ci-cd.yml

name: CI/CD

on:
  push:
    tags: [v*]
    branches:
      - main
  pull_request:
    # By default, a workflow only runs when a pull_request event's activity type is opened,
    # synchronize, or reopened.
    types: [opened, synchronize, reopened, edited]
    branches:
      - main

permissions: read-all

jobs:
  check-auto-tagging-will-work:
    concurrency:
      group: ${{ github.ref }}
      cancel-in-progress: true
    if: |
      github.event_name == 'pull_request' &&
      (! startsWith(github.ref, 'refs/tags') && ! startsWith(github.ref, 'refs/heads/main'))
    uses: climatepolicyradar/reusable-workflows/.github/workflows/check-auto-tagging-will-work.yml@v10

  code-quality:
    if: |
      ! cancelled() && always() &&
      (needs.check-auto-tagging-will-work.result == 'skipped' || needs.check-auto-tagging-will-work.result == 'success') &&
      ! startsWith(github.ref, 'refs/tags')
    needs:
      - check-auto-tagging-will-work
    permissions:
      # For trunk to post annotations
      checks: write
      # For repo checkout
      contents: read
    uses: climatepolicyradar/reusable-workflows/.github/workflows/python-precommit-validator.yml@v16

  test:
    if: |
      ! cancelled() && always() &&
      (needs.check-auto-tagging-will-work.result == 'skipped' || needs.check-auto-tagging-will-work.result == 'success') &&
      ! startsWith(github.ref, 'refs/tags')
    needs:
      - check-auto-tagging-will-work
    runs-on: ubuntu-latest
    steps:
      - name: Install latest Docker Compose
        uses: ndeloof/install-compose-action@v0.0.1
        with:
          legacy: false

      - uses: actions/checkout@v4

      - name: Run Unit Tests
        run: make test TEST=tests/unit_tests/
        env:
          POSTGRES_USER: navigator_admin
          POSTGRES_PASSWORD: password
          POSTGRES_DB: navigator

      - name: Run Integration Tests
        run: make test TEST=tests/integration_tests
        env:
          POSTGRES_USER: navigator_admin
          POSTGRES_PASSWORD: password
          POSTGRES_DB: navigator

  build:
    if: |
      ! cancelled() && always() &&
      (needs.code-quality.result == 'success' && needs.test.result == 'success') &&
      ! startsWith(github.ref, 'refs/tags')
    runs-on: ubuntu-latest
    needs:
      - code-quality
      - test
    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: make build

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Publish initial image based on branch to ECR
        id: retag_and_push_to_ecr
        uses: climatepolicyradar/retag-and-push-to-ecr@v1
        env:
          DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        with:
          repo-name: navigator-admin-backend
          semver-tag: latest

  manual-semver:
    if: ${{ ! cancelled() && always() && startsWith(github.ref, 'refs/tags') }}
    uses: climatepolicyradar/reusable-workflows/.github/workflows/semver.yml@v3
    secrets: inherit
    with:
      repo-name: navigator-admin-backend
      semver-tag: main-${GITHUB_SHA::8}

  tag:
    if: ${{ ! cancelled() && always() && (needs.build.result == 'success')}}
    needs: build
    permissions:
      contents: write
    uses: climatepolicyradar/reusable-workflows/.github/workflows/tag.yml@v3
    with:
      repo-name: navigator-admin-backend
      semver-tag: main-${GITHUB_SHA::8}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}

  release:
    if: ${{ ! cancelled() && always() && (needs.tag.result == 'success' && needs.tag.outputs.new_tag != 'Skip')}}
    needs: tag
    permissions:
      contents: write
    uses: climatepolicyradar/reusable-workflows/.github/workflows/release.yml@v3
    with:
      new_tag: ${{ needs.tag.outputs.new_tag }}