studios-rollback.yaml

name: Rollback studio to a previous version
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
on:
  workflow_dispatch:
    inputs:
      image-sha:
        description: 'The commit sha of the image to rollback to'
        required: true
        type: string
      environment:
        description: 'Choose the environment to rollback'
        type: choice
        options:
          - 'development'
          - 'preprod'
          - 'production'
        required: true
permissions:
  id-token: write
jobs:
  find-image:
    runs-on: ubuntu-latest
    env:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    outputs:
      imageExists: ${{ steps.find-image-in-ghcr.outputs.found }}
    steps:
      - name: Regex 👾
        uses: actions-ecosystem/action-regex-match@v2
        id: regex-match
        with:
          text: ${{ github.event.inputs.image-sha }}
          regex: '^[a-z0-9]{12}$'

      - name: Skip or fail if invalid 🛂
        id: validate-input
        if: ${{ steps.regex-match.outputs.match == '' }}
        uses: actions/github-script@v7
        with:
          script: |
            core.setFailed('Commit SHA is not valid. Please use the 12 characters format.')

      - name: Find image on GHCR 🌠
        if: ${{ steps.regex-match.outputs.match != '' }}
        id: find-image-in-ghcr
        shell: bash
        run: |
          set -e
          set -u
          set -o pipefail
          set -x
          TOKEN=$(curl -u padms:${{ secrets.PADMS_PAT }} https://ghcr.io/token\?scope\="repository:equinor/energyvision>:pull" | jq -r .token)
          statusCode=$(curl --head --write-out '%{http_code}' --silent --output /dev/null -H "Authorization: Bearer $TOKEN" https://ghcr.io/v2/equinor/energyvision/studio-global/manifests/${{ github.event.inputs.image-sha }})
          if [[ $statusCode -eq 200 ]]
          then
            echo "found=true" >> $GITHUB_OUTPUT
          else
            echo "found=false" >> $GITHUB_OUTPUT
          fi
      - uses: act10ns/slack@v2
        with:
          status: ${{ job.status }}
          steps: ${{ toJson(steps) }}
        if: failure()

  rollback-global:
    runs-on: ubuntu-latest
    needs: find-image
    if: ${{ needs.find-image.outputs.imageExists }} == true && ${{ github.event.inputs.environment }} == "production"
    environment:
      name: production
      url: https://equinor.sanity.studio
    env:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
      SANITY_STUDIO_BRANDMASTER_URL: ${{ secrets.SANITY_STUDIO_BRANDMASTER_URL }}
      SANITY_STUDIO_BRANDMASTER_PLUGIN_SOURCE: ${{ secrets.SANITY_STUDIO_BRANDMASTER_PLUGIN_SOURCE }}
      SANITY_STUDIO_API_DATASET: global
      SANITY_STUDIO_FOTOWARE_CLIENT_ID: ${{ secrets.SANITY_STUDIO_FOTOWARE_CLIENT_ID }}
      SANITY_STUDIO_FOTOWARE_TENANT_URL: ${{ secrets.SANITY_STUDIO_FOTOWARE_TENANT_URL }}
      SANITY_STUDIO_FOTOWARE_REDIRECT_ORIGIN: ${{ secrets.SANITY_STUDIO_FOTOWARE_REDIRECT_ORIGIN }}
      SANITY_STUDIO_FOTOWARE_AF_EXPORT_URL: ${{ secrets.SANITY_STUDIO_FOTOWARE_AF_EXPORT_URL }}
      SANITY_STUDIO_FOTOWARE_AF_EXPORT_KEY: ${{ secrets.SANITY_STUDIO_FOTOWARE_AF_EXPORT_KEY }}
      DOCKER_BUILDKIT: 1
    steps:
      - name: Checkout 🛎️
        id: checkout-main
        uses: actions/checkout@v7
        with:
          repository: 'equinor/energyvision'
          fetch-depth: 0
      - name: Get long sha ️🏷️
        id: get-long-sha
        shell: bash
        run: |
          echo "sha=$(git rev-parse ${{ github.event.inputs.image-sha }})" >> $GITHUB_OUTPUT
      - name: Checkout 🛎️
        id: checkout-specific-branch
        uses: actions/checkout@v7
        with:
          repository: 'equinor/energyvision'
          fetch-depth: 0
          ref: '${{ steps.get-long-sha.outputs.sha }}'
      - name: Install pnpm 📦
        id: install-pnpm
        uses: pnpm/action-setup@v4
      - name: Cache pnpm modules 💾
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: 'pnpm'
      - name: Install dependencies 🔧
        id: install-dependencies
        run: |
          pnpm install
          pnpm studio install
      - name: Deploy 🚀
        id: deploy
        working-directory: ./studio
        run: |
          pnpm run deploy
        env:
          SANITY_AUTH_TOKEN: ${{ secrets.SANITY_DEPLOY }}
      - uses: act10ns/slack@v2
        with:
          status: ${{ job.status }}
          steps: ${{ toJson(steps) }}
        if: failure()

