ci-cd.yml

name: CI/CD

on:
  push:
    tags: ["v*"]
    branches:
      - main
  pull_request:
    branches:
      - main

permissions: read-all

# https://github.com/marketplace/actions/docker-layer-caching
jobs:
  code-quality:
    permissions:
      # For trunk to post annotations
      checks: write
      # For repo checkout
      contents: read
    uses: climatepolicyradar/reusable-workflows/.github/workflows/python-precommit-validator.yml@main

  test:
    runs-on: ubuntu-latest
    steps:
      - name: Install latest Docker Compose
        uses: ndeloof/install-compose-action@v0.0.1
        with:
          legacy: false

      - uses: actions/checkout@v4

      - name: Configure test env variables
        run: cp .env.example .env

      - name: Build docker compose
        run: make build_dev

      - name: Run Unit Tests
        run: make unit_test

      - name: Run Integration Tests
        run: make integration_test

  check-auto-tagging-will-work:
    if: ${{ ! startsWith(github.ref, 'refs/tags') && ! startsWith(github.ref, 'refs/heads/main') }}
    runs-on: ubuntu-latest
    steps:
      - name: Dump GitHub context
        shell: sh
        env:
          PR_BODY: "${{ github.event.pull_request.body }}"
          PR_NUMBER: "${{ github.event.pull_request.number }}"
        run: |
          echo "$PR_BODY"
          echo "$PR_NUMBER"

      - name: Determine new tag version
        id: determine_next_tag_from_pr
        uses: climatepolicyradar/get-next-tag-from-pr-body@main
        # User controlled input needs to be santitised beforehand e.g., by adding an
        # intermediate env var to prevent the workflow being exposed to a critical
        # command injection attack
        env:
          PR_BODY: "${{ github.event.pull_request.body }}"
          PR_NUMBER: "${{ github.event.pull_request.number }}"
        with:
          pr_body: "${{ env.pr_body }}"
          pr_number: ${{ env.pr_number }}

      # - name: Echo next tag
      #   run: echo ${{ steps.determine_next_tag_from_pr.outputs.new_tag }}

  build:
    if: ${{ ! startsWith(github.ref, 'refs/tags') }}
    runs-on: ubuntu-latest
    needs:
      - code-quality
      - test
    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: make build

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Publish initial image based on branch to ECR
        env:
          DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        shell: bash
        run: |
          if [[ "${GITHUB_REF}" == "refs/heads"* ]]; then
            branch="${GITHUB_REF/refs\/heads\//}"
            if [[ "${branch}" = "main" ]]; then
              docker_tag=latest
              docker tag navigator-admin-backend "$ECR_REGISTRY/navigator-admin-backend:${docker_tag}"
              docker push "$ECR_REGISTRY/navigator-admin-backend:${docker_tag}"
            fi
          elif [[ "${GITHUB_REF}" != "refs/tags"* ]]; then
            echo "Assuming '${GITHUB_HEAD_REF}' is a branch"
            if [[ -n "${GITHUB_HEAD_REF}" ]]; then
                branch="$(echo ${GITHUB_HEAD_REF}| tr -c '[0-9,A-Z,a-z]' '-')"
                timestamp=$(date --utc -Iseconds | cut -c1-19 | tr -c '[0-9]T\n' '-')
                short_sha=${GITHUB_SHA:0:8}
                docker_tag="${branch}-${timestamp}-${short_sha}"
                docker tag navigator-admin-backend "$ECR_REGISTRY/navigator-admin-backend:${docker_tag}"
                docker push "$ECR_REGISTRY/navigator-admin-backend:${docker_tag}"
            fi
          fi

  manual-semver:
    needs:
      - code-quality
      - test
    if: ${{ startsWith(github.ref, 'refs/tags') }}
    uses: climatepolicyradar/reusable-workflows/.github/workflows/semver.yml@main
    secrets: inherit
    with:
      repo-name: navigator-admin-backend
      semver-tag: main-${GITHUB_SHA::8}

  tag:
    needs: build
    permissions:
      contents: write
    uses: climatepolicyradar/reusable-workflows/.github/workflows/tag.yml@main
    with:
      repo-name: navigator-admin-backend
      semver-tag: main-${GITHUB_SHA::8}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}

  release:
    needs: tag
    permissions:
      contents: write
    uses: climatepolicyradar/reusable-workflows/.github/workflows/release.yml@main
    with:
      new_tag: ${{ needs.tag.outputs.new_tag }}