create-deploy-release.yml

name: Deployment on datagouv domains with version bump
run-name: Deploy ${{ github.event.inputs.site }} to ${{ github.event.inputs.environment }} (v${{ github.sha }})

on:
  workflow_dispatch:
    inputs:
      site:
        description: 'Site to deploy on preprod or prod'
        required: true
        default: 'ecologie'
        type: choice
        options: # Can't use vars here because this is a workflow dispatch input
          - ecologie
          - meteo-france
          - logistique
          - defis
          - hackathon
          - simplifions
          - culture
          - accessibilite
      environment:
        description: 'Environment to deploy to'
        required: true
        default: 'preprod'
        type: choice
        options: # Can't use vars here because this is a workflow dispatch input
          - demo
          - preprod
          - prod
      version_type:
        description: 'Version type for the release'
        required: true
        default: 'patch'
        type: choice
        options: # Can't use vars here because this is a workflow dispatch input
          - major
          - minor
          - patch
  push:
    branches:
      - '*'
jobs:
  deploy-release:
    # Only run this job for:
    # - Manual workflow dispatch (workflow_dispatch)
    # - Push to branches with commit messages starting with '[' (deployment commits)
    # This prevents the job from running on normal commits and saves resources
    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') && startsWith(github.event.head_commit.message, '['))
    runs-on: ubuntu-latest
    env:
      # variables to be defined
      APP_NAME: ${{ vars.APP_NAME }}
      SCAFFOLD_REPO_SSH_URL: ${{ vars.SCAFFOLD_REPO_SSH_URL }}
      SCAFFOLD_DIR: 'scaffold'
      ENVS: ${{ vars.ENVS }}
      APPS: ${{ vars.APPS }}

      # secrets to be defined
      GITLAB_API_TOKEN: ${{ secrets.GITLAB_API_TOKEN }}
      DEPLOY_PRIVATE_KEY: ${{ secrets.DEPLOY_PRIVATE_KEY }}

      # workflow dispatch inputs (for manual deployment)
      CONFIG_NAME: ${{ github.event.inputs.site }}
      ENV: ${{ github.event.inputs.environment }}
      VERSION_TYPE: ${{ github.event.inputs.version_type }}
    steps:
      - name: Debug event
        run: |
          echo "Event name: ${{ github.event_name }}"
          echo "Repository: ${{ github.repository }}"
          echo "Branch: ${{ github.ref }}"
          echo "SHA: ${{ github.sha }}"
          echo "CONFIG_NAME: $CONFIG_NAME"
          echo "ENV: $ENV"
          echo "VERSION_TYPE: $VERSION_TYPE"
      - name: Configure environment
        shell: bash
        run: |
          # configure environment variables
          echo "REPO_HTTPS_URL=${{ github.server_url }}/${{ github.repository }}.git" >> $GITHUB_ENV
          echo "REPO_SSH_URL=git@github.com:${{ github.repository }}.git" >> $GITHUB_ENV
          echo "REPO_CURRENT_BRANCH=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_ENV

          # configure the SSH deploy private key
          mkdir -p ~/.ssh
          echo "$DEPLOY_PRIVATE_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
          ssh-keyscan -t rsa gitlab.com >> ~/.ssh/known_hosts

          # configure git
          git config --global user.email "root@data.gouv.fr"
          git config --global user.name "datagouv"

      - name: Clone this repo and the scaffold script repository
        shell: bash
        run: |
          git clone --quiet --depth 1 -b ${{ env.REPO_CURRENT_BRANCH }} ${{ env.REPO_SSH_URL }}
          git clone --quiet --depth 1 $SCAFFOLD_REPO_SSH_URL ${{ env.SCAFFOLD_DIR }}

      - name: Parse commit message and set deployment variables
        if: (github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') && startsWith(github.event.head_commit.message, '['))
        shell: bash
        run: |
          LAST_COMMIT_MESSAGE=$(git log -1 --pretty=%s)

          if [[ $LAST_COMMIT_MESSAGE =~ ^\[($ENVS):($APPS):(major|minor|patch)\] ]]; then
            ENV="${BASH_REMATCH[1]}"
            CONFIG_NAME="${BASH_REMATCH[2]}"
            VERSION_TYPE="${BASH_REMATCH[3]}"
          else
            echo "error: invalid env, app and/or version type"
            exit 1
          fi

          echo "ENV=$ENV" >> $GITHUB_ENV
          echo "CONFIG_NAME=$CONFIG_NAME" >> $GITHUB_ENV
          echo "VERSION_TYPE=$VERSION_TYPE" >> $GITHUB_ENV
        working-directory: ${{ env.APP_NAME }}

      - name: Set next release version
        shell: bash
        run: |
          pattern="${CONFIG_NAME}-${ENV}-[0-9]+\.[0-9]+\.[0-9]+$"
          tags=$(git ls-remote --tags origin | grep -Eo "refs/tags/${pattern}" | sed 's#refs/tags/##' || true)
          if [ -n "$tags" ]; then
              # --no-tags prevents git from auto-following related tags,
              # which would cause "tag already exists" errors on subsequent fetches
              for tag in $tags; do git fetch --no-tags origin tag $tag; done
          fi
          RELEASE_VERSION=$(../${{ env.SCAFFOLD_DIR }}/scripts/bump_version_non_semver.sh $CONFIG_NAME $ENV $VERSION_TYPE)

          echo "RELEASE_VERSION=$RELEASE_VERSION" >> $GITHUB_ENV
        working-directory: ${{ env.APP_NAME }}

      - name: Trigger GitLab CI/CD pipeline
        shell: bash
        run: |
          # Run the script that triggers the GitLab CI/CD pipeline.
          # Must have GITLAB_API_TOKEN set in the environment
          # GITLAB_API_TOKEN is the token related to the "infra" GitLab repository, so that the GitLab CI/CD pipeline can be triggered
          # The script args are, in order:
          # - CONFIG_NAME: the name of the project to deploy
          # - RELEASE_VERSION: the version to deploy
          # - ENV: the environment to deploy to
          # - VARS: the optional deploy variables
          ./scripts/gitlab-ci-pipeline.sh $CONFIG_NAME $RELEASE_VERSION $ENV ""
        working-directory: ${{ env.SCAFFOLD_DIR }}