push.yml

name: Push

on:
  push:
    branches:
      - "main"

env:
  AZURE_CONTAINER_REGISTRY: ${{ secrets.AZURE_CONTAINER_REGISTRY }}
  RESOURCE_GROUP: ${{ secrets.RESOURCE_GROUP }}
  STAGING_CLUSTER_NAME: ${{ secrets.STAGING_CLUSTER_NAME }}
  PRODUCTION_CLUSTER_NAME: ${{ secrets.PRODUCTION_CLUSTER_NAME }}
  IMAGE_PULL_SECRET_NAME: ${{ secrets.IMAGE_PULL_SECRET_NAME }}
  STAGING_DEPLOYMENT_MANIFEST_PATH: "deployment/deployment-staging.yml"
  PRODUCTION_DEPLOYMENT_MANIFEST_PATH: "deployment/deployment-canary.yml"

jobs:
  run-linters:
    name: Run linters
    runs-on: ubuntu-latest

    steps:
      - name: Check out Git repository
        uses: actions/checkout@v2

      - name: Set up Python
        uses: actions/setup-python@v1
        with:
          python-version: 3.8

      - name: Install Python dependencies
        run: pip install black

      - name: Run linters
        uses: wearerequired/lint-action@v2
        with:
          black: true

  run-tests:
    name: Run tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.8"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt
      - name: Test with pytest
        run: |
          pip install pytest
          pip install pytest-cov
          pip install mock
          pip install pytest-httpserver
          python -m pytest --cov-config=.coveragerc --cov=. --exitfirst --verbose --failed-first --cov-fail-under=70

  build:
    runs-on: ubuntu-latest
    if: "! contains(toJSON(github.event.commits.*.message), '[skip-ci]')"

    needs: [run-tests, run-linters]

    outputs:
      imageTag: ${{ steps.generate_tag.outputs.new_tag }}
      imageRepository: ${{ steps.image_repository_op.outputs.image_repository }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Generate Tag
        id: generate_tag
        uses: anothrNick/github-tag-action@1.52.0
        env:
          GITHUB_TOKEN: ${{ secrets.ECM3440_GITHUB_TOKEN }}
          WITH_V: true
          DEFAULT_BUMP: patch
          DRY_RUN: true

      - name: Login to Docker Hub
        uses: azure/docker-login@v1
        with:
          login-server: ${{ secrets.REGISTRY_LOGIN_SERVER }}
          username: ${{ secrets.REGISTRY_USERNAME }}
          password: ${{ secrets.REGISTRY_PASSWORD }}

      - name: Generate image repository path
        id: image_repository_op
        run: |
          echo IMAGE_REPOSITORY=$(echo ${{ secrets.REGISTRY_LOGIN_SERVER }}/${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
          echo "image_repository=$IMAGE_REPOSITORY" >> $GITHUB_OUTPUT

      - name: Build and push image
        run: |
          docker build . -t ${{ env.IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }} \
           --build-arg SERVICEBUS_CONNECTION_STR="${{ secrets.SERVICEBUS_CONNECTION_STR }}" \
           --build-arg SERVICEBUS_TOPIC_NAME="${{ secrets.SERVICEBUS_TOPIC_NAME }}" \
           --build-arg SERVICEBUS_SUBSCRIPTION_NAME="${{ secrets.SERVICEBUS_SUBSCRIPTION_NAME }}" \
           --label org.opencontainers.image.source=${{ github.event.repository.clone_url }} \
           --label org.opencontainers.image.revision=${{ github.sha }}

          docker push ${{ env.IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }}

      - name: Comment on PR
        uses: mshick/add-pr-comment@v1
        env:
          GITHUB_TOKEN: ${{ secrets.ECM3440_GITHUB_TOKEN }}
        with:
          message: "@${{ github.actor }} Image is available for testing. `docker pull ${{ env.IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }}`"
          allow-repeats: false

      - name: Push Latest Tag
        uses: anothrNick/github-tag-action@1.52.0
        env:
          GITHUB_TOKEN: ${{ secrets.ECM3440_GITHUB_TOKEN }}
          WITH_V: true
          DEFAULT_BUMP: patch

      - name: Notify Failure
        if: failure()
        uses: mshick/add-pr-comment@v1
        env:
          GITHUB_TOKEN: ${{ secrets.ECM3440_GITHUB_TOKEN }}
        with:
          message: "@${{ github.actor }} Yikes! You better fix it before anyone else finds out! [Build](https://github.com/${{ github.repository }}/commit/${{ github.event.pull_request.head.sha }}/checks) has Failed!"
          allow-repeats: false

  create-secret:
    runs-on: ubuntu-latest
    if: "! contains(toJSON(github.event.commits.*.message), '[pre-release]')"

    needs: [run-tests, run-linters]

    permissions:
      actions: read
      contents: read
      id-token: write

    steps:
      # Logs in with your Azure credentials
      - name: Azure login
        uses: azure/login@v1.4.3
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
      - name: Get K8s context
        uses: azure/aks-set-context@v2.0
        with:
          resource-group: ${{ env.RESOURCE_GROUP }}
          cluster-name: ${{ env.STAGING_CLUSTER_NAME }}

