_osdc-deploy.yml

name: "~ OSDC: Deploy (reusable)"

on:
  workflow_call:
    inputs:
      cluster:
        description: "Cluster id from clusters.yaml (e.g. meta-staging-aws-uw1, meta-prod-aws-ue2)"
        required: true
        type: string
      environment:
        description: "GitHub environment for deployment gating (empty = no gate)"
        required: false
        type: string
        default: ""
      use_lf_credentials:
        description: "Use LF_AWS_DEPLOY_ROLE_ARN secret instead of Meta AWS credentials"
        required: false
        type: boolean
        default: false
      taint_nodes:
        description: "Taint ARC runner nodes with NoSchedule before deploy for graceful refresh"
        required: false
        type: boolean
        default: true
      run_smoke:
        description: "Run smoke tests after deploy"
        required: false
        type: boolean
        default: true
      run_integration:
        description: "Run integration tests after deploy (requires CANARY_GITHUB_TOKEN)"
        required: false
        type: boolean
        default: true
      restart_listeners:
        description: "Delete and recreate ARC listeners after deploy (required when controller image changes)"
        required: false
        type: boolean
        default: false
      skip_lint_test:
        description: "Skip `just lint` and `just test` pre-flight checks (firefighting only)"
        required: false
        type: boolean
        default: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    name: Deploy ${{ inputs.cluster }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    timeout-minutes: 180
    # Serialize all tofu state-mutating work per cluster. Shared with
    # _osdc-plan.yml so plan and deploy against the same cluster never
    # race on the DynamoDB state lock.
    concurrency:
      group: osdc-tofu-${{ inputs.cluster }}
      cancel-in-progress: false
    defaults:
      run:
        working-directory: osdc
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install just
        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3.1.0

      - name: Install mise
        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
        with:
          version: "2026.5.11"
          install: true
          working_directory: osdc

      - name: Install Python dependencies
        run: uv sync

      - name: Lint
        if: ${{ !inputs.skip_lint_test }}
        run: just lint

      - name: Test
        if: ${{ !inputs.skip_lint_test }}
        run: just test

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
        with:
          role-to-assume: ${{ inputs.use_lf_credentials && secrets.LF_AWS_DEPLOY_ROLE_ARN || format('arn:aws:iam::{0}:role/{1}', secrets.META_AWS_ACC_ID, secrets.META_AWS_DEPLOY_ROLE) }}
          aws-region: us-west-1
          role-duration-seconds: 7200

      # Register QEMU binfmt handlers so `docker build --platform linux/arm64`
      # works on an amd64 runner. The base deploy builds image-cache-janitor
      # (and node-compactor) for both archs; whenever the content-addressed
      # tag changes (Dockerfile edit, etc.) the build branch runs and needs
      # cross-arch emulation.
      - name: Set up QEMU for cross-arch builds
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0

      - name: Deploy ${{ inputs.cluster }}
        run: just deploy "${{ inputs.cluster }}"
        env:
          OSDC_CONFIRM: "yes"
          # smoke runs as a dedicated job below, skip the in-deploy step
          OSDC_SMOKE: "no"
          OSDC_TAINT_NODES: ${{ inputs.taint_nodes && 'yes' || 'no' }}
          ARC_RESTART_LISTENERS: ${{ inputs.restart_listeners && 'yes' || 'no' }}

  smoke:
    name: Smoke tests
    needs: deploy
    if: ${{ inputs.run_smoke }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    timeout-minutes: 30
    defaults:
      run:
        working-directory: osdc
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install just
        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3.1.0

      - name: Install mise
        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
        with:
          version: "2026.5.11"
          install: true
          working_directory: osdc

      - name: Install Python dependencies
        run: uv sync

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
        with:
          role-to-assume: ${{ inputs.use_lf_credentials && secrets.LF_AWS_DEPLOY_ROLE_ARN || format('arn:aws:iam::{0}:role/{1}', secrets.META_AWS_ACC_ID, secrets.META_AWS_DEPLOY_ROLE) }}
          aws-region: us-west-1
          role-duration-seconds: 7200

      - name: Run smoke tests
        run: just smoke "${{ inputs.cluster }}"

  integration:
    name: Integration tests
    needs: deploy
    if: ${{ inputs.run_integration }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    timeout-minutes: 60
    defaults:
      run:
        working-directory: osdc
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install just
        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3.1.0

      - name: Install mise
        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
        with:
          version: "2026.5.11"
          install: true
          working_directory: osdc

      - name: Install Python dependencies
        run: uv sync

      - name: Verify gh CLI
        run: gh --version
        env:
          GH_TOKEN: ${{ secrets.CANARY_GITHUB_TOKEN }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
        with:
          role-to-assume: ${{ inputs.use_lf_credentials && secrets.LF_AWS_DEPLOY_ROLE_ARN || format('arn:aws:iam::{0}:role/{1}', secrets.META_AWS_ACC_ID, secrets.META_AWS_DEPLOY_ROLE) }}
          aws-region: us-west-1
          role-duration-seconds: 7200

      - name: Run integration tests
        run: just integration-test "${{ inputs.cluster }}" --skip-drain --skip-smoke --skip-compactor
        env:
          GH_TOKEN: ${{ secrets.CANARY_GITHUB_TOKEN }}