prisma-decision-api/.github/workflows/promote-to-prod-and-public.yml at a81429579ef53882947774ed005770a20d48f2cd · equinor/prisma-decision-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: Promote test to prod and public

on:
    push:
        tags:
            - "v*"

permissions: {}

jobs:
    resolve-tag:
        runs-on: ubuntu-latest
        permissions: {}
        outputs:
            tag: ${{ steps.resolve.outputs.tag }}
        steps:
            - name: Resolve tag to promote
              id: resolve
              run: |
                  TAG="${GITHUB_REF#refs/tags/}"
                  if [ -z "$TAG" ] || [ "$TAG" = "$GITHUB_REF" ]; then
                    echo "::error::No tag found in GITHUB_REF"
                    exit 1
                  fi
                  echo "tag=$TAG" >> "$GITHUB_OUTPUT"
                  echo "Promoting tag: $TAG"

    check-migrations:
        runs-on: ubuntu-latest
        permissions:
            contents: read
        outputs:
            has_changes: ${{ steps.check.outputs.has_changes }}
        steps:
            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
              with:
                  fetch-depth: 0
                  persist-credentials: false
            - name: Check for new migrations since last tag
              id: check
              run: |
                  CURRENT_TAG=${GITHUB_REF#refs/tags/}
                  PREVIOUS_TAG=$(git tag --sort=-creatordate | grep -v "$CURRENT_TAG" | head -n 1)
                  if [ -z "$PREVIOUS_TAG" ]; then
                    echo "has_changes=true" >> $GITHUB_OUTPUT
                  elif git diff --name-status "$PREVIOUS_TAG" "$CURRENT_TAG" -- PrismaDotnetApi/SqlServerMigrations/ | grep -q .; then
                    echo "has_changes=true" >> $GITHUB_OUTPUT
                  else
                    echo "has_changes=false" >> $GITHUB_OUTPUT
                  fi

    migrate-prod:
        needs: [resolve-tag, check-migrations]
        if: needs.check-migrations.outputs.has_changes == 'true'
        permissions:
            id-token: write
            contents: read
        uses: ./.github/workflows/run-migration.yml
        with:
            env-name: Production
        secrets:
            AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
            AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
            AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
            AZURE_RESOURCE_GROUP: ${{ secrets.AZURE_RESOURCE_GROUP }}
            AZURE_SQL_SERVER_NAME: ${{ secrets.AZURE_SQL_SERVER_NAME }}

    migrate-public:
        needs: [resolve-tag, check-migrations, migrate-prod]
        if: needs.check-migrations.outputs.has_changes == 'true'
        permissions:
            id-token: write
            contents: read
        uses: ./.github/workflows/run-migration.yml
        with:
            env-name: Public
        secrets:
            AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
            AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
            AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
            AZURE_RESOURCE_GROUP: ${{ secrets.AZURE_RESOURCE_GROUP }}
            AZURE_SQL_SERVER_NAME: ${{ secrets.AZURE_SQL_SERVER_NAME }}

    deploy-prod:
        if: always() && needs.resolve-tag.result == 'success' && (needs.migrate-prod.result == 'success' || needs.migrate-prod.result == 'skipped')
        needs: [resolve-tag, migrate-prod]
        runs-on: ubuntu-latest
        permissions:
            contents: write
        environment: prod
        steps:
            - name: Checkout
              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
              with:
                  persist-credentials: true
                  fetch-depth: 0
                  fetch-tags: true

            - name: Create prod-deploy tag
              env:
                  TAG: ${{ needs.resolve-tag.outputs.tag }}
              run: |
                  PROD_TAG="prod-deploy-${TAG}"
                  git tag "$PROD_TAG" "${TAG}"
                  git push origin "$PROD_TAG"
                  echo "Created and pushed tag: $PROD_TAG"

    deploy-public:
        needs: [resolve-tag, migrate-public, deploy-prod]
        if: always() && needs.resolve-tag.result == 'success' && needs.deploy-prod.result == 'success' && (needs.migrate-public.result == 'success' || needs.migrate-public.result == 'skipped')
        runs-on: ubuntu-latest
        permissions:
            contents: write
        environment: public
        steps:
            - name: Checkout
              uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
              with:
                  persist-credentials: true
                  fetch-depth: 0
                  fetch-tags: true

            - name: Create public-deploy tag
              env:
                  TAG: ${{ needs.resolve-tag.outputs.tag }}
              run: |
                  PUBLIC_TAG="public-deploy-${TAG}"
                  git tag "$PUBLIC_TAG" "${TAG}"
                  git push origin "$PUBLIC_TAG"
                  echo "Created and pushed tag: $PUBLIC_TAG"
                  echo "Created and pushed tag: $PUBLIC_TAG"