ci-cd.yml

name: CI/CD

on:
  push:
    tags: [v*]
    branches:
      - main
  pull_request:
    # By default, a workflow only runs when a pull_request event's activity type is opened,
    # synchronize, or reopened.
    types: [opened, synchronize, reopened, edited]
    branches:
      - main

permissions: read-all

jobs:
  check-auto-tagging-will-work:
    if: |
      github.event_name == 'pull_request' &&
      (! startsWith(github.ref, 'refs/tags') && ! startsWith(github.ref, 'refs/heads/main'))
    uses: climatepolicyradar/reusable-workflows/.github/workflows/check-auto-tagging-will-work.yml@v3

  code-quality:
    if: |
      always() &&
      (needs.check-auto-tagging-will-work.result == 'skipped' || needs.check-auto-tagging-will-work.result == 'success')
    needs:
      - check-auto-tagging-will-work
    permissions:
      # For trunk to post annotations
      checks: write
      # For repo checkout
      contents: read
    uses: climatepolicyradar/reusable-workflows/.github/workflows/python-precommit-validator.yml@v3

  test:
    if: |
      always() &&
      (needs.check-auto-tagging-will-work.result == 'skipped' || needs.check-auto-tagging-will-work.result == 'success')
    needs:
      - check-auto-tagging-will-work
    runs-on: ubuntu-latest
    steps:
      - name: Install latest Docker Compose
        uses: ndeloof/install-compose-action@v0.0.1
        with:
          legacy: false

      - uses: actions/checkout@v4

      - name: Configure test env variables
        run: cp .env.example .env

      - name: Build docker compose
        run: make build_dev

      - name: Run Unit & Integration Tests
        run: make test

  build:
    if: ${{ ! startsWith(github.ref, 'refs/tags') }}
    runs-on: ubuntu-latest
    needs:
      - code-quality
      - test
    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: make build

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Publish initial image based on branch to ECR
        env:
          DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        shell: bash
        run: |
          if [[ "${GITHUB_REF}" == "refs/heads"* ]]; then
            branch="${GITHUB_REF/refs\/heads\//}"
            if [[ "${branch}" = "main" ]]; then
              docker_tag=latest
              docker tag navigator-admin-backend "$ECR_REGISTRY/navigator-admin-backend:${docker_tag}"
              docker push "$ECR_REGISTRY/navigator-admin-backend:${docker_tag}"
            fi
          elif [[ "${GITHUB_REF}" != "refs/tags"* ]]; then
            echo "Assuming '${GITHUB_HEAD_REF}' is a branch"
            if [[ -n "${GITHUB_HEAD_REF}" ]]; then
                branch="$(echo ${GITHUB_HEAD_REF}| tr -c '[0-9,A-Z,a-z]' '-')"
                timestamp=$(date --utc -Iseconds | cut -c1-19 | tr -c '[0-9]T\n' '-')
                short_sha=${GITHUB_SHA:0:8}
                docker_tag="${branch}-${timestamp}-${short_sha}"
                docker tag navigator-admin-backend "$ECR_REGISTRY/navigator-admin-backend:${docker_tag}"
                docker push "$ECR_REGISTRY/navigator-admin-backend:${docker_tag}"
            fi
          fi

  manual-semver:
    needs:
      - code-quality
      - test
    if: ${{ startsWith(github.ref, 'refs/tags') }}
    uses: climatepolicyradar/reusable-workflows/.github/workflows/semver.yml@v3
    secrets: inherit
    with:
      repo-name: navigator-admin-backend
      semver-tag: main-${GITHUB_SHA::8}

  tag:
    needs: build
    permissions:
      contents: write
    uses: climatepolicyradar/reusable-workflows/.github/workflows/tag.yml@v3
    with:
      repo-name: navigator-admin-backend
      semver-tag: main-${GITHUB_SHA::8}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}

  release:
    needs: tag
    if: ${{ needs.tag.outputs.new_tag != 'Skip' }}
    permissions:
      contents: write
    uses: climatepolicyradar/reusable-workflows/.github/workflows/release.yml@v3
    with:
      new_tag: ${{ needs.tag.outputs.new_tag }}