deploy_thru_prod.yml

name: Deploy thru Prod

on:
  workflow_call:
    inputs:
      commit-identifier:
        description: SHA or tag to apply
        type: string
        required: true
      oidc-domain:
        description: 'OIDC Domain. Ex: "core" or "reveng"'
        required: true
        type: string
      terraform-workspace:
        description: Terraform Workspace, (optional) when omitted, the environment is used
        type: string
        required: false
      terraform-root-dev:
        description: Root directory of terraform dev. When omitted, terraform/dev is used
        type: string
        required: false
      terraform-root-stage:
        description: Root directory of terraform stage. When omitted, terraform/stage is used
        type: string
        required: false
      terraform-root-prod:
        description: Root directory of terraform prod. When omitted, terraform/prod is used
        type: string
        required: false
      terraform-version:
        description: Terraform version to use
        type: string
        required: true
    secrets:
      ORG_READ_ONLY_SSH_KEY:
        required: true
      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN:
        required: true


concurrency: ${{ github.repository }}

permissions:
  id-token: write
  contents: write
  pull-requests: write

jobs:
  Set-Release-Tag:
    runs-on: ubuntu-latest
    if: ${{ github.event.pull_request.merged || github.event_name == 'workflow_dispatch' }}
    outputs:
      release-tag: ${{ steps.releaseTag.outputs.release-tag }}

    steps:
      - name: Set Release Tag
        id: releaseTag
        run: echo "release-tag=$(date +'%Y.%m.%d-%H-%M')" >> $GITHUB_OUTPUT

  DeployDev:
    name: Apply Dev
    needs: [Set-Release-Tag]
    uses: ./.github/workflows/deploy_environment.yml
    with:
      environment: dev
      oidc-domain: ${{ inputs.oidc-domain }}
      terraform-workspace: ${{ inputs.terraform-workspace || 'dev' }}
      commit-identifier: ${{ inputs.commit-identifier }}
      release-tag: ${{ needs.Set-Release-Tag.outputs.release-tag }}
      terraform-root: ${{ inputs.terraform-root-dev || 'terraform/dev' }}
      terraform-version: ${{ inputs.terraform-version }}
    secrets:
      ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN: ${{ secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN }}

  DeployStage:
    name: Apply Stage
    needs: [Set-Release-Tag, DeployDev]
    uses: ./.github/workflows/deploy_environment.yml
    with:
      environment: stage
      oidc-domain: ${{ inputs.oidc-domain }}
      terraform-workspace: ${{ inputs.terraform-workspace || 'stage'}}
      commit-identifier: ${{ inputs.commit-identifier }}
      release-tag: ${{ needs.Set-Release-Tag.outputs.release-tag }}
      terraform-root: ${{ inputs.terraform-root-stage || 'terraform/stage' }}
      terraform-version: ${{ inputs.terraform-version }}
    secrets:
      ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN: ${{ secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN }}

  DeployProd:
    name: Apply Prod
    needs: [Set-Release-Tag, DeployStage]
    uses: ./.github/workflows/deploy_environment.yml
    with:
      environment: prod
      oidc-domain: ${{ inputs.oidc-domain }}
      terraform-workspace: ${{ inputs.terraform-workspace || 'prod' }}
      commit-identifier: ${{ inputs.commit-identifier }}
      release-tag: ${{ needs.Set-Release-Tag.outputs.release-tag }}
      terraform-root: ${{ inputs.terraform-root-prod || 'terraform/prod' }}
      terraform-version: ${{ inputs.terraform-version }}
    secrets:
      ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN: ${{ secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN }}

  CreateRelease:
    name: Create New Release
    needs: [Set-Release-Tag, DeployProd]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Actions
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.commit-identifier }}
          fetch-depth: "0"

      - name: Create release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ needs.Set-Release-Tag.outputs.release-tag }}
          commit: ${{ inputs.commit-identifier }}
          token: ${{ secrets.GITHUB_TOKEN }}

  ReportStatus:
    name: Report Status on PR
    runs-on: ubuntu-latest
    needs: [DeployDev, DeployStage, DeployProd, CreateRelease]
    if: always()
    env:
      BUILD_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

    steps:
      - uses: mshick/add-pr-comment@v2
        with:
          message: |
            # :page_with_curl: Status Report :page_with_curl:
            **Deploy to Stage Status:** This job has ${{ needs.DeployStage.result == 'success' && 'passed! :heavy_check_mark:' ||
              needs.DeployStage.result == 'failure' && 'failed. :x:' || needs.DeployStage.result == 'skipped' && 'skipped. :warning:' || 'canceled. :no_entry_sign:'}}
            **Deploy to Prod Status:** This job has ${{ needs.DeployProd.result == 'success' && 'passed! :heavy_check_mark:' ||
              needs.DeployProd.result == 'failure' && 'failed. :x:' || needs.DeployProd.result == 'skipped' && 'skipped. :warning:' || 'canceled. :no_entry_sign:'}}
            **Create Release:** This job has ${{ needs.CreateRelease.result == 'success' && 'passed! :heavy_check_mark:' ||
              needs.CreateRelease.result == 'failure' && 'failed. :x:' || needs.CreateRelease.result == 'skipped' && 'skipped. :warning:' || 'canceled. :no_entry_sign:'}}
            [Click here to view the job](${{ env.BUILD_URL }})
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          repo-token-user-login: "github-actions[bot]"