deploy-dev.yml

name: build-and-deploy-dev

on:
  push:
    branches: [ "master" ]
    paths-ignore:
      - "README.md"
      - "deploy-personal.sh"
      - "docker-compose.yml"
      - "local-infra*.sh"
      - ".github/workflows/**"
  workflow_dispatch:


concurrency:
  group: deploy-dev
  cancel-in-progress: true

permissions:
  contents: read
  id-token: write # TODO: switch to OIDC role-to-assume later
  checks: write

env:
  AWS_REGION: eu-west-1
  ENVIRONMENT: development
  TF_IN_AUTOMATION: "1"
  TF_PLUGIN_CACHE_DIR: ~/.terraform.d/plugin-cache

jobs:
  build_test:
    runs-on: ubuntu-latest
    outputs:
      tag: ${{ steps.tag.outputs.tag }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: "21"
          cache: gradle

      - name: Build and test
        run: ./gradlew --no-daemon clean test

      - name: Summarize tests results
        uses: jeantessier/test-summary-action@v1
        if: ${{ always() }}

      - name: Compute image tag
        id: tag
        run: |
          set -euo pipefail
          TAG="$(./gradlew -q printVersion | tr -d '\r\n')"
          echo "tag=$TAG"  >> "$GITHUB_OUTPUT"

  deploy:
     runs-on: ubuntu-22.04-arm
     needs: build_test
     env:
      TAG: ${{ needs.build_test.outputs.tag }}
      PLATFORM: linux/arm64
      BUILDX_OUT: type=registry,oci-mediatypes=false

     steps:
       - name: Checkout
         uses: actions/checkout@v4

       - name: Setup Java
         uses: actions/setup-java@v4
         with:
           distribution: graalvm
           java-version: "21"
           cache: gradle

       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
         with:
           terraform_wrapper: false

       - name: Create Terraform plugin cache directory
         run: mkdir -p "${TF_PLUGIN_CACHE_DIR}"


       - name: Cache Terraform plugins
         uses: actions/cache@v4
         with:
           path: "${TF_PLUGIN_CACHE_DIR}"
           key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
           restore-keys: |
             ${{ runner.os }}-terraform-
             
             

       # TODO: Replace with OIDC role-to-assume
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id:  ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ env.AWS_REGION }}

       - name: Login to Amazon ECR
         uses: aws-actions/amazon-ecr-login@v2

       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3

       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

       - name: Terraform init (development/core) and read outputs
         working-directory: infra/envs/dev/core
         run: |
            set -euo pipefail
            terraform init -input=false
      
            echo "SALES_ANALYZER_JOB_ECR_URL=$(terraform output -raw sales_analyzer_job_ecr_url)" >> "$GITHUB_ENV"
            echo "SALES_CLEANUP_ECR_URL=$(terraform output -raw sales_cleanup_ecr_url)" >> "$GITHUB_ENV"
            echo "SALES_DASHBOARD_ECR_URL=$(terraform output -raw sales_dashboard_ecr_url)" >> "$GITHUB_ENV"
            echo "SALES_FX_SERVICE_ECR_URL=$(terraform output -raw sales_fx_service_ecr_url)" >> "$GITHUB_ENV"
            echo "SALES_INGESTER_ECR_URL=$(terraform output -raw sales_ingester_ecr_url)" >> "$GITHUB_ENV"
           

       - name: Build artifacts and generate dockerfiles
         run: |
           ./gradlew --no-daemon \
            :SalesDashboard:assemble \
            :SalesDashboard:dockerfile \
            :SalesFxService:assemble \
            :SalesFxService:dockerfile \
            :SalesAnalyzerJob:assemble \
            :SalesAnalyzerJob:dockerfile \
            :SalesCleanup:buildNativeLayersTask \
            :SalesCleanup:dockerPrepareContext \
            :SalesCleanup:dockerfileNative \
            :SalesIngester:buildNativeLayersTask \
            :SalesIngester:shadowJar


       - name: Build and push docker images
         run: |
           set -euo pipefail
           
           ROOT_DIR="$GITHUB_WORKSPACE"
           
           DOCKERFILE_SALES_DASHBOARD="$ROOT_DIR/SalesDashboard/build/docker/main/Dockerfile"
           DOCKERFILE_SALES_FX_SERVICE="$ROOT_DIR/SalesFxService/build/docker/main/Dockerfile"
           DOCKERFILE_SALES_ANALYZER_JOB="$ROOT_DIR/SalesAnalyzerJob/build/docker/main/Dockerfile"
           DOCKERFILE_SALES_CLEANUP="$ROOT_DIR/SalesCleanup/build/docker/native-main/DockerfileNative"
           DOCKERFILE_SALES_INGESTER="$ROOT_DIR/SalesIngester/Dockerfile"
           
           CTX_SALES_DASHBOARD="$ROOT_DIR/SalesDashboard/build/docker/main"
           CTX_SALES_FX_SERVICE="$ROOT_DIR/SalesFxService/build/docker/main"
           CTX_SALES_ANALYZER_JOB="$ROOT_DIR/SalesAnalyzerJob/build/docker/main"
           CTX_SALES_CLEANUP="$ROOT_DIR/SalesCleanup/build/docker/native-main"
           CTX_SALES_INGESTER="$ROOT_DIR/SalesIngester"
           
           echo "==> Build & push images with Docker buildx (platform=$PLATFORM, tag=$TAG)"
           
           echo "    - SalesCleanup (native)"
           docker buildx build --progress=plain --platform "$PLATFORM" \
            --provenance=false --sbom=false \
            --output "$BUILDX_OUT" \
            -f "$DOCKERFILE_SALES_CLEANUP" \
            -t "${SALES_CLEANUP_ECR_URL}:${TAG}" \
            "$CTX_SALES_CLEANUP"
           
           echo "    - SalesIngester (JVM Lambda)"
           docker buildx build --progress=plain --platform "$PLATFORM" \
            --provenance=false --sbom=false \
            --output "$BUILDX_OUT" \
            -f "$DOCKERFILE_SALES_INGESTER" \
            -t "${SALES_INGESTER_ECR_URL}:${TAG}" \
            "$CTX_SALES_INGESTER"
           
           echo "    - SalesDashboard (JVM Fargate)"
           docker buildx build --progress=plain --platform "$PLATFORM" \
            --provenance=false --sbom=false \
            --output "$BUILDX_OUT" \
            -f "$DOCKERFILE_SALES_DASHBOARD" \
            -t "${SALES_DASHBOARD_ECR_URL}:${TAG}" \
            "$CTX_SALES_DASHBOARD"
           
           echo "    - SalesFxService (JVM Fargate)"
           docker buildx build --progress=plain --platform "$PLATFORM" \
            --provenance=false --sbom=false \
            --output "$BUILDX_OUT" \
            -f "$DOCKERFILE_SALES_FX_SERVICE" \
            -t "${SALES_FX_SERVICE_ECR_URL}:${TAG}" \
            "$CTX_SALES_FX_SERVICE"
           
           echo "    - SalesAnalyzerJob (JVM Fargate)"
           docker buildx build --progress=plain --platform "$PLATFORM" \
            --provenance=false --sbom=false \
            --output "$BUILDX_OUT" \
            -f "$DOCKERFILE_SALES_ANALYZER_JOB" \
            -t "${SALES_ANALYZER_JOB_ECR_URL}:${TAG}" \
            "$CTX_SALES_ANALYZER_JOB"


       - name: Deploy applications
         working-directory: infra/envs/dev/app
         run: |
            set -euo pipefail
            terraform init -input=false
            terraform apply -auto-approve