ci.yml

---
name: CI Build
on:
  push:
    branches: ['master', 'prod']
  pull_request:
    branches: ['master']

env:
  GITHUB_REPOSITORY: ${{ github.repository }}
  GITHUB_ORGANIZATION: ${{ github.repository_owner }}
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  django-tests:
    name: "Django tests"
    runs-on: ubuntu-latest
    continue-on-error: ${{ matrix.experimental }}
    strategy:
      fail-fast: false
      matrix:
        include:
          # Blocking: current production stack (.python-version + constraints-production.txt)
          - python_version: current
            django_version: current
            experimental: false
          # Non-blocking: track upcoming Python/Django compatibility
          - python_version: "3.14"
            django_version: "6"
            experimental: true
    env:
      PYTHON_VERSION: ${{ matrix.python_version }}
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v7
        with:
          fetch-depth: 2
      - name: "Login to Githhub Container Registry"
        run: ./scripts/docker_login_github.py
      - if: matrix.django_version != 'latest' && matrix.django_version != 'current' && matrix.django_version != '6'
        run: |
          echo "DJANGO_VERSION=${DJANGO_VERSION}" | tee "${GITHUB_ENV}";
        env:
          DJANGO_VERSION: ${{ matrix.django_version }}
      - if: matrix.django_version == 'latest'
        run: |
          latest_version=$(curl 'https://pypi.org/pypi/django/json' | jq .info.version -r)
          echo "DJANGO_VERSION=${latest_version}" | tee "${GITHUB_ENV}";
      - if: matrix.django_version == '6'
        run: |
          latest_version=$(
            curl -s 'https://pypi.org/pypi/django/json' | jq -r '
              [.releases | keys[] | select(test("^6\\.[0-9]+\\.[0-9]+$"))]
              | sort_by(split(".") | map(tonumber)) | last
            '
          )
          echo "DJANGO_VERSION=${latest_version}" | tee "${GITHUB_ENV}";
      - name: "Log test matrix versions"
        run: |
          echo "Python: ${PYTHON_VERSION}"
          echo "Django: ${DJANGO_VERSION:-current (from constraints)}"
          echo "Experimental (non-blocking): ${{ matrix.experimental }}"
        env:
          DJANGO_VERSION: ${{ env.DJANGO_VERSION }}
      - name: "Copy .env.example to .env"
        run: cp .env.example .env
      - name: "Build CI image"
        run: ./scripts/manage_image.py build --image-type ci
      - name: "Verify CI image"
        run: ./scripts/manage_image.py verify --image-type ci
      - name: Pull images
        run: PYTHONUNBUFFERED=1 ./scripts/pull_images.py
      - name: "Run tests"
        run: ./run_test.sh
      - name: "Check missing migrations"
        run: docker compose run web makemigrations --check -v 3
      - name: "Checks the entire Django project for potential problems"
        run: docker compose run web check --fail-level DEBUG -v 3
      - name: "Upload coverage"
        if: ${{ !matrix.experimental }}
        uses: codecov/codecov-action@v7.0.0
        with:
          files: coverage.xml
          disable_search: true
          fail_ci_if_error: false
          verbose: true
          token: ${{ secrets.CODECOV_TOKEN }}
      - name: Upload test results to Codecov
        if: ${{ !matrix.experimental && !cancelled() }}
        uses: codecov/codecov-action@v7.0.0
        with:
          report_type: test_results
          files: junit.xml
          disable_search: true
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}
      - name: "Push CI image (push)"
        if: github.event_name == 'push' && github.ref == 'refs/heads/master' && !matrix.experimental
        run: |
          ./scripts/manage_image.py push --image-type ci
          # Push cache
          ./scripts/manage_image.py build --image-type ci --prepare-buildx-cache
      - name: Show logs on fail
        if: ${{ failure() }}
        run: docker compose logs

  static-checks:
    name: "Static checks"
    runs-on: ubuntu-latest
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v7
      - name: "Setup Python"
        uses: actions/setup-python@v7
        with:
          python-version-file: '.python-version'
      - name: "Setup Python dependencies"
        run: pip install -U pip wheel setuptools virtualenv pre-commit
      - name: "Use pre-commit environment cache"
        uses: actions/cache@v6
        with:
          path: ~/.cache/pre-commit
          key: pre-commit-3|${{ env.pythonLocation }}|${{ hashFiles('.pre-commit-config.yaml') }}
      - name: "Run static checks"
        run: pre-commit run --show-diff-on-failure --color=always --all-files

  bi-validate:
    name: "BI Validate"
    runs-on: ubuntu-latest
    needs: [django-tests, static-checks]
    env:
      COMPOSE_FILE: "docker-compose.yaml:docker-compose.dbt.yaml:docker-compose.dbt-local.yaml"
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v7
        with:
          fetch-depth: 2
      - name: "Setup Python"
        uses: actions/setup-python@v7
        with:
          python-version-file: '.python-version'
      - name: "Login to Githhub Container Registry"
        run: ./scripts/docker_login_github.py
      - name: "Copy .env.example to .env"
        run: cp .env.example .env
      - name: "Build CI image"
        run: ./scripts/manage_image.py build --image-type ci
      - name: "Verify CI image"
        run: ./scripts/manage_image.py verify --image-type ci
      - name: "Build BI image"
        run: ./scripts/manage_image.py build --image-type bi
      - name: "Verify BI image"
        run: ./scripts/manage_image.py verify --image-type bi
      - name: Pull images
        run: PYTHONUNBUFFERED=1 ./scripts/pull_images.py
      - run: docker compose config
      # We dont have a cache for self-management image and we dont need to need it, so we exclude it.
      - run: docker compose config --services | grep -v self-management | xargs docker compose up -d
      - run: ./run_manage.sh migrate
      - run: ./run_manage.sh populate_db
      - run: ./run_dbt.sh dbt deps
      - run: ./run_dbt.sh dbt build
      - name: "Push BI image (push)"
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: |
          ./scripts/manage_image.py push --image-type bi
          # Push cache
          ./scripts/manage_image.py build --image-type bi --prepare-buildx-cache

