deploy.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json

name: Deploy

on:
  workflow_call:
    inputs:
      environment:
        required: true
        description: "Name of the deployment environment (product-{dev|staging|production})"
        type: string
      github_environment:
        required: true
        description: "Name of the Github deployment environment ({app_name}-{environment})"
        type: string
      app_name:
        required: false
        description: "Name of the app, displayed in PR description"
        type: string
      app_icon:
        required: false
        description: "Icon of the app, displayed in PR description"
        type: string
      bundle_uri:
        required: true
        description: "S3 URI of the bundle in the registry bucket"
        type: string
      root_dir:
        required: false
        description: "Directory where the project root is located"
        type: string
      bundle_dir:
        required: false
        default: "dist"
        description: "Directory where the bundle should be unpacked"
        type: string
      deploy_hash:
        required: true
        description: "Hash of the code to deploy, this is usually the build hash provided from the build step"
        type: string
      bucket_name:
        required: true
        description: "Name of the S3 origin bucket"
        type: string
      domain_name:
        required: true
        description: "Domain name for the app (e.g. app.example.com)"
        type: string
      inject_config_cmd:
        required: false
        description: "Command to run to inject the environment config"
        type: string
      registry_scope:
        required: false
        default: "@pleo-io"
        description: "Org scope for the GitHub Package Registry"
        type: string
    outputs:
      deployment_url:
        description: "URL where the deployment can be accessed"
        value: ${{ jobs.deploy.outputs.deployment_url }}
      preview_url:
        description: "Permanent URL where the deployment can be accessed"
        value: ${{ jobs.deploy.outputs.preview_url }}

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-22.04
    environment:
      name: ${{ inputs.github_environment  }}
      url: ${{ steps.deployment-url.outputs.url }}
    outputs:
      deployment_url: ${{ steps.deployment-url.outputs.url }}
      preview_url: ${{ steps.preview-url.outputs.url }}
    steps:
      - uses: actions/checkout@v4.1.4

      - uses: pnpm/action-setup@v4.0.0

      - uses: actions/setup-node@v4.0.2
        with:
          node-version: "20"
          registry-url: "https://npm.pkg.github.com"
          scope: ${{ inputs.registry_scope }}

      - name: Cache node_modules/.pnpm
        uses: actions/cache@v4.2.0
        with:
          path: node_modules/.pnpm
          key: pnpm-node-modules-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            pnpm-node-modules-

      - name: Install Dependencies
        run: pnpm install --frozen-lockfile --ignore-scripts
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GH_REGISTRY_NPM_TOKEN }}

      - name: Setup AWS Credentials for Origin Bucket Access
        uses: aws-actions/configure-aws-credentials@v4.0.2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: Check version already deployed
        id: is-version-already-deployed
        run: |
          DEPLOY_EXISTS=$(aws s3 ls s3://${{ inputs.bucket_name }}/html/${{ inputs.deploy_hash }}/ || true)
          if [ -z "$DEPLOY_EXISTS" ]; then
            echo "Version ${{ inputs.deploy_hash }} not yet deployed"
            echo "is_deployed=false" >> $GITHUB_OUTPUT
          else
            echo "Version ${{ inputs.deploy_hash }} already deployed"
            echo "is_deployed=true" >> $GITHUB_OUTPUT
          fi

      # For feature preview deployments we're using the permalink as the deploy URL for the GitHub deployment
      # For deployments on the default branch we're using the domain name passed via inputs.
      - name: Get Deployment URL
        id: deployment-url
        run: |
          DEFAULT_BRANCH=${{ github.event.repository.default_branch }}
          if [[ -z "$DEFAULT_BRANCH" ]]; then
              echo "Could not determine default branch"
              exit 1
          fi
          SUBDOMAIN=$([[ $GITHUB_REF = "refs/heads/$DEFAULT_BRANCH" ]] && echo "" || echo "preview-${{ inputs.deploy_hash }}.")
          echo "url=https://${SUBDOMAIN}${{ inputs.domain_name }}" >> $GITHUB_OUTPUT

      - name: Setup AWS Credentials for Registry Bucket Access
        uses: aws-actions/configure-aws-credentials@v4.0.2
        if: ${{ steps.is-version-already-deployed.outputs.is_deployed == 'false'}}
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_FRONTEND_REGISTRY }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_FRONTEND_REGISTRY }}
          aws-region: eu-west-1

