deploy.yml

name: TRM Infrastructure Deployment

on:
  push:
    branches:
    - staging
    - production

jobs:
  infrastructure_common:
    name: Manage Common Infrastructure
    runs-on: ubuntu-latest
    env:
      GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
      TF_VAR_project: techlabs-trm
      TF_VAR_region: europe-west3
      TF_VAR_domain: trm.techlabs.org
    outputs:
      artifact_registry_repository_prefix: ${{ steps.terraform_output.outputs.artifact_registry_repository_prefix }}
    defaults:
      run:
        working-directory: infrastructure/common
    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v1
      with:
        terraform_version: 0.13.5
        terraform_wrapper: false

    - name: terraform init
      run: terraform init

    - name: terraform apply
      run: terraform apply -auto-approve

    - name: terraform output
      id: terraform_output
      run: |
        echo "::set-output name=artifact_registry_repository_prefix::$(terraform output artifact_registry_repository_prefix)"

  hasura_image:
    name: Build & Push Hasura Image
    runs-on: ubuntu-latest
    needs: [infrastructure_common]
    defaults:
      run:
        working-directory: database
    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - uses: dorny/paths-filter@e2bed85912bf87322673b976228bde722213a6df
      id: changes
      with:
        base: ${{ github.ref }}
        filters: |
          database:
            - 'database/**'

    - name: Setup gcloud
      if: steps.changes.outputs.database == 'true'
      uses: google-github-actions/setup-gcloud@v0
      with:
        version: '308.0.0'
        service_account_key: ${{ secrets.GOOGLE_CREDENTIALS }}
        export_default_credentials: true

    - name: Configure gcloud Auth for Docker
      if: steps.changes.outputs.database == 'true'
      run: gcloud auth configure-docker europe-west3-docker.pkg.dev

    - name: Try to pull existing image
      if: steps.changes.outputs.database == 'true'
      continue-on-error: true
      run: docker pull ${{ needs.infrastructure_common.outputs.artifact_registry_repository_prefix }}/hasura:${GITHUB_REF##*/}

    - name: Build Hasura image
      if: steps.changes.outputs.database == 'true'
      # ${GITHUB_REF##*/} gets branch name
      run: docker build -t ${{ needs.infrastructure_common.outputs.artifact_registry_repository_prefix }}/hasura:${GITHUB_REF##*/} .

    - name: Push Hasura image
      if: steps.changes.outputs.database == 'true'
      # ${GITHUB_REF##*/} gets branch name
      run: docker push ${{ needs.infrastructure_common.outputs.artifact_registry_repository_prefix }}/hasura:${GITHUB_REF##*/}

  gotenberg_image:
    name: Build & Push Gotenberg Image
    runs-on: ubuntu-latest
    needs: [infrastructure_common]
    defaults:
      run:
        working-directory: pdf-generator
    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - uses: dorny/paths-filter@e2bed85912bf87322673b976228bde722213a6df
      id: changes
      with:
        base: ${{ github.ref }}
        filters: |
          pdf_generator:
            - 'pdf-generator/**'

    - name: Setup gcloud
      if: steps.changes.outputs.pdf_generator == 'true'
      uses: google-github-actions/setup-gcloud@v0
      with:
        version: '308.0.0'
        service_account_key: ${{ secrets.GOOGLE_CREDENTIALS }}
        export_default_credentials: true

    - name: Configure gcloud Auth for Docker
      if: steps.changes.outputs.pdf_generator == 'true'
      run: gcloud auth configure-docker europe-west3-docker.pkg.dev

    - name: Build image
      if: steps.changes.outputs.pdf_generator == 'true'
      run: docker build -t ${{ needs.infrastructure_common.outputs.artifact_registry_repository_prefix }}/gotenberg:${GITHUB_REF##*/} .

    - name: Push image
      if: steps.changes.outputs.pdf_generator == 'true'
      # ${GITHUB_REF##*/} gets branch name
      run: docker push ${{ needs.infrastructure_common.outputs.artifact_registry_repository_prefix }}/gotenberg:${GITHUB_REF##*/}

  certificate_generator_image:
    name: Build & Push Certificate Generator Image
    runs-on: ubuntu-latest
    needs: [infrastructure_common]
    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - uses: dorny/paths-filter@e2bed85912bf87322673b976228bde722213a6df
      id: changes
      with:
        base: ${{ github.ref }}
        filters: |
          code_changed:
            - 'functions/certificate-generator/**'
            - 'functions/lib/trm-api/**'

    - name: Setup gcloud
      if: steps.changes.outputs.code_changed == 'true'
      uses: google-github-actions/setup-gcloud@v0
      with:
        version: '308.0.0'
        service_account_key: ${{ secrets.GOOGLE_CREDENTIALS }}
        export_default_credentials: true