  prod-image:
    name: "Build Prod Image"
    runs-on: ubuntu-latest
    needs: [django-tests, static-checks]
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v7
      - name: "Login to GitHhub Container Registry"
        run: ./scripts/docker_login_github.py
      - name: "Set image tag"
        if: github.event_name == 'push'
        run: |
          set -x;
          APP_NAME="$(./scripts/detect_app_name.py)";
          echo "APP_NAME=${APP_NAME}"
          echo "IMAGE_TAG=${APP_NAME}" >> $GITHUB_ENV;
          echo "HEROKU_APP=${APP_NAME}" >> $GITHUB_ENV;
      - name: "Build PROD image"
        run: ./scripts/manage_image.py build --image-type prod
      - name: "Verify PROD image"
        run: ./scripts/manage_image.py verify --image-type prod
      - name: "Push PROD image (push)"
        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
        run: |
          ./scripts/manage_image.py push --image-type prod
          # Push cache
          ./scripts/manage_image.py build --image-type prod --prepare-buildx-cache

  deploy-app:
    name: "Deploy app (push) - ${{ github.ref }}"
    runs-on: ubuntu-latest
    needs: [prod-image, bi-validate]
    if: github.event_name == 'push'
    permissions:
      contents: read
      deployments: write
      packages: write
    env:
      HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v7
      - name: "Login to Githhub Container Registry"
        run: ./scripts/docker_login_github.py
      - name: "Login to Heroku Docker Registry"
        run: ./scripts/docker_login_heroku.py
      - name: "Install Heroku CLI"
        run: "curl https://cli-assets.heroku.com/install.sh | sh"
      - name: "Set environment env variable"
        run: |
          APP_NAME="$(./scripts/detect_app_name.py)";
          echo "APP_NAME=${APP_NAME}"
          echo "HEROKU_APP=${APP_NAME}" >> $GITHUB_ENV;
          echo "HEROKU_DOMAIN=$(./scripts/fetch_domain.py "${APP_NAME}")" >> $GITHUB_ENV;
      - uses: chrnorm/deployment-action@v2
        name: Create GitHub deployment
        id: deployment
        with:
          token: "${{ github.token }}"
          environment-url: "https://${{ env.HEROKU_DOMAIN }}"
          initial-status: in_progress
          environment: "${{ env.HEROKU_APP }}"
      - name: "Build PROD image"
        run: ./scripts/manage_image.py build --image-type prod
      - name: "Deploy"
        run: './scripts/deploy.sh "${HEROKU_APP}"'
      - name: Update deployment status (success)
        if: success()
        uses: chrnorm/deployment-status@v2
        with:
          token: "${{ github.token }}"
          state: "success"
          environment-url: "https://${{ env.HEROKU_DOMAIN }}"
          deployment-id: ${{ steps.deployment.outputs.deployment_id }}
      - name: Update deployment status (failure)
        if: failure()
        uses: chrnorm/deployment-status@v2
        with:
          token: "${{ github.token }}"
          state: "failure"
          environment-url: "https://${{ env.HEROKU_DOMAIN }}"
          deployment-id: ${{ steps.deployment.outputs.deployment_id }}

  deploy-bi:
    name: "Deploy BI (push) - ${{ github.ref }}"
    runs-on: ubuntu-latest
    needs: [prod-image, bi-validate]
    if: github.event_name == 'push'
    env:
      HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}
      COMPOSE_FILE: "docker-compose.dbt.yaml"
    steps:
      - name: "Checkout ${{ github.ref }} ( ${{ github.sha }} )"
        uses: actions/checkout@v7
        with:
          fetch-depth: 2
      - name: "Setup Python"
        uses: actions/setup-python@v7
        with:
          python-version-file: '.python-version'
      - name: "Login to Githhub Container Registry"
        run: ./scripts/docker_login_github.py
      - name: "Build BI image"
        run: ./scripts/manage_image.py build --image-type bi
      - name: "Verify BI image"
        run: ./scripts/manage_image.py verify --image-type bi
      - run: pip install django-environ
      - name: "Install Heroku CLI"
        run: |
          curl https://cli-assets.heroku.com/install-ubuntu.sh | sh
          echo "export PATH=$PATH:/usr/local/bin" >> $HOME/.bashrc
          source $HOME/.bashrc
          heroku --version
      - name: "Authenticate Heroku CLI"
        run: |
          echo "$HEROKU_API_KEY" | heroku auth:token
      - name: "Set environment env variable"
        if: github.ref == 'refs/heads/prod'
        run: |
          source <(python ./pola-bi/dev.py --environment prod)
          printenv | grep POLA_APP | cut -d "=" -f 2- | xargs -n 1 -I {} echo "::add-mask::{}"
          printenv | grep POLA_APP >> $GITHUB_ENV;
      - name: "Set environment env variable"
        if: github.ref == 'refs/heads/master'
        run: |
          source <(python ./pola-bi/dev.py --environment staging)
          printenv | grep POLA_APP | cut -d "=" -f 2- | xargs -n 1 -I {} echo "::add-mask::{}"
          printenv | grep POLA_APP >> $GITHUB_ENV;
      - run: ./run_dbt.sh dbt deps
      - run: ./run_dbt.sh dbt build