build.yml

name: Build

on:
  push:
    branches: 
      - develop
      - main
      - 'release/**'
      - 'feature/**'
      - 'issue/**'
      - 'issues/**'
      - 'dependabot/**'
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  PYTHON_VERSION: '3.12'
  POETRY_VERSION: '2.3.2'
  TERRAFORM_VERSION: '1.5.3'

jobs:
  build:
    name: Build, Test, and Publish
    runs-on: ubuntu-latest

    permissions:
      contents: write
      packages: write
      id-token: write

    outputs:
      new_version: ${{ steps.build-outputs.outputs.new_version }}
      pyproject_name: ${{ steps.build-outputs.outputs.pyproject_name }}
      target_env_uppercase: ${{ steps.build-outputs.outputs.target_env_uppercase }}
      target_env_lowercase: ${{ steps.build-outputs.outputs.target_env_lowercase }}
      source: ${{ steps.build-outputs.outputs.source }}

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0  # Needed for proper versioning
      
      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'
      
      - name: Setup Poetry
        uses: abatilo/actions-poetry@v4
        with:
          poetry-version: ${{ env.POETRY_VERSION }}
      
      - name: Configure Poetry
        run: |
          poetry config virtualenvs.in-project true
      
      - name: Cache Poetry dependencies
        uses: actions/cache@v4
        with:
          path: .venv
          key: poetry-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}

      - name: Version Management
        id: versioning
        run: |
          current_version=$(poetry version -s)
          base_version=$(echo "$current_version" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
          pyproject_name=$(poetry version | awk '{print $1}')

          # Version calculation based on branch
          if [[ "${{ github.ref }}" =~ ^refs/heads/(issue|feature|dependabot)/ ]]; then
            TIMESTAMP=$(date -u +"%Y%m%d%H%M")
            new_version="${base_version}a${TIMESTAMP}"
            echo "TARGET_ENV_UPPERCASE=SIT" >> $GITHUB_ENV
          elif [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then
            echo "TARGET_ENV_UPPERCASE=SIT" >> $GITHUB_ENV
            new_version=$(poetry version prerelease -s)
          elif [[ "${{ github.ref }}" =~ ^refs/heads/release/ ]]; then
            echo "TARGET_ENV_UPPERCASE=UAT" >> $GITHUB_ENV
            if [[ ${current_version} =~ rc ]]; then
              new_version=$(poetry version prerelease -s)
            else
              new_version="${GITHUB_REF#refs/heads/release/}rc1"
            fi
          elif [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
            echo "TARGET_ENV_UPPERCASE=OPS" >> $GITHUB_ENV
            new_version=${base_version}
          fi
          
          echo "new_version=${new_version}" >> $GITHUB_ENV
          echo "pyproject_name=${pyproject_name}" >> $GITHUB_ENV
          poetry version ${new_version}

      - name: Run Snyk as a blocking step
        uses: snyk/actions/python@master
        env:
            SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: test
          args: >
              --org=${{ secrets.SNYK_ORG_ID }}
              --project-name=${{ github.repository }}
              --severity-threshold=high
              --fail-on=all

      - name: Run Snyk on Python
        uses: snyk/actions/python@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: monitor
          args: >
            --org=${{ secrets.SNYK_ORG_ID }}
            --project-name=${{ github.repository }}
  
      - name: Run Poetry
        run: |
          poetry build
          poetry install
          poetry run pylint podaac
          poetry run flake8 podaac
          poetry run pytest --junitxml=build/reports/pytest.xml --cov=podaac/ --cov-report=html -m "not aws and not integration" tests/

      - name: Quick check for changes
        id: check_changes
        if: |
          github.ref == 'refs/heads/develop' ||
          github.ref == 'refs/heads/main'    ||
          startsWith(github.ref, 'refs/heads/release')
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "changes=true" >> $GITHUB_OUTPUT
          else
            echo "changes=false" >> $GITHUB_OUTPUT
          fi
      
      - name: Commit Version Bump
        # If building develop, a release branch, or main then we commit the version bump back to the repo
        if: steps.check_changes.outputs.changes == 'true'
        run: |
          git config user.name "${GITHUB_ACTOR}"
          git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
          git commit -am "/version ${{ env.new_version }}"
          git push

