release.yml

name: Release and Deploy

on:
  push:
    branches:
      - main

permissions:
  contents: write
  issues: write
  pull-requests: write
  id-token: write

env:
  ECS_SERVICE_NEST: 'rushdb-ecs-service'
  ECS_SERVICE_MCP: 'rushdb-mcp-service'
  ECS_CLUSTER: 'rushdb-ecs-cluster'

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.determine-version.outputs.version }}
      has_tag: ${{ steps.check-tag.outputs.has_tag }}
      is_version_bump: ${{ steps.check-commit.outputs.is_version_bump }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 10.1.0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 18
          cache: pnpm
          registry-url: 'https://registry.npmjs.org'

      - name: Install Dependencies
        run: pnpm install

      - name: Build packages
        run: |
          pnpm --filter ./packages/javascript-sdk... --filter ./packages/mcp-server... build

      - name: Setup .npmrc
        run: |
          cat << EOF > ~/.npmrc
          registry=https://registry.npmjs.org/
          //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}
          access=public
          always-auth=true
          EOF

      - name: Determine Upcoming Version
        id: determine-version
        run: |
          STATUS=$(pnpm changeset status --no-color --verbose || true)
          VERSION=$(echo "$STATUS" | grep -E '@rushdb/(javascript-sdk|mcp-server)' | awk '{print $NF}' | sed 's/[^[:print:]]//g' | head -n1)
          if [ -z "$VERSION" ]; then
            echo "No upcoming version detected for javascript-sdk or mcp-server; leaving empty"
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Create Release PR or Publish
        id: changesets
        uses: changesets/action@v1
        with:
          version: pnpm changeset version
          publish: pnpm release --filter ./packages/javascript-sdk... --filter ./packages/mcp-server...
          commit: 'chore(release): version packages v${{ steps.determine-version.outputs.version }}'
          title: 'chore(release): version packages v${{ steps.determine-version.outputs.version }}'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Check Commit Type
        id: check-commit
        run: |
          COMMIT_MESSAGE=$(git log -1 --pretty=%B)
          EXPECTED_MESSAGE="chore(release): version packages v${{ steps.determine-version.outputs.version }}"
          if [ "$COMMIT_MESSAGE" = "$EXPECTED_MESSAGE" ]; then
            echo "is_version_bump=true" >> $GITHUB_OUTPUT
          else
            echo "is_version_bump=false" >> $GITHUB_OUTPUT
          fi

  docker:
    needs: release
    if: needs.release.outputs.is_version_bump == 'true'
    runs-on: ubuntu-latest
    outputs:
      image: ${{ steps.set-image.outputs.image }}
      version: ${{ needs.release.outputs.version }}

    steps:
      - run: echo '${{ toJSON(needs.release.outputs) }}'

      - name: Checkout
        uses: actions/checkout@v3

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ vars.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_PASSWORD }}

      - name: Build and push platform
        uses: docker/build-push-action@v5
        with:
          context: .
          file: platform/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            rushdb/platform:latest
            rushdb/platform:${{ needs.release.outputs.version }}

      - name: Build and push MCP server
        uses: docker/build-push-action@v5
        with:
          context: .
          file: packages/mcp-server/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            rushdb/mcp-server:latest
            rushdb/mcp-server:${{ needs.release.outputs.version }}

      - name: Set image output
        id: set-image
        run: echo "image=rushdb/platform:${{ needs.release.outputs.version }}" >> $GITHUB_OUTPUT

  deploy:
    needs: [release, docker]
    if: needs.release.outputs.is_version_bump == 'true'
    name: Deploy to ECS
    runs-on: ubuntu-22.04
    environment: ${{ github.event.inputs.environment || 'production' }}

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Checkout
        uses: actions/checkout@v3

