review_apps_on_pr_change.yml

name: "Review apps: on PR change"
on:
  pull_request:
    # being explicit about what to trigger on.
    # matches the docs for the default types
    # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request
    types: [opened, reopened, synchronize]
jobs:
  update-review-app:
    # this references a codebuild project configured in forms-deploy
    # see: https://docs.aws.amazon.com/codebuild/latest/userguide/action-runner.html
    runs-on: codebuild-review-forms-admin-gha-runner-${{github.run_id}}-${{github.run_attempt}}

    permissions:
      pull-requests: write

    steps:
      - name: Generate container image URI
        run: |
          echo "CONTAINER_IMAGE_URI=842676007477.dkr.ecr.eu-west-2.amazonaws.com/forms-admin:pr-${{github.event.pull_request.number}}-${{github.event.pull_request.head.sha}}-$(date +%s)" >> "$GITHUB_ENV"

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build container
        run: |
          # Docker credentials are configured in CodeBuild
          # CodeBuild retrieves the credentials from ParameterStore
          echo "${DOCKER_PASSWORD}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
          docker build \
            --tag "${{env.CONTAINER_IMAGE_URI}}" \
            .

      - name: Push container
        id: build-container
        run: |
          aws ecr get-login-password --region eu-west-2 \
          | docker login --username AWS --password-stdin 842676007477.dkr.ecr.eu-west-2.amazonaws.com

          echo "Pushing container image"
          echo "${{env.CONTAINER_IMAGE_URI}}"

          docker push "${CONTAINER_IMAGE_URI}"

      - name: Determine Terraform version
        id: terraform-version
        run: |
          cat .review_apps/.terraform-version | xargs printf "TF_VERSION=%s" >> "$GITHUB_OUTPUT"

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: ${{steps.terraform-version.outputs.TF_VERSION}}

      - name: Deploy review app
        id: deploy
        run: |
          cd .review_apps/

          terraform init -backend-config="key=review-apps/forms-admin/pr-${{github.event.pull_request.number}}.tfstate"

          terraform apply \
            -var "pull_request_number=${{github.event.pull_request.number}}" \
            -var "forms_admin_container_image=${{env.CONTAINER_IMAGE_URI}}" \
            -no-color \
            -auto-approve

          echo "REVIEW_APP_URL=$(terraform output -raw review_app_url)" >> "$GITHUB_OUTPUT"
          echo "ECS_CLUSTER_ID=$(terraform output -raw review_app_ecs_cluster_id)" >> "$GITHUB_OUTPUT"
          echo "ECS_SERVICE_NAME=$(terraform output -raw review_app_ecs_service_name)" >> "$GITHUB_OUTPUT"

      - name: Wait for AWS ECS deployments to finish
        run: |
          aws ecs wait services-stable \
            --cluster "${{steps.deploy.outputs.ECS_CLUSTER_ID}}" \
            --services "${{steps.deploy.outputs.ECS_SERVICE_NAME}}"

      - name: Comment on PR
        env:
          GH_TOKEN: ${{ github.token }}
        run: |

          cat <<EOF > "${{runner.temp}}/pr-comment.md"
          :tada: A review copy of this PR has been deployed! You can reach it at ${{steps.deploy.outputs.REVIEW_APP_URL}}.

          It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready
          after 5 minutes, there may be something wrong with the ECS task. You will need to go to the integration AWS account
          to debug, or otherwise ask an infrastructure person.

          For more details please see the [review app wiki page](https://github.com/alphagov/forms-team/wiki/Review-apps)
          EOF

          gh pr comment "${{github.event.pull_request.html_url}}" --body-file "${{runner.temp}}/pr-comment.md"