      - name: Push Tag
        env:
          VERSION: ${{ env.new_version }}
        if: |
          github.ref == 'refs/heads/develop' ||
          github.ref == 'refs/heads/main'    ||
          startsWith(github.ref, 'refs/heads/release')
        run: |
          git config user.name "${GITHUB_ACTOR}"
          git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
          git tag -a "${VERSION}" -m "Version ${VERSION}"
          git push origin "${VERSION}"

      - name: Create Zip release
        run: |
          cd terraform
          zip -r ../tig-terraform-${{ env.new_version }}.zip *

      - name: Upload Release Artifacts
        if: |
          github.ref == 'refs/heads/develop' ||
          github.ref == 'refs/heads/main'    ||
          startsWith(github.ref, 'refs/heads/release') ||
          github.event.head_commit.message == '/deploy sit' ||
          github.event.head_commit.message == '/deploy uat'
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ env.new_version }}
          artifacts: "*.zip"
          token: ${{ secrets.GITHUB_TOKEN }}
          body: "Version ${{ env.new_version }}"
          makeLatest: "${{ github.ref == 'refs/heads/main' }}"
          prerelease: "${{ github.ref != 'refs/heads/main' }}"

      - name: Publish to test.pypi.org
        id: pypi-test-publish
        if: |
          github.ref == 'refs/heads/develop' ||
          startsWith(github.ref, 'refs/heads/release') ||
          github.event.head_commit.message == '/deploy sit' ||
          github.event.head_commit.message == '/deploy uat'
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/

      - name: Publish to pypi.org
        if: |
          github.ref == 'refs/heads/main'
        id: pypi-publish
        uses: pypa/gh-action-pypi-publish@release/v1

      - name: Wait for package
        if: |
          github.ref == 'refs/heads/develop' ||
          github.ref == 'refs/heads/main' ||
          startsWith(github.ref, 'refs/heads/release/') ||
          github.event.head_commit.message == '/deploy sit' ||
          github.event.head_commit.message == '/deploy uat'
        run: |
          pip install tenacity logging 
          python3 ${GITHUB_WORKSPACE}/.github/workflows/wait-for-pypi.py ${{env.pyproject_name}}[harmony]==${{ env.new_version }}

      - name: Deploy Env Override
        if: |
          github.event.head_commit.message == '/deploy sit' ||
          github.event.head_commit.message == '/deploy uat'
        run: |
          message="${{ github.event.head_commit.message }}"
          trimmed_message=${message:1}  # Remove leading slash
          override_env=$(echo "$trimmed_message" | grep -oE '[^[:space:]]+$')
          override_env_upper=$(echo "$trimmed_message" | awk '{print toupper($NF)}')
          echo "THE_ENV=${override_env}" >> $GITHUB_ENV
          echo "TARGET_ENV_UPPERCASE=${override_env_upper}" >> $GITHUB_ENV

      - name: Lower Case Target Env
        run: |
          original_env_value="${TARGET_ENV_UPPERCASE}"
          lowercase_value=$(echo "${original_env_value}" | tr '[:upper:]' '[:lower:]')
          echo "TARGET_ENV_LOWERCASE=${lowercase_value}" >> $GITHUB_ENV

      - name: Set Build Source
        id: set-source
        run: |
          # Use test PyPI package format (Dockerfile will find it via extra-index-url)
          echo "SOURCE=${{ env.pyproject_name }}==${{ env.new_version }}" >> $GITHUB_ENV

      - name: Set build outputs
        id: build-outputs
        run: |
          echo "new_version=${{ env.new_version }}" >> $GITHUB_OUTPUT
          echo "pyproject_name=${{ env.pyproject_name }}" >> $GITHUB_OUTPUT
          echo "target_env_uppercase=${{ env.TARGET_ENV_UPPERCASE }}" >> $GITHUB_OUTPUT
          echo "target_env_lowercase=${{ env.TARGET_ENV_LOWERCASE }}" >> $GITHUB_OUTPUT
          echo "source=${{ env.SOURCE }}" >> $GITHUB_OUTPUT