      - name: Download & Unpack Bundle
        if: ${{ steps.is-version-already-deployed.outputs.is_deployed == 'false'}}
        run: |
          aws s3 cp ${{ inputs.bundle_uri }} bundle.tar.gz
          mkdir ${{ inputs.bundle_dir }} && tar -xvzf bundle.tar.gz -C ${{ inputs.bundle_dir }}

      - name: Setup AWS Credentials for Origin Bucket Access
        uses: aws-actions/configure-aws-credentials@v4.0.2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: Inject Environment Config
        if: ${{ inputs.inject_config_cmd && steps.is-version-already-deployed.outputs.is_deployed == 'false'}}
        env:
          NODE_AUTH_TOKEN: ${{ secrets.GH_REGISTRY_NPM_TOKEN }}
          SPA_ROOT_DIR: ${{ inputs.root_dir }}
          SPA_BUNDLE_DIR: ${{ inputs.bundle_dir }}
          SPA_ENV: ${{ inputs.environment }}
          SPA_TREE_HASH: ${{ inputs.deploy_hash }}
        run: ${{ inputs.inject_config_cmd }}

      - name: Copy Static Files
        if: ${{ steps.is-version-already-deployed.outputs.is_deployed == 'false'}}
        run: |
          aws s3 cp ${{ inputs.bundle_dir }}/static s3://${{ inputs.bucket_name }}/static \
            --cache-control 'public,max-age=31536000,immutable' \
            --recursive

      - name: Copy HTML Files
        if: ${{ steps.is-version-already-deployed.outputs.is_deployed == 'false'}}
        run: |
          aws s3 cp ${{ inputs.bundle_dir }}/ s3://${{ inputs.bucket_name }}/html/${{ inputs.deploy_hash }} \
           --cache-control 'public,max-age=31536000,immutable' \
           --recursive \
           --exclude "static/*"

      - name: Update .well-known Files If Exists
        if: ${{ steps.is-version-already-deployed.outputs.is_deployed == 'false'}}
        run: |
          aws s3 cp \
           s3://${{ inputs.bucket_name }}/html/${{ inputs.deploy_hash }}/.well-known/apple-app-site-association \
           s3://${{ inputs.bucket_name }}/html/${{ inputs.deploy_hash }}/.well-known/apple-app-site-association \
           --content-type 'application/json' \
           --cache-control 'public,max-age=3600' \
           --metadata-directive REPLACE || echo "Failed updating .well-known files"

      # We always copy deploy hash file even if we don't do an actual deployemnt as part of this commit
      # This is used to identify which version of the deployed app is associated with the current commit
      # In case we trigger rollback to this commit, we know what deployment to use based on the stored deploy_hash for this commit
      - name: Copy Deploy Hash File
        run: |
          echo ${{ inputs.deploy_hash }} >> ${{ github.sha }}
          aws s3 cp ${{ github.sha }} s3://${{ inputs.bucket_name }}/deploys/commits/${{ github.sha }}

      - name: Update Cursor File
        id: cursor-update
        uses: pleo-io/spa-tools/actions/cursor-deploy@spa-github-actions-v10.1.0
        if: ${{ steps.is-version-already-deployed.outputs.is_deployed == 'false' || github.ref_name == github.event.repository.default_branch }}
        with:
          bucket_name: ${{ inputs.bucket_name }}

      - name: Get Preview Url
        id: preview-url
        run: |
          preview_url="https://${{ steps.cursor-update.outputs.branch_label }}.${{ inputs.domain_name }}"
          echo "Permanent preview url $preview_url"
          echo "url=$preview_url" >> $GITHUB_OUTPUT

      - name: Update PR Description
        uses: pleo-io/spa-tools/actions/post-preview-urls@spa-github-actions-v10.1.0
        if: ${{ github.event_name == 'pull_request' && inputs.app_name && steps.is-version-already-deployed.outputs.is_deployed == 'false' }}
        with:
          app_name: ${{ inputs.app_name }}
          app_icon: ${{ inputs.app_icon }}
          as_labels: true
          links: |
            [
              {"name": "${{ inputs.app_name }} preview", "url": "${{ steps.preview-url.outputs.url }}"},
              {"name": "Current Permalink", "url": "${{ steps.deployment-url.outputs.url }}"}
            ]

      - name: Verify app deployment
        if: ${{ steps.is-version-already-deployed.outputs.is_deployed == 'false'}}
        # We expect the viewer-request lambda to add the version in the response headers
        run: curl --silent --head --show-error ${{ steps.deployment-url.outputs.url }} | grep -q ${{ inputs.deploy_hash }}