  rollback-secret:
    runs-on: ubuntu-latest
    needs: find-image
    if: ${{ needs.find-image.outputs.imageExists }} == true && ${{ github.event.inputs.environment }} == "production"
    environment:
      name: production
    env:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
      SANITY_STUDIO_API_PROJECT_ID: w3b4om14
      SANITY_STUDIO_BRANDMASTER_URL: ${{ secrets.SANITY_STUDIO_BRANDMASTER_URL }}
      SANITY_STUDIO_BRANDMASTER_PLUGIN_SOURCE: ${{ secrets.SANITY_STUDIO_BRANDMASTER_PLUGIN_SOURCE }}
      SANITY_STUDIO_API_DATASET: secret
      SANITY_STUDIO_FOTOWARE_CLIENT_ID: ${{ secrets.SANITY_STUDIO_FOTOWARE_CLIENT_ID }}
      SANITY_STUDIO_FOTOWARE_TENANT_URL: ${{ secrets.SANITY_STUDIO_FOTOWARE_TENANT_URL }}
      SANITY_STUDIO_FOTOWARE_REDIRECT_ORIGIN: ${{ secrets.SANITY_STUDIO_FOTOWARE_REDIRECT_ORIGIN }}
      SANITY_STUDIO_FOTOWARE_REDIRECT_URI: ${{ secrets.SANITY_STUDIO_FOTOWARE_REDIRECT_URI }}
      SANITY_STUDIO_FOTOWARE_AF_EXPORT_URL: ${{ secrets.SANITY_STUDIO_FOTOWARE_AF_EXPORT_URL }}
      SANITY_STUDIO_FOTOWARE_AF_EXPORT_KEY: ${{ secrets.SANITY_STUDIO_FOTOWARE_AF_EXPORT_KEY }}
      DOCKER_BUILDKIT: 1
    steps:
      - name: Checkout 🛎️
        id: checkout-main
        uses: actions/checkout@v7
        with:
          repository: 'equinor/energyvision'
          fetch-depth: 0
          # ref: '${{ steps.get-preprod-sha.outputs.sha }}'
      - name: Get long sha ️🏷️
        id: get-long-sha
        shell: bash
        run: |
          echo "sha=$(git rev-parse ${{ github.event.inputs.image-sha }})" >> $GITHUB_OUTPUT
      - name: Checkout 🛎️
        id: checkout-specific-branch
        uses: actions/checkout@v7
        with:
          repository: 'equinor/energyvision'
          fetch-depth: 0
          ref: '${{ steps.get-long-sha.outputs.sha }}'
      - name: Install pnpm 📦
        id: install-pnpm
        uses: pnpm/action-setup@v4
      - name: Cache pnpm modules 💾
        uses: actions/setup-node@v4
        with:
          node-version: 24
          cache: 'pnpm'
      - name: Install dependencies 🔧
        id: install-dependencies
        run: |
          pnpm install
          pnpm studio install
      - name: Deploy 🚀
        id: deploy
        working-directory: ./studio
        run: |
          pnpm run deploy
        env:
          SANITY_AUTH_TOKEN: ${{ secrets.SANITY_SECRET_DEPLOY }}
      - uses: act10ns/slack@v2
        with:
          status: ${{ job.status }}
          steps: ${{ toJson(steps) }}
        if: failure()

  update-radix-config:
    needs: find-image
    runs-on: ubuntu-latest
    environment:
      name: ${{ github.event.inputs.environment }}
    if: ${{ needs.find-image.outputs.imageExists }} == true
    env:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    steps:
      - name: Checkout internal 🛎️
        id: checkout-internal
        uses: actions/checkout@v7
        with:
          repository: 'equinor/energyvision-internal'
          ref: main
          token: ${{ secrets.PADMS_PAT }} # Replace with ssh as per https://stackoverflow.com/questions/60222741/github-actions-and-git-clone-issue
      - name: Write to console 🗒️
        shell: bash
        run: |
          # Install pre-requisite
          python -m pip install --user ruamel.yaml
          python ci/upgradeEnvironment.py studio ${{ github.event.inputs.image-sha }} ${{ secrets.ENV }}
          git config --global user.name 'github'
          git config --global user.email 'padms@users.noreply.github.com'
          git remote set-url origin https://x-access-token:${{ secrets.PADMS_PAT }}@github.com/equinor/energyvision-internal
          if [[ `git status --porcelain` ]]
          then
            git commit -am "🔙 Rolling back satellite studios in ${{ github.event.inputs.environment }} to version ${{ github.event.inputs.image-sha }}"
            git pull --rebase origin main
            git push origin HEAD:main
          fi
      - uses: act10ns/slack@v2
        with:
          status: ${{ job.status }}
          steps: ${{ toJson(steps) }}
        if: failure()

  deploy:
    needs: update-radix-config
    runs-on: ubuntu-latest
    environment:
      name: ${{ github.event.inputs.environment }}
      url: https://equinor.com
    env:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
      DOCKER_BUILDKIT: 1
    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v7

      # MAIN PRODUCTION CLUSTER
      - name: Deploy to Radix  🚀
        id: deploy-main
        uses: equinor/radix-github-actions@v2
        with:
          azure_client_id: 460b889f-89e0-4cc9-965c-31f3e7770226
          version: latest

      - run: rx create job deploy
          --context platform2
          -a equinor-web-sites
          -e ${{ secrets.ENV }}
          -f
        shell: bash

      - uses: act10ns/slack@v2
        with:
          status: ${{ job.status }}
          steps: ${{ toJson(steps) }}
        if: failure()