      - name: Upload terraform zip artifact
        if: |
          github.ref == 'refs/heads/develop' ||
          github.ref == 'refs/heads/main'    ||
          startsWith(github.ref, 'refs/heads/release') ||
          github.event.head_commit.message == '/deploy sit' ||
          github.event.head_commit.message == '/deploy uat'
        uses: actions/upload-artifact@v4
        with:
          name: terraform-zip
          path: tig-terraform-${{ env.new_version }}.zip
          retention-days: 1

  deploy:
    name: Deploy Docker and Terraform
    runs-on: ubuntu-24.04-arm
    needs: build
    if: |
      github.ref == 'refs/heads/develop' ||
      github.ref == 'refs/heads/main'    ||
      startsWith(github.ref, 'refs/heads/release') ||
      github.event.head_commit.message == '/deploy sit' ||
      github.event.head_commit.message == '/deploy uat'
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Set deployment variables from build outputs
        run: |
          echo "NEW_VERSION=${{ needs.build.outputs.new_version }}" >> $GITHUB_ENV
          echo "PYPROJECT_NAME=${{ needs.build.outputs.pyproject_name }}" >> $GITHUB_ENV
          echo "TARGET_ENV_UPPERCASE=${{ needs.build.outputs.target_env_uppercase }}" >> $GITHUB_ENV
          echo "TARGET_ENV_LOWERCASE=${{ needs.build.outputs.target_env_lowercase }}" >> $GITHUB_ENV
          echo "SOURCE=${{ needs.build.outputs.source }}" >> $GITHUB_ENV

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=${{ github.ref == 'refs/heads/main' }}
          tags: |
            type=pep440,pattern={{version}},value=${{ env.NEW_VERSION }}
            type=raw,value=${{ env.TARGET_ENV_LOWERCASE }}

      - name: Build and Push Docker Image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/lambdaDockerfileArm
          push: true
          pull: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/arm64
          build-args: |
            SOURCE=${{ env.SOURCE }}

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.3

      - name: Get Docker image tag
        id: docker-tag
        run: |
          # Extract the first tag (version tag) from metadata output
          DOCKER_IMAGE_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n1)
          echo "DOCKER_IMAGE_TAG=${DOCKER_IMAGE_TAG}" >> $GITHUB_ENV
          echo "DOCKER_IMAGE_TAG=${DOCKER_IMAGE_TAG}" >> $GITHUB_OUTPUT

      - name: Deploy Terraform
        working-directory: terraform_deploy/
        env:
          AWS_ACCESS_KEY_ID:       ${{ secrets[format('AWS_ACCESS_KEY_ID_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }}
          AWS_SECRET_ACCESS_KEY:   ${{ secrets[format('AWS_SECRET_ACCESS_KEY_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }}
          AWS_ACCOUNT_ID:          ${{ secrets[format('AWS_ACCOUNT_ID_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }}
          AWS_DEFAULT_REGION:      us-west-2

          TF_VAR_tig_docker_image: ${{ env.DOCKER_IMAGE_TAG }}
          TF_VAR_EARTH_DATA_LOGIN_CLIENT_ID: ${{ secrets[format('EARTH_DATA_LOGIN_CLIENT_ID_{0}', env.TARGET_ENV_UPPERCASE)] }}
          TF_VAR_EARTH_DATA_LOGIN_PASSWORD: ${{ secrets[format('EARTH_DATA_LOGIN_PASSWORD_{0}', env.TARGET_ENV_UPPERCASE)] }}
        run: |
          python3 override.py https://github.com/podaac/tig/releases/download/${{ env.NEW_VERSION }}/tig-terraform-${{ env.NEW_VERSION }}.zip "${{ env.DOCKER_IMAGE_TAG }}"
          source bin/config.sh ${{ env.TARGET_ENV_LOWERCASE }}
          terraform plan -var-file=tfvars/"${{ env.TARGET_ENV_LOWERCASE }}".tfvars -var="app_version=${{ env.NEW_VERSION }}" -out="tfplan"
          terraform apply -auto-approve tfplan > /dev/null