prod-deploy.yml

name: Deploy to prod

on:
  workflow_dispatch:
  schedule:
    # Weekdays Mon-Fri @ 18:00 UTC (10AM PST [winter] / 11AM PDT [summer])
    - cron: '0 18 * * 1-5'

permissions:
  contents: write
  id-token: write
  pull-requests: write

jobs:
  run-staging-e2e-test:
    name: Run e2e test on staging
    uses: chanzuckerberg/cryoet-data-portal/.github/workflows/frontend-e2e-tests.yml@main
    secrets: inherit
    # The variable IS_DEPLOY_ALLOWED is used to manually gate the prod deploys
    if: vars.IS_DEPLOY_ALLOWED == 'true'
    with:
      environment: staging

  find-frontend-release-pr:
    concurrency:
      group: create-frontend-release-${{ github.ref }}
      cancel-in-progress: true

    outputs:
      pr: ${{ steps.find-release-pr.outputs.result }}

    name: find release PR
    runs-on: ubuntu-latest
    if: github.repository == 'chanzuckerberg/cryoet-data-portal'
    needs: run-staging-e2e-test
    steps:
      - name: find release PR
        uses: actions/github-script@v7
        id: find-release-pr
        with:
          script: |
            const { owner, repo } = context.repo
            const { data: searchResult } = await github.rest.search.issuesAndPullRequests(
              {
                q: `repo:${owner}/${repo} is:pr label:"autorelease: pending"`,
                per_page: 1,
              }
            )

            const [issue] = searchResult.items
            if (!issue) {
              throw new Error('No release PR found')
            }

            // Getting PR data from /pulls API has more info about the pull
            // request like merge_commit_sha.
            const { data: pr } = await github.rest.pulls.get({
              owner,
              repo,
              pull_number: issue.number,
            })

            return pr

  tag-frontend-release:
    concurrency:
      group: tag-frontend-release-${{ github.ref }}
      cancel-in-progress: true

    outputs:
      tag: ${{ fromJson(steps.get-tag-name.outputs.result).tag }}

    name: tag frontend release
    runs-on: ubuntu-latest
    if: github.repository == 'chanzuckerberg/cryoet-data-portal'
    needs: find-frontend-release-pr
    steps:
      - name: merge release PR
        uses: actions/github-script@v7
        id: merge-release-pr
        if: fromJson(needs.find-frontend-release-pr.outputs.pr).state == 'open'
        with:
          result-encoding: string
          script: |
            const pr = ${{ needs.find-frontend-release-pr.outputs.pr }}
            console.log(`Merging release PR #${pr.number}`)

            const { owner, repo } = context.repo
            const mergeResponse = await github.rest.pulls.merge({
              owner,
              repo,
              pull_number: pr.number,
              merge_method: 'squash',
            })

            return mergeResponse.data.sha

      - name: checkout repo for tagging
        uses: actions/checkout@v4
        with:
          ref: |
            ${{
              fromJson(needs.find-frontend-release-pr.outputs.pr).state == 'open' &&
              steps.merge-release-pr.outputs.result ||
              fromJson(needs.find-frontend-release-pr.outputs.pr).merge_commit_sha
            }}

      - name: get tag name
        id: get-tag-name
        uses: actions/github-script@v7
        with:
          script: |
            const pr = ${{ needs.find-frontend-release-pr.outputs.pr }}
            const version = pr.title.split(' ').at(-1)

            return {
              version,
              tag: `web-v${version}`,
            }

      - name: tag release
        run: |
          git config user.name github-actions[bot]
          git config user.email github-actions[bot]@users.noreply.github.com
          git tag -a ${{ fromJson(steps.get-tag-name.outputs.result).tag }} -m "Releasing frontend v${{ fromJson(steps.get-tag-name.outputs.result).version }}"
          git push origin ${{ fromJson(steps.get-tag-name.outputs.result).tag }}

      - name: update label for release PR
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          result-encoding: string
          script: |
            const pr = ${{ needs.find-frontend-release-pr.outputs.pr }}
            const { owner, repo } = context.repo
            const { tag } = ${{ steps.get-tag-name.outputs.result }}

            await Promise.all([
              github.rest.issues.removeLabel({
                owner,
                repo,
                issue_number: pr.number,
                name: 'autorelease: pending'
              }),

              github.rest.issues.addLabels({
                owner,
                repo,
                issue_number: pr.number,
                labels: ['autorelease: tagged']
              }),
            ])

  deploy-to-prod:
    concurrency:
      group: prod-frontend-deploy-${{ github.ref }}
      cancel-in-progress: true
    name: deploy prod branch
    runs-on: ubuntu-latest
    environment: prod
    needs: [find-frontend-release-pr, tag-frontend-release]
    if: github.repository == 'chanzuckerberg/cryoet-data-portal'
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          mask-aws-account-id: true
          aws-region: ${{ secrets.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          role-duration-seconds: 1200
      - name: Create or update stack
        uses: chanzuckerberg/github-actions/.github/actions/deploy-happy-stack@v1.24.0
        env:
          # Force using BuildKit instead of normal Docker, required so that metadata
          # is written/read to allow us to use layers of previous builds as cache.
          DOCKER_BUILDKIT: 1
          COMPOSE_DOCKER_CLI_BUILD: 1
          DOCKER_REPO: ${{ secrets.ECR_REPO }}/
          ENV: prod
        with:
          stack-name: frontend
          create-tag: true
          tag: ${{ env.STACK_NAME }}
          tfe-token: ${{ secrets.TFE_TOKEN }}
          working-directory: ./frontend
          env: prod
          operation: create-or-update
          github-repo-branch: ${{ needs.tag-frontend-release.outputs.tag }}

  run-prod-e2e-test:
    name: Run e2e test on prod
    needs: deploy-to-prod
    uses: chanzuckerberg/cryoet-data-portal/.github/workflows/frontend-e2e-tests.yml@main
    secrets: inherit
    with:
      environment: prod