    - name: Configure gcloud Auth for Docker
      if: steps.changes.outputs.code_changed == 'true'
      run: gcloud auth configure-docker europe-west3-docker.pkg.dev

    - name: Try to pull existing image
      if: steps.changes.outputs.code_changed == 'true'
      continue-on-error: true
      run: docker pull ${{ needs.infrastructure_common.outputs.artifact_registry_repository_prefix }}/certificate-generator:${GITHUB_REF##*/}

    - name: Build image
      if: steps.changes.outputs.code_changed == 'true'
      # ${GITHUB_REF##*/} gets branch name
      run: |
        docker-compose build fn-certificate-generator
        docker tag trm_fn-certificate-generator:latest ${{ needs.infrastructure_common.outputs.artifact_registry_repository_prefix }}/certificate-generator:${GITHUB_REF##*/}

    - name: Push image
      if: steps.changes.outputs.code_changed == 'true'
      # ${GITHUB_REF##*/} gets branch name
      run: docker push ${{ needs.infrastructure_common.outputs.artifact_registry_repository_prefix }}/certificate-generator:${GITHUB_REF##*/}

  infrastructure_app:
    name: Manage App Infrastructure
    runs-on: ubuntu-latest
    needs: [hasura_image, gotenberg_image, certificate_generator_image]
    env:
      GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
      TF_VAR_database_passwords: ${{ secrets.TF_VAR_DATABASE_PASSWORDS }}
      TF_VAR_hasura_jwt_keys: ${{ secrets.TF_VAR_HASURA_JWT_KEYS }}
      TF_VAR_hasura_passwords: ${{ secrets.TF_VAR_HASURA_PASSWORDS }}
      TF_VAR_oauth_credentials: ${{ secrets.TF_VAR_OAUTH_CREDENTIALS }}
      TF_VAR_edyoucated_username: ${{ secrets.TF_VAR_EDYOUCATED_USERNAME }}
      TF_VAR_edyoucated_password: ${{ secrets.TF_VAR_EDYOUCATED_PASSWORD }}
      TF_VAR_edyoucated_user_pool_id: ${{ secrets.TF_VAR_EDYOUCATED_USER_POOL_ID }}
      TF_VAR_edyoucated_identity_pool_id: ${{ secrets.TF_VAR_EDYOUCATED_IDENTITY_POOL_ID }}
      TF_VAR_edyoucated_client_id: ${{ secrets.TF_VAR_EDYOUCATED_CLIENT_ID }}
      TF_VAR_edyoucated_aws_region: ${{ secrets.TF_VAR_EDYOUCATED_AWS_REGION }}
      TF_VAR_edyoucated_api_url: ${{ secrets.TF_VAR_EDYOUCATED_API_URL }}
      TF_VAR_edyoucated_organization_id: ${{ secrets.TF_VAR_EDYOUCATED_ORGANIZATION_ID }}
      TF_VAR_trm_data_folder_id: ${{ secrets.TF_VAR_TRM_DATA_FOLDER_ID }}
      TF_VAR_google_impersonate_subject: ${{ secrets.TF_VAR_GOOGLE_IMPERSONATE_SUBJECT }}
      TF_VAR_project: techlabs-trm
      TF_VAR_region: europe-west3
      TF_VAR_domain: trm.techlabs.org
      TF_VAR_gsuite_domain: techlabs.org
    outputs:
      hasura_url: ${{ steps.terraform_output.outputs.hasura_url }}
      functions_auth_url: ${{ steps.terraform_output.outputs.functions_auth_url }}
    defaults:
      run:
        working-directory: infrastructure/app
    steps:
    - name: Checkout
      uses: actions/checkout@v2

    - name: Prepare function dependencies
      run: |
        cp -rp functions/lib/trm-api functions/typeform
        cp -rp functions/lib/trm-api functions/form-response
        cp -rp functions/lib/trm-api functions/activity-import
        cp -rp functions/lib/trm-api functions/export
        cp -rp functions/lib/trm-api functions/auth

        sed -i -e 's/file:\.\.\/lib\/trm-api/file:\.\/trm-api/g' functions/*/package*.json
      working-directory: .

