deploy.yml

name: Deploy Compose Runner Stack

on:
  release:
    types: [published]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      ECS_IMAGE_REPOSITORY: compose-runner-ecs
      LAMBDA_IMAGE_REPOSITORY: compose-runner-lambda

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          registry-url: "https://registry.npmjs.org"

      - name: Install CDK dependencies
        working-directory: infra/cdk
        run: |
          python -m venv .venv
          source .venv/bin/activate
          pip install -r requirements.txt

      - name: Install AWS CDK CLI
        run: npm install -g aws-cdk@2.1107.0 --registry=https://registry.npmjs.org

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Deploy image repository stack
        working-directory: infra/cdk
        env:
          VERSION: ${{ github.event.release.tag_name }}
        run: |
          source .venv/bin/activate
          cdk deploy \
            ComposeRunnerImageRepositoriesStack \
            -c composeRunnerVersion=${VERSION} \
            --require-approval never

      - name: Verify ComposeRunnerStack does not synthesize CDK Docker assets
        working-directory: infra/cdk
        env:
          VERSION: ${{ github.event.release.tag_name }}
        run: |
          source .venv/bin/activate
          rm -rf /tmp/compose-runner-cdk-verify
          cdk synth \
            ComposeRunnerStack \
            --output /tmp/compose-runner-cdk-verify \
            -c composeRunnerVersion=${VERSION} >/dev/null
          jq -e '(.dockerImages // {}) | length == 0' \
            /tmp/compose-runner-cdk-verify/ComposeRunnerStack.assets.json >/dev/null || {
              echo "ComposeRunnerStack synthesized Docker image assets; deployment would require the CDK bootstrap ECR repository."
              cat /tmp/compose-runner-cdk-verify/ComposeRunnerStack.assets.json
              exit 1
          }

      - name: Log in to Amazon ECR
        run: |
          AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
          ECR_REGISTRY="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
          echo "ECR_REGISTRY=${ECR_REGISTRY}" >> "$GITHUB_ENV"
          aws ecr get-login-password | docker login --username AWS --password-stdin "$ECR_REGISTRY"

      - name: Build and push release images
        env:
          VERSION: ${{ github.event.release.tag_name }}
        run: |
          if [ -z "$VERSION" ]; then
            echo "Release tag name is required to publish ECR images"
            exit 1
          fi

          ECS_IMAGE_URI="${ECR_REGISTRY}/${ECS_IMAGE_REPOSITORY}:${VERSION}"
          LAMBDA_IMAGE_URI="${ECR_REGISTRY}/${LAMBDA_IMAGE_REPOSITORY}:${VERSION}"

          docker build \
            --file Dockerfile \
            --build-arg COMPOSE_RUNNER_VERSION="${VERSION}" \
            --tag "${ECS_IMAGE_URI}" \
            .
          docker push "${ECS_IMAGE_URI}"

          docker build \
            --file aws_lambda/Dockerfile \
            --build-arg COMPOSE_RUNNER_VERSION="${VERSION}" \
            --tag "${LAMBDA_IMAGE_URI}" \
            .
          docker push "${LAMBDA_IMAGE_URI}"

      - name: Deploy CDK stack
        working-directory: infra/cdk
        env:
          RESULTS_PREFIX: compose-runner/results
          TASK_CPU: 4096
          TASK_MEMORY_MIB: 30720
          STATE_MACHINE_TIMEOUT_SECONDS: 7200
          VERSION: ${{ github.event.release.tag_name }}
        run: |
          source .venv/bin/activate
          cdk deploy \
            ComposeRunnerStack \
            --require-approval never \
            --outputs-file cdk-outputs.json \
            -c composeRunnerVersion=${VERSION} \
            -c resultsPrefix=${RESULTS_PREFIX} \
            -c taskCpu=${TASK_CPU} \
            -c taskMemoryMiB=${TASK_MEMORY_MIB} \
            -c stateMachineTimeoutSeconds=${STATE_MACHINE_TIMEOUT_SECONDS}

      - name: Smoke test submission and status endpoints
        working-directory: infra/cdk
        run: |
          SUBMIT_URL=$(jq -r '.ComposeRunnerStack.ComposeRunnerSubmitFunctionUrl' cdk-outputs.json)
          STATUS_URL=$(jq -r '.ComposeRunnerStack.ComposeRunnerStatusFunctionUrl' cdk-outputs.json)
          if [ -z "$SUBMIT_URL" ] || [ "$SUBMIT_URL" = "null" ]; then
            echo "Submit Function URL not found in outputs"
            exit 1
          fi
          if [ -z "$STATUS_URL" ] || [ "$STATUS_URL" = "null" ]; then
            echo "Status Function URL not found in outputs"
            exit 1
          fi

          body='{"meta_analysis_id": "pFGy6g3LRo9x", "environment": "production", "no_upload": true}'
          response=$(curl -s -w "\n%{http_code}" -X POST "$SUBMIT_URL" -H "Content-Type: application/json" -d "$body")
          submit_code=$(echo "$response" | tail -n1)
          submit_json=$(echo "$response" | head -n1)
          echo "$submit_json" > smoke_submit.json
          echo "Submit status code: $submit_code"
          if [ "$submit_code" != "202" ]; then
            echo "Submit endpoint failed: $submit_json"
            exit 1
          fi
          job_id=$(jq -r '.job_id' smoke_submit.json)
          artifact_prefix=$(jq -r '.artifact_prefix' smoke_submit.json)
          if [ -z "$job_id" ] || [ "$job_id" = "null" ]; then
            echo "Submit response missing job_id: $submit_json"
            exit 1
          fi
          if [ -z "$artifact_prefix" ] || [ "$artifact_prefix" = "null" ]; then
            echo "Submit response missing artifact_prefix: $submit_json"
            exit 1
          fi

          status_body=$(printf '{"job_id":"%s"}' "$job_id")
          status_response=$(curl -s -w "\n%{http_code}" -X POST "$STATUS_URL" -H "Content-Type: application/json" -d "$status_body")
          status_code=$(echo "$status_response" | tail -n1)
          status_json=$(echo "$status_response" | head -n1)
          echo "$status_json" > smoke_status.json
          echo "Status status code: $status_code"
          if [ "$status_code" != "200" ]; then
            echo "Status endpoint failed: $status_json"
            exit 1
          fi
          status_value=$(jq -r '.status' smoke_status.json)
          if [ "$status_value" = "null" ] || [ -z "$status_value" ]; then
            echo "Status response missing status: $status_json"
            exit 1
          fi

      - name: Garbage collect unused CDK bootstrap S3 assets
        working-directory: infra/cdk
        run: |
          source .venv/bin/activate
          AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
          cdk gc \
            "aws://${AWS_ACCOUNT_ID}/${AWS_REGION}" \
            --unstable=gc \
            --type=s3 \
            --action=full \
            --created-buffer-days=7 \
            --rollback-buffer-days=30 \
            --confirm false