.deploy_stack.yml

name: .Deploy Stack

on:
  workflow_call:
    inputs:
      ### Required
      environment_name:
        description: 'The name of the environment to deploy to'
        required: true
        default: 'dev'
        type: string
      command:
        description: 'The terragrunt command to run'
        required: true
        default: 'apply'
        type: string
      tag:
        description: 'The tag of the containers to deploy'
        default: 'latest'
        type: string
        required: false
      app_env:
        required: false
        type: string
        description: 'The APP env separates between AWS ENV and Actual APP, since AWS dev is where PR, and TEST is deployed'
    outputs:
      API_GW_URL: 
        value: ${{ jobs.deploy.outputs.API_GW_URL }}
      S3_BUCKET_ARN:
        value: ${{ jobs.deploy.outputs.S3_BUCKET_ARN }}
      S3_BUCKET_NAME:
        value: ${{ jobs.deploy.outputs.S3_BUCKET_NAME }}
      CF_DOMAIN:
        value: ${{ jobs.deploy.outputs.CF_DOMAIN }}
      CF_DISTRIBUTION_ID:
        value: ${{ jobs.deploy.outputs.CF_DISTRIBUTION_ID }}
env:
    AWS_REGION: ca-central-1
permissions:
  id-token: write # This is required for requesting the JWT
  contents: write # This is required for actions/checkout
jobs:
  
  ecr:
    name:  ECR
    runs-on: ubuntu-24.04
    environment: ${{ inputs.environment_name }}
    strategy:
      matrix:
        package: [backend,migrations]
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          role-session-name: gha-ecr-push
          aws-region: ca-central-1
      
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2
        
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          
      - name: Pull, tag and push image to ECR
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          GHCR_IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.package }}:${{ inputs.tag }}
        run: |
          # Check if command is apply and validate image exists
          if [ "${{ inputs.command }}" == "apply" ]; then
            docker manifest inspect $GHCR_IMAGE > /dev/null 2>&1 || { echo "Error: Image $GHCR_IMAGE does not exist and command is apply"; exit 1; }
            docker pull $GHCR_IMAGE || { echo "Error: Failed to pull image $GHCR_IMAGE"; exit 1; }
            
            # Tag for ECR
            ECR_IMAGE=$ECR_REGISTRY/${{ github.repository }}:${{ matrix.package }}-${{ inputs.tag }}
            docker tag $GHCR_IMAGE $ECR_IMAGE
            
            # Push to ECR
            docker push $ECR_IMAGE
          else
            echo "Command is not apply, continuing"
            exit 0;
          fi
          
  stack-prefix:
    name: Stack Prefix
    needs: ecr
    uses: ./.github/workflows/.stack-prefix.yml
  deploy:
    name: Deploys
    needs: [stack-prefix]
    uses: ./.github/workflows/.deployer.yml
    with:
      environment_name: ${{ inputs.environment_name }}
      command: ${{ inputs.command }}
      app_env: ${{ inputs.app_env }}
      stack_prefix: ${{ needs.stack-prefix.outputs.stack_prefix }}
      tag: ${{ inputs.tag }}
    secrets: inherit
  
  build-ui:
    name: Build And upload UI to s3 ${{ inputs.environment_name }}
    environment: ${{ inputs.environment_name }}
    if: (inputs.command == 'apply')
    needs: [deploy]
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: setup node
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6
        with:
            role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
            aws-region: ${{ env.AWS_REGION }}
      - name: Build And Update UI (CF)
        working-directory: frontend
        env:
          VITE_API_BASE_URL: ${{ needs.deploy.outputs.API_GW_URL }}/api
          S3_BUCKET_ARN: ${{ needs.deploy.outputs.S3_BUCKET_ARN }}
          CF_DISTRIBUTION_ID: ${{ needs.deploy.outputs.CF_DISTRIBUTION_ID }}
        run: |
          BUCKET=$(echo "$S3_BUCKET_ARN" | cut -d: -f6)
          npm run deploy
          aws s3 cp ./dist/index.html s3://$BUCKET/index.html \
            --cache-control "no-cache, must-revalidate" \
            --content-type "text/html"
          aws s3 sync ./dist s3://$BUCKET \
            --exclude "index.html" \
            --cache-control "public, max-age=31536000, immutable" \
            --delete
          aws cloudfront create-invalidation --distribution-id $CF_DISTRIBUTION_ID --paths "/*"