deploy-dataops-v1.yml

name: Deploy DataOps V1 Lambda

on:
  push:
    branches:
      - main
    paths:
      - ".github/workflows/deploy-dataops-v1.yml"
      - "backend/**"
      - "content/**"
      - "frontend/**"
      - "infra/**"
      - "Makefile"
      - "package.json"
      - "package-lock.json"
      - "samconfig.toml"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: dataops-v1-deploy
  cancel-in-progress: false

env:
  AWS_REGION: eu-west-1
  AWS_DEFAULT_REGION: eu-west-1
  AWS_ROLE_ARN: arn:aws:iam::817685572750:role/dataops-github-actions-deploy
  DOCS_GITHUB_OWNER: DataTalksClub
  DOCS_GITHUB_REPO: dataops
  DOCS_GITHUB_BRANCH: main
  BASIC_AUTH_USERNAME: admin

jobs:
  checks:
    name: Check DataOps v1 app
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Install Node workspace dependencies
        run: npm ci

      - name: Install backend Playwright Chromium
        run: npm exec --workspace dataops-backend -- playwright install --with-deps chromium

      - name: Run backend tests
        run: npm --prefix backend test

      - name: Typecheck backend
        run: npm --prefix backend run typecheck

      - name: Build backend
        run: npm --prefix backend run build

      - name: Run backend Playwright E2E
        run: npm --prefix backend run test:e2e

      - name: Upload backend Playwright artifacts
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: backend-playwright-artifacts
          path: |
            backend/playwright-report/
            backend/test-results/
          if-no-files-found: ignore
          retention-days: 7

      - name: Set up SAM
        uses: aws-actions/setup-sam@v3
        with:
          use-installer: true
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Validate SAM template
        run: make sam-validate

      - name: Build SAM artifact
        run: make sam-build

  deploy:
    name: Deploy DataOps v1 app
    runs-on: ubuntu-latest
    needs: checks
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Install Node workspace dependencies
        run: npm ci

      - name: Set up SAM
        uses: aws-actions/setup-sam@v3
        with:
          use-installer: true
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6.1.0
        with:
          role-to-assume: ${{ env.AWS_ROLE_ARN }}
          role-session-name: dataops-v1-deploy
          aws-region: ${{ env.AWS_REGION }}

      - name: Build SAM artifact
        run: make sam-build

      - name: Deploy DataOps v1 stack
        run: |
          sam deploy \
            --config-env full-sandbox \
            --parameter-overrides \
              "ParameterKey=GitHubOwner,ParameterValue=$DOCS_GITHUB_OWNER" \
              "ParameterKey=GitHubRepo,ParameterValue=$DOCS_GITHUB_REPO" \
              "ParameterKey=GitHubBranch,ParameterValue=$DOCS_GITHUB_BRANCH" \
              "ParameterKey=BasicAuthUsername,ParameterValue=$BASIC_AUTH_USERNAME"

      - name: Seed runtime users, workflow templates, and recurring configs
        working-directory: ${{ github.workspace }}/backend
        run: |
          export DATAOPS_TASKS_TABLE="$(aws cloudformation describe-stacks \
            --stack-name dataops-v1 \
            --query "Stacks[0].Outputs[?OutputKey=='DataOpsTasksTableName'].OutputValue" \
            --output text)"
          export DATAOPS_USERS_TABLE="$(aws cloudformation describe-stacks \
            --stack-name dataops-v1 \
            --query "Stacks[0].Outputs[?OutputKey=='DataOpsUsersTableName'].OutputValue" \
            --output text)"
          export DATAOPS_TEMPLATES_TABLE="$(aws cloudformation describe-stacks \
            --stack-name dataops-v1 \
            --query "Stacks[0].Outputs[?OutputKey=='DataOpsTemplatesTableName'].OutputValue" \
            --output text)"
          npm exec -- tsx scripts/seed-users.ts
          npm exec -- tsx scripts/seed-templates.ts
          npm exec -- tsx scripts/seed-recurring.ts

      - name: Smoke test deployed single-origin backend
        run: |
          backend_url="$(aws cloudformation describe-stacks \
            --stack-name dataops-v1 \
            --query "Stacks[0].Outputs[?OutputKey=='BackendUrl'].OutputValue" \
            --output text)"
          # The Function URL output ends with a trailing slash; strip it so we hit
          # "/" and "/login" instead of malformed double-slash paths ("//", "//login").
          backend_url="${backend_url%/}"
          # The deployed backend should serve /login (200) and redirect / to /login (302).
          # The Function URL event normalization in handler.ts must work for this.
          # Retry a few times: immediately after a stack update the Function URL can
          # briefly return a cold-start/propagation blip before the new code settles.
          code=""
          login_code=""
          for attempt in 1 2 3 4 5; do
            code=$(curl -sS -o /dev/null -w "%{http_code}" "$backend_url/")
            login_code=$(curl -sS -o /dev/null -w "%{http_code}" "$backend_url/login")
            if { [ "$code" = "200" ] || [ "$code" = "301" ] || [ "$code" = "302" ]; } \
               && [ "$login_code" = "200" ]; then
              echo "Backend smoke OK on attempt $attempt: root=$code login=$login_code"
              exit 0
            fi
            echo "Smoke attempt $attempt: root=$code login=$login_code (retrying)"
            sleep 10
          done
          echo "Backend smoke test failed after retries: root expected 200/301/302 got $code; /login expected 200 got $login_code"
          exit 1