publish-infra.yml

name: Publish Infra

on:
  # PR targeting master is created or new commits are pushed
  push:
    branches:
      - master
    paths:
      - "infrastructure/**"

  # Manual trigger via GH Actions UI
  workflow_dispatch:
    inputs:
      environment:
        description: "Select target environment"
        required: true
        default: "dev"
        type: choice
        options:
          - dev
          - test
          - prod
      run_initial:
        description: "Run initial Terraform setup?"
        required: false
        default: "No"
        type: choice
        options:
          - "No"
          - "Yes"

jobs:
  initial:
    if: ${{ inputs.run_initial == 'Yes' }}
    uses: ./.github/workflows/aws-template-terraform.yml
    with:
      CONTEXT_FOLDER: "./infrastructure/cloud/environments/initial"
      TF_VARS_CONFIG_FOLDER: "../${{ inputs.environment || 'dev' }}"
      CHANGE_FOLDER_NAME: environments/${{ inputs.environment }}
      ENVIRONMENT_NAME: ${{ inputs.environment || 'dev' }}
      APPLY_TF_CODE: true
    secrets: inherit

  post-initial:
    runs-on: ubuntu-latest
    needs: initial
    if: ${{ inputs.run_initial == 'Yes' }}
    environment: ${{ inputs.environment }}
    permissions:
      id-token: write
      packages: write
    env:
      DUMMY_IMAGE_NAME: dummy-image
      GITHUB_IMAGE_REPO: ghcr.io/bcgov/jasper
      APP_ECR_REPO_URL: ${{ vars.AWS_ACCOUNT }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/${{ vars.APP_NAME }}-app-repo-${{ inputs.environment }}
      LAMBDA_ECR_REPO_URL: ${{ vars.AWS_ACCOUNT }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/${{ vars.APP_NAME }}-lambda-repo-${{ inputs.environment }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Image Metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ${{ env.GITHUB_IMAGE_REPO }}/${{ env.DUMMY_IMAGE_NAME }}
          tags: |
            type=raw,value=latest

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: docker

      - name: Build ${{ env.DUMMY_IMAGE_NAME }} image
        uses: docker/build-push-action@v6
        with:
          push: true
          file: ./docker/dummy-image/Dockerfile.release
          context: .
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-skip-session-tagging: true
          aws-region: ${{ vars.AWS_REGION }}
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          role-duration-seconds: 1800
          role-session-name: ci-deployment

      - name: Login to Amazon ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Push dummy images to App ECR
        shell: bash
        run: |
          echo 'Deploying ${{ env.DUMMY_IMAGE_NAME }} to App ECR'
          docker tag  ${{ env.GITHUB_IMAGE_REPO }}/${{ env.DUMMY_IMAGE_NAME }}:latest ${{ env.APP_ECR_REPO_URL }}:${{ env.DUMMY_IMAGE_NAME }}
          docker push ${{ env.APP_ECR_REPO_URL }}:${{ env.DUMMY_IMAGE_NAME }}

      - name: Push dummy images to Lambda ECR
        shell: bash
        run: |
          echo 'Deploying ${{ env.env.DUMMY_IMAGE_NAME }} to Lambda ECR'
          docker tag  ${{ env.GITHUB_IMAGE_REPO }}/${{ env.DUMMY_IMAGE_NAME }}:latest ${{ env.LAMBDA_ECR_REPO_URL }}:${{ env.DUMMY_IMAGE_NAME }}
          docker push ${{ env.LAMBDA_ECR_REPO_URL }}:${{ env.DUMMY_IMAGE_NAME }}

  deploy:
    needs: [initial, post-initial]
    if: always()
    uses: ./.github/workflows/aws-template-terraform.yml
    with:
      CONTEXT_FOLDER: "./infrastructure/cloud/environments/${{ inputs.environment || 'dev' }}"
      TF_VARS_CONFIG_FOLDER: "."
      CHANGE_FOLDER_NAME: environments/${{ inputs.environment || 'dev' }}
      ENVIRONMENT_NAME: ${{ inputs.environment || 'dev' }}
      APPLY_TF_CODE: true
    secrets: inherit