ci.yml

name: CI/CD Pipeline
on:
  push:
  workflow_dispatch:

jobs:
  versions:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Determine versions
        id: versions
        run: |
          echo "erlang=$(grep 'erlang_version' elixir_buildpack.config | cut -d'=' -f2)" >> "$GITHUB_OUTPUT"
          echo "elixir=$(grep 'elixir_version' elixir_buildpack.config | cut -d'=' -f2)" >> "$GITHUB_OUTPUT"
          echo "alpine=$(grep 'alpine_version' elixir_buildpack.config | cut -d'=' -f2)" >> "$GITHUB_OUTPUT"
          echo "postgres=$(yq '.docker_services.postgres.version' < dev.yml)" >> "$GITHUB_OUTPUT"
    outputs:
      elixir: ${{ steps.versions.outputs.elixir }}
      erlang: ${{ steps.versions.outputs.erlang }}
      alpine: ${{ steps.versions.outputs.alpine }}
      postgres: ${{ steps.versions.outputs.postgres }}

  test:
    runs-on: ubuntu-latest
    needs: versions
    services:
      postgres:
        image: postgres:${{ needs.versions.outputs.postgres }}-alpine
        env:
          POSTGRES_USER: postgres
          POSTGRES_HOST_AUTH_METHOD: trust
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    env:
      MIX_ENV: test
      DB_USER: postgres
      DATABASE_URL: postgres://postgres@localhost/ex_gridhook_test
    steps:
      - uses: actions/checkout@v4
      - uses: erlef/setup-beam@v1
        with:
          otp-version: ${{ needs.versions.outputs.erlang }}
          elixir-version: ${{ needs.versions.outputs.elixir }}
      - uses: actions/cache/restore@v4
        id: cache-restore-mix-deps
        with:
          path: |
            deps
            _build
          key: mix-${{ needs.versions.outputs.erlang }}-${{ needs.versions.outputs.elixir }}-${{ hashFiles('**/mix.lock') }}
          restore-keys: |
            mix-${{ needs.versions.outputs.erlang }}-${{ needs.versions.outputs.elixir }}-
      - name: Prepare deps
        if: steps.cache-restore-mix-deps.outputs.cache-hit != 'true'
        run: mix do deps.get, deps.compile
      - uses: actions/cache/save@v4
        if: steps.cache-restore-mix-deps.outputs.cache-hit != 'true'
        with:
          path: |
            deps
            _build
          key: ${{ steps.cache-restore-mix-deps.outputs.cache-primary-key }}
      - run: mix format --check-formatted && mix credo
      - run: mix do ecto.create, ecto.migrate && mix test

  build:
    runs-on: ubuntu-latest
    needs: versions
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: ${{ secrets.AWS_REGION }}
          role-to-assume: ${{ secrets.AWS_ECR_ACCESS_ROLE_ARN }}
      - name: Log into AWS ECR
        uses: docker/login-action@v3
        with:
          registry: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com
      - uses: docker/build-push-action@v6
        with:
          build-args: |
            ERLANG_VERSION=${{ needs.versions.outputs.erlang }}
            ELIXIR_VERSION=${{ needs.versions.outputs.elixir }}
            ALPINE_VERSION=${{ needs.versions.outputs.alpine }}
            MIX_ENV=prod
            AWS_ACCESS_KEY_ID=${{ secrets.DOCKER_BUILDER_AWS_ACCESS_KEY_ID }}
            AWS_SECRET_ACCESS_KEY=${{ secrets.DOCKER_BUILDER_AWS_SECRET_ACCESS_KEY }}
            REVISION=${{ github.sha }}
          context: .
          push: ${{ github.ref_name == github.event.repository.default_branch }}
          tags: |
            ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/${{ github.event.repository.name }}:sha-${{ github.sha }}

  deploy:
    runs-on: ubuntu-latest
    if: github.ref_name == github.event.repository.default_branch
    needs:
      - test
      - build
    concurrency:
      group: deploy-to-production
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.repository.default_branch }}
          fetch-depth: 0
      - name: Checkout stack repository
        uses: actions/checkout@v4
        with:
          repository: barsoom/stack
          path: stack
          token: ${{ secrets.STACK_TOKEN }}
          sparse-checkout: |
            applications/gridhook/values.yaml
            script/ci/deploy.sh
            script/ci/ensure_revision_is_newer_than_deployed_revision.sh

      - name: Ensure revision is newer than deployed revision
        run: stack/script/ci/ensure_revision_is_newer_than_deployed_revision.sh

      - name: Update values.yaml with new image tag
        run: |
          NEW_TAG="${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com/${{ github.event.repository.name }}:sha-${{ github.sha }}"
          sed -i "s|image:.*|image: $NEW_TAG|g" stack/applications/gridhook/values.yaml

      - name: Deploy
        run: stack/script/ci/deploy.sh gridhook.auctionet.dev