      - name: Render task definition
        id: render-task
        run: |
          cat <<EOF > task-definition.json
          {
            "containerDefinitions": [
              {
                "name": "rushdb",
                "image": "${{ needs.docker.outputs.image }}",
                "cpu": 1024,
                "memory": 2048,
                "portMappings": [
                  {
                    "containerPort": 3000,
                    "hostPort": 3000,
                    "protocol": "tcp",
                    "appProtocol": "http"
                  }
                ],
                "essential": true,
                "logConfiguration": {
                  "logDriver": "awslogs",
                  "options": {
                    "awslogs-group": "/ecs/rushdb",
                    "awslogs-region": "${{ vars.AWS_REGION }}",
                    "awslogs-stream-prefix": "ecs-rushdb"
                  }
                },
                "environment": [
                  { "name": "NODE_ENV", "value": "production" },
                  { "name": "LOG_LEVEL", "value": "info" },
                  { "name": "RUSHDB_DASHBOARD_URL", "value": "${{ vars.RUSHDB_DASHBOARD_URL }}" },
                  { "name": "RUSHDB_AES_256_ENCRYPTION_KEY", "value": "${{ secrets.RUSHDB_AES_256_ENCRYPTION_KEY }}" },
                  { "name": "RUSHDB_JWT_PRIVATE_KEY_BASE64", "value": "${{ secrets.RUSHDB_JWT_PRIVATE_KEY_BASE64 }}" },
                  { "name": "RUSHDB_JWT_PUBLIC_KEY_BASE64", "value": "${{ secrets.RUSHDB_JWT_PUBLIC_KEY_BASE64 }}" },
                  { "name": "RUSHDB_JWT_KID", "value": "${{ vars.RUSHDB_JWT_KID }}" },
                  { "name": "RUSHDB_SELF_HOSTED", "value": "false" },
                  { "name": "RUSHDB_SERVE_STATIC", "value": "false" },
                  { "name": "NEO4J_URL", "value": "${{ secrets.NEO4J_URL }}" },
                  { "name": "NEO4J_USERNAME", "value": "${{ secrets.NEO4J_USERNAME }}" },
                  { "name": "NEO4J_PASSWORD", "value": "${{ secrets.NEO4J_PASSWORD }}" },
                  { "name": "GOOGLE_CLIENT_ID", "value": "${{ secrets.GOOGLE_CLIENT_ID }}" },
                  { "name": "GOOGLE_SECRET", "value": "${{ secrets.GOOGLE_SECRET }}" },
                  { "name": "GH_CLIENT_ID", "value": "${{ secrets.GH_CLIENT_ID }}" },
                  { "name": "GH_SECRET", "value": "${{ secrets.GH_SECRET }}" },
                  { "name": "MAIL_HOST", "value": "${{ secrets.MAIL_HOST }}" },
                  { "name": "MAIL_USER", "value": "${{ secrets.MAIL_USER }}" },
                  { "name": "MAIL_PASSWORD", "value": "${{ secrets.MAIL_PASSWORD }}" },
                  { "name": "MAIL_FROM", "value": "${{ secrets.MAIL_FROM }}" },
                  { "name": "SERVICE_CAPTCHA_KEY", "value": "${{ secrets.SERVICE_CAPTCHA_KEY }}" },
                  { "name": "BILLING_SERVICE_URL", "value": "${{ secrets.BILLING_SERVICE_URL }}" },
                  { "name": "RUSHDB_BILLING_SECRET", "value": "${{ secrets.RUSHDB_BILLING_SECRET }}" },
                  { "name": "SQL_DB_TYPE", "value": "postgres" },
                  { "name": "SQL_DB_URL", "value": "${{ secrets.SQL_DB_URL }}" },
                  { "name": "RUSHDB_PUBLIC_URL", "value": "${{ vars.RUSHDB_PUBLIC_URL }}" },
                  { "name": "RUSHDB_OAUTH_ISSUER", "value": "${{ vars.RUSHDB_PUBLIC_URL }}" },
                  { "name": "RUSHDB_EMBEDDING_BASE_URL", "value": "${{ secrets.RUSHDB_EMBEDDING_BASE_URL }}" },
                  { "name": "RUSHDB_EMBEDDING_API_KEY", "value": "${{ secrets.RUSHDB_EMBEDDING_API_KEY }}" },
                  { "name": "RUSHDB_EMBEDDING_MODEL", "value": "${{ vars.RUSHDB_EMBEDDING_MODEL }}" },
                  { "name": "RUSHDB_EMBEDDING_DIMENSIONS", "value": "${{ vars.RUSHDB_EMBEDDING_DIMENSIONS }}" }
                ]
              }
            ],
            "family": "rushdb-task-definition",
            "networkMode": "awsvpc",
            "requiresCompatibilities": ["FARGATE"],
            "cpu": "1024",
            "memory": "2048",
            "executionRoleArn": "${{ secrets.ECS_EXECUTION_ROLE_ARN }}"
          }
          EOF

      - name: Deploy platform to ECS
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: task-definition.json
          service: ${{ env.ECS_SERVICE_NEST }}
          cluster: ${{ env.ECS_CLUSTER }}
          wait-for-service-stability: false

      - name: Render MCP task definition
        run: |
          cat <<EOF > mcp-task-definition.json
          {
            "containerDefinitions": [
              {
                "name": "rushdb-mcp",
                "image": "rushdb/mcp-server:${{ needs.release.outputs.version }}",
                "cpu": 512,
                "memory": 1024,
                "portMappings": [
                  {
                    "containerPort": 3001,
                    "hostPort": 3001,
                    "protocol": "tcp",
                    "appProtocol": "http"
                  }
                ],
                "essential": true,
                "logConfiguration": {
                  "logDriver": "awslogs",
                  "options": {
                    "awslogs-group": "/ecs/rushdb-mcp",
                    "awslogs-region": "${{ vars.AWS_REGION }}",
                    "awslogs-stream-prefix": "ecs-rushdb-mcp"
                  }
                },
                "environment": [
                  { "name": "MCP_TRANSPORT", "value": "http" },
                  { "name": "PORT", "value": "3001" },
                  { "name": "RUSHDB_API_URL", "value": "https://api.rushdb.com/api/v1" },
                  { "name": "MCP_RESOURCE_URL", "value": "https://mcp.rushdb.com" },
                  { "name": "RUSHDB_OAUTH_ISSUER", "value": "${{ vars.RUSHDB_PUBLIC_URL }}" }
                ]
              }
            ],
            "family": "rushdb-mcp-task-definition",
            "networkMode": "awsvpc",
            "requiresCompatibilities": ["FARGATE"],
            "cpu": "512",
            "memory": "1024",
            "executionRoleArn": "${{ secrets.ECS_EXECUTION_ROLE_ARN }}"
          }
          EOF

      - name: Deploy MCP server to ECS
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: mcp-task-definition.json
          service: ${{ env.ECS_SERVICE_MCP }}
          cluster: ${{ env.ECS_CLUSTER }}
          wait-for-service-stability: false