}

  deploy-nonprod:
    name: Deploy to ${{ matrix.environment }} environment
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    concurrency: deploy_${{ matrix.environment }}
    needs: [docker, all-checks-passed]
    strategy:
      max-parallel: 1
      matrix:
        environment: [staging, sandbox]
    environment:
      name: ${{ matrix.environment }}
      url: ${{ steps.deploy.outputs.environment_url }}
    outputs:
      environment_url: ${{ steps.deploy.outputs.environment_url }}
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: ./.github/actions/deploy-environment-to-aks
        id: deploy
        with:
          environment: ${{ matrix.environment }}
          docker-image-tag: ${{ needs.docker.outputs.docker-image-tag }}
          azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
          statuscake-api-token: ${{ secrets.STATUSCAKE_API_TOKEN }}
          commit-sha: ${{ github.sha }}

  deploy-production:
    name: Deploy production
    needs: [deploy-nonprod]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    environment:
      name: production
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: ./.github/actions/deploy-environment-to-aks
        id: deploy
        with:
          environment: production
          docker-image-tag: ${{ needs.docker.outputs.docker-image-tag }}
          azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
          statuscake-api-token: ${{ secrets.STATUSCAKE_API_TOKEN }}
          commit-sha: ${{ github.sha }}