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v1
      with:
        terraform_version: 0.13.5
        terraform_wrapper: false

    - name: terraform init
      run: terraform init

    - name: terraform workspace select
      run: terraform workspace select ${GITHUB_REF##*/}

    - name: terraform apply
      run: terraform apply -auto-approve

    - name: terraform output
      id: terraform_output
      run: |
        echo "::set-output name=hasura_url::$(terraform output hasura_url)"
        echo "::set-output name=functions_auth_url::$(terraform output functions_auth_url)"

    - name: Upload frontend config
      uses: actions/upload-artifact@v2
      with:
        name: frontend-config
        path: infrastructure/app/output/config.*.js
        if-no-files-found: error

  frontend_build:
    name: Build Frontend
    runs-on: ubuntu-latest
    needs: [infrastructure_app]
    outputs:
      changed: ${{ steps.changes.outputs.frontend }}
    defaults:
      run:
        working-directory: frontend
    steps:
    - name: Checkout
      uses: actions/checkout@v2

    # TODO path filter needs to check if frontend config changed and take it into account
    # - uses: dorny/paths-filter@e2bed85912bf87322673b976228bde722213a6df
    #   id: changes
    #   with:
    #     base: ${{ github.ref }}
    #     filters: |
    #       frontend:
    #         - 'frontend/**'

    - name: Download frontend config
      # if: steps.changes.outputs.frontend == 'true'
      uses: actions/download-artifact@v2
      with:
        name: frontend-config
        path: frontend/src

    - name: Rename frontend config
      # if: steps.changes.outputs.frontend == 'true'
      run: mv src/config.${GITHUB_REF##*/}.js src/config.js

    - uses: actions/setup-node@v2-beta
      # if: steps.changes.outputs.frontend == 'true'
      with:
        node-version: '14'

    - name: Get yarn cache directory path
      # if: steps.changes.outputs.frontend == 'true'
      id: yarn-cache-dir-path
      run: echo "::set-output name=dir::$(yarn cache dir)"

    - uses: actions/cache@v2
      # if: steps.changes.outputs.frontend == 'true'
      id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
      with:
        path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
        key: ${{ runner.os }}-yarn-v2-${{ hashFiles('frontend/**/yarn.lock') }}
        restore-keys: |
          ${{ runner.os }}-yarn-v2

    - name: yarn install
      # if: steps.changes.outputs.frontend == 'true'
      run: yarn install

    - name: yarn build
      # if: steps.changes.outputs.frontend == 'true'
      run: yarn build

    - name: Upload frontend build
      # if: steps.changes.outputs.frontend == 'true'
      uses: actions/upload-artifact@v2
      with:
        name: frontend-build
        path: frontend/build
        if-no-files-found: error

  frontend_deploy_staging:
    name: Deploy Frontend (Staging)
    runs-on: ubuntu-latest
    needs: [frontend_build]
    if: github.ref == 'refs/heads/staging' # && needs.frontend_build.outputs.changed == 'true'
    steps:
    - name: Get deploy repo
      id: deploy-repo
      run: echo "::set-output name=repository::TechLabs-Berlin/trm-frontend-${GITHUB_REF##*/}"

    - name: Checkout deploy repo
      uses: actions/checkout@v2
      with:
        repository: ${{ steps.deploy-repo.outputs.repository }}
        path: deploy
        ssh-key: ${{ secrets.DEPLOY_SSH_KEY_STAGING }}

    - name: Download frontend build
      uses: actions/download-artifact@v2
      with:
        name: frontend-build
        path: build

    - name: Copy frontend build to deploy repo
      run: |
        cp -r deploy/.git deploy/CNAME deploy/README.md build/

    - name: Configure git
      run: |
        git config --global user.email "berlin@techlabs.org"
        git config --global user.name "TechLabs Berlin GitHub Workflow"

    - name: Commit deploy repo
      run: |
        git add --all --force .
        git commit -m "Add frontend build at $(date +%FT%T%Z)" --allow-empty
      working-directory: build

    - name: Push deploy repo
      run: git push
      working-directory: build

  frontend_deploy_production:
    name: Deploy Frontend (Production)
    runs-on: ubuntu-latest
    needs: [frontend_build]
    if: github.ref == 'refs/heads/production' # && needs.frontend_build.outputs.changed == 'true'
    steps:
    - name: Get deploy repo
      id: deploy-repo
      run: echo "::set-output name=repository::TechLabs-Berlin/trm-frontend-${GITHUB_REF##*/}"

    - name: Checkout deploy repo
      uses: actions/checkout@v2
      with:
        repository: ${{ steps.deploy-repo.outputs.repository }}
        path: deploy
        ssh-key: ${{ secrets.DEPLOY_SSH_KEY_PRODUCTION }}

    - name: Download frontend build
      uses: actions/download-artifact@v2
      with:
        name: frontend-build
        path: build

    - name: Copy frontend build to deploy repo
      run: |
        cp -r deploy/.git deploy/CNAME deploy/README.md build/

    - name: Configure git
      run: |
        git config --global user.email "berlin@techlabs.org"
        git config --global user.name "TechLabs Berlin GitHub Workflow"

    - name: Commit deploy repo
      run: |
        git add --all --force .
        git commit -m "Add frontend build at $(date +%FT%T%Z)" --allow-empty
      working-directory: build

    - name: Push deploy repo
      run: git push
      working-directory: build