      # Retrieves the credentials for pulling images from your Azure Container Registry
      - name: Get ACR credentials
        id: get-acr-creds
        run: |
          az acr update -n ${{ env.AZURE_CONTAINER_REGISTRY }} -g ${{ env.RESOURCE_GROUP }} --admin-enabled true
          ACR_USERNAME=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query username -o tsv)
          ACR_PASSWORD=$(az acr credential show -g ${{ env.RESOURCE_GROUP }} -n ${{ env.AZURE_CONTAINER_REGISTRY }} --query passwords[0].value -o tsv)
          echo "::add-mask::${ACR_USERNAME}"
          echo "::set-output name=username::${ACR_USERNAME}"
          echo "::add-mask::${ACR_PASSWORD}"
          echo "::set-output name=password::${ACR_PASSWORD}"

      # Creates a kubernetes secret on your Azure Kubernetes Service cluster that matches up to the credentials from the last step
      - name: Create K8s secret for pulling image from ACR
        uses: Azure/k8s-create-secret@v1.1
        with:
          container-registry-url: ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io
          container-registry-username: ${{ steps.get-acr-creds.outputs.username }}
          container-registry-password: ${{ steps.get-acr-creds.outputs.password }}
          secret-name: ${{ env.IMAGE_PULL_SECRET_NAME }}

  deploy-staging:
    runs-on: ubuntu-latest
    if: "! contains(toJSON(github.event.commits.*.message), '[pre-release]')"
    
    outputs:
      imageTag: ${{ steps.generate_tag.outputs.image_tag }}
      imageRepository: ${{ steps.generate_image_repository.image_repository }}

    permissions:
      actions: read
      contents: read
      id-token: write

    needs: [build, create-secret]

    steps:
      # Checks out the repository this file is in
      - name: Checkout
        uses: actions/checkout@v3

      # Logs in with your Azure credentials
      - name: Azure login
        uses: azure/login@v1.4.3
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
      - name: Get K8s context
        uses: azure/aks-set-context@v2.0
        with:
          resource-group: ${{ env.RESOURCE_GROUP }}
          cluster-name: ${{ env.STAGING_CLUSTER_NAME }}

      - name: Inject environment variables to deployment
        uses: swdotcom/update-and-apply-kubernetes-configs@v1
        with:
          k8-config-file-paths: ${{ env.STAGING_DEPLOYMENT_MANIFEST_PATH }}
          replacement-method: defined
        env:
          SERVICE_NAME: ${{ github.event.repository.name }}
          IMAGE_REPOSITORY: ${{ needs.build.outputs.imageRepository }}
          IMAGE_TAG: ${{ needs.build.outputs.imageTag }}

      # Deploys application based on given manifest file
      - name: Deploys application
        uses: Azure/k8s-deploy@v4
        with:
          manifests: ${{ env.STAGING_DEPLOYMENT_MANIFEST_PATH }}
          images: |
            ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/ecm3440/event-processor:${{ needs.build.outputs.imageTag }}
          imagepullsecrets: |
            ${{ env.IMAGE_PULL_SECRET_NAME }}
            
      - name: Set image tag output
        id: generate_tag
        run: |
          echo "image_tag=${{ needs.build.outputs.imageTag }}" >> $GITHUB_OUTPUT
          
      - name: Set image repository output
        id: generate_image_repository
        run: |
          echo "image_repository=${{ needs.build.outputs.imageRepository }}" >> $GITHUB_OUTPUT

  deploy-production:
    runs-on: ubuntu-latest
    if: "! contains(toJSON(github.event.commits.*.message), '[pre-release]')"

    permissions:
      actions: read
      contents: read
      id-token: write

    needs: [deploy-staging]

    steps:
      - uses: trstringer/manual-approval@v1
        with:
          secret: ${{ secrets.ECM3440_GITHUB_TOKEN }}
          approvers: charlie2clarke,Ben-Newman-Exeter
          minimum-approvals: 1
          issue-title: "Deploying ${{ needs.deploy-staging.outputs.imageTag }} to prod from staging"

      # Checks out the repository this file is in
      - name: Checkout
        uses: actions/checkout@v3

      # Logs in with your Azure credentials
      - name: Azure login
        uses: azure/login@v1.4.3
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}

      # Retrieves your Azure Kubernetes Service cluster's kubeconfig file
      - name: Get K8s context
        uses: azure/aks-set-context@v2.0
        with:
          resource-group: ${{ env.RESOURCE_GROUP }}
          cluster-name: ${{ env.PRODUCTION_CLUSTER_NAME }}

      - name: Inject environment variables to deployment
        uses: swdotcom/update-and-apply-kubernetes-configs@v1
        with:
          k8-config-file-paths: ${{ env.PRODUCTION_DEPLOYMENT_MANIFEST_PATH }}
          replacement-method: defined
        env:
          SERVICE_NAME: ${{ github.event.repository.name }}
          IMAGE_REPOSITORY: ${{ needs.deploy-staging.outputs.imageRepository }}
          IMAGE_TAG: ${{ needs.deploy-staging.outputs.imageTag }}

      # Deploys application based on given manifest file
      - name: Deploys application
        uses: Azure/k8s-deploy@v4
        with:
          manifests: ${{ env.PRODUCTION_DEPLOYMENT_MANIFEST_PATH }}
          images: |
            ${{ env.AZURE_CONTAINER_REGISTRY }}.azurecr.io/ecm3440/event-processor:${{ needs.deploy-staging.outputs.imageTag }}
          imagepullsecrets: |
            ${{ env.IMAGE_PULL_SECRET_NAME }}