ci-api-deploy.yml

name: CI API deploy

on:
  workflow_dispatch:
    inputs:
      release_version:
        type: string
        description: Release version (must match a build version in S3)
        required: true

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID2 }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY2 }}
      AWS_REGION: us-west-2
      ENVIRONMENT: staging

    steps:
    - name: Update Lambda function code
      run: |
        aws lambda update-function-code \
          --function-name totemboundci-api \
          --s3-bucket totemboundci-releases \
          --s3-key totem-api/totembound-api-${{ github.event.inputs.release_version }}.zip

    - name: Wait for update to complete
      run: |
        aws lambda wait function-updated \
          --function-name totemboundci-api

    # The stats-snapshot Lambda shares the same artifact (different handler).
    # Best-effort: it's created by ci-infra-deploy, so skip if it doesn't exist yet.
    - name: Update stats-snapshot Lambda code
      run: |
        FN=totemboundci-stats-snapshot
        if aws lambda get-function --function-name "$FN" >/dev/null 2>&1; then
          aws lambda update-function-code \
            --function-name "$FN" \
            --s3-bucket totemboundci-releases \
            --s3-key totem-api/totembound-api-${{ github.event.inputs.release_version }}.zip
          aws lambda wait function-updated --function-name "$FN"
          echo "Updated $FN"
        else
          echo "$FN not found yet (created by ci-infra-deploy) — skipping"
        fi

    - name: Verify deployment
      run: |
        aws lambda get-function \
          --function-name totemboundci-api \
          --query 'Configuration.{State:State,LastModified:LastModified,CodeSize:CodeSize}' \
          --output table