cfw-autumn/.github/workflows/build.yml

name: Build and Push to ECR

on:
  push:
    branches:
      - main
      - staging
      - dev
      
  workflow_dispatch:
    inputs:
      tag:
        description: 'Manual deploy'
        required: false
        default: 'manual'

env:
  AWS_REGION: us-west-2
  # Branches allowed to deploy to staging via workflow_dispatch with tag=deploy-staging.
  # Add short-lived PR branches here when you need staging without merging to dev.
  STAGING_DEPLOY_BRANCH_ALLOWLIST: axiom-ingest-cuts

jobs:
  checks:
    name: Type Check
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Bun
        uses: oven-sh/setup-bun@v2
        with:
          bun-version: 1.3.10
      
      - name: Install dependencies
        run: bun install
      
      - name: Run TypeScript type check
        run: |
          bun ts

  build-and-push:
    name: Build and Push Docker Image
    needs: checks
    runs-on: blacksmith-16vcpu-ubuntu-2404
    
    permissions:
      id-token: write
      contents: read
      pull-requests: read
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      
      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2
      
      - name: Extract metadata for Docker
        id: meta
        env:
          REQUESTED_STAGING_DEPLOY: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag == 'deploy-staging' }}
        run: |
          BRANCH_NAME=${GITHUB_REF#refs/heads/}
          COMMIT_SHA=${GITHUB_SHA::8}
          DEPLOY_STAGING_OVERRIDE="false"
          
          # Sanitize branch name for Docker tag (replace / with -)
          SAFE_BRANCH=$(echo $BRANCH_NAME | sed 's/\//-/g')

          if [ "$REQUESTED_STAGING_DEPLOY" = "true" ] && [ "$BRANCH_NAME" != "dev" ]; then
            for ALLOWED_BRANCH in $STAGING_DEPLOY_BRANCH_ALLOWLIST; do
              if [ "$BRANCH_NAME" = "$ALLOWED_BRANCH" ]; then
                DEPLOY_STAGING_OVERRIDE="true"
                break
              fi
            done

            if [ "$DEPLOY_STAGING_OVERRIDE" != "true" ]; then
              echo "::error::Branch '$BRANCH_NAME' is not allowed to deploy to staging. Add it to STAGING_DEPLOY_BRANCH_ALLOWLIST in .github/workflows/build.yml."
              exit 1
            fi
          fi

          if [ "$DEPLOY_STAGING_OVERRIDE" = "true" ]; then
            # deployStaging expects the staging ECR image tag to be dev-<sha>.
            IMAGE_BRANCH="dev"
          else
            IMAGE_BRANCH="$SAFE_BRANCH"
          fi
          
          echo "branch=$IMAGE_BRANCH" >> $GITHUB_OUTPUT
          echo "sha=$COMMIT_SHA" >> $GITHUB_OUTPUT
          echo "deploy_staging_override=$DEPLOY_STAGING_OVERRIDE" >> $GITHUB_OUTPUT
          
          # Select ECR repository based on branch
          if [ "$BRANCH_NAME" = "dev" ] || [ "$DEPLOY_STAGING_OVERRIDE" = "true" ]; then
            echo "ecr_repo=autumn-staging" >> $GITHUB_OUTPUT
          else
            echo "ecr_repo=autumn" >> $GITHUB_OUTPUT
          fi
          
          # Set custom tag if provided
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ -n "${{ github.event.inputs.tag }}" ]; then
            echo "custom_tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
          fi
      
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      
      - name: Build and push Docker image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ steps.meta.outputs.ecr_repo }}
          IMAGE_TAG_SHA: ${{ steps.meta.outputs.sha }}
          IMAGE_TAG_BRANCH: ${{ steps.meta.outputs.branch }}
        run: |
          # Build single combined tag: branch-sha
          COMBINED_TAG="${IMAGE_TAG_BRANCH}-${IMAGE_TAG_SHA}"
          TAGS="${ECR_REGISTRY}/${ECR_REPOSITORY}:${COMBINED_TAG}"
          
          # Build and push
          docker buildx build \
            --platform linux/amd64 \
            --push \
            --provenance=false \
            --sbom=false \
            --cache-from type=registry,ref=${ECR_REGISTRY}/${ECR_REPOSITORY}:${IMAGE_TAG_BRANCH} \
            --cache-to type=inline \
            --tag ${TAGS//,/ --tag } \
            -f docker/Dockerfile \
            .
      
      - name: Output image details
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ steps.meta.outputs.ecr_repo }}
          IMAGE_TAG_SHA: ${{ steps.meta.outputs.sha }}
          IMAGE_TAG_BRANCH: ${{ steps.meta.outputs.branch }}
        run: |
          COMBINED_TAG="${IMAGE_TAG_BRANCH}-${IMAGE_TAG_SHA}"
          echo "Image pushed successfully!"
          echo "Repository: ${ECR_REGISTRY}/${ECR_REPOSITORY}"
          echo "Tag: ${COMBINED_TAG}"

      - name: Auto-deploy fix branches
        if: github.ref == 'refs/heads/main'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DEPLOY_URL: ${{ secrets.DEPLOY_URL }}
          DEPLOY_SECRET: ${{ secrets.DEPLOY_SECRET }}
          COMMIT_SHA: ${{ github.sha }}
        run: |
          # Get the PR that was merged (if any)
          PR_DATA=$(gh pr list --state merged --search "$COMMIT_SHA" --json headRefName --limit 1)
          BRANCH_NAME=$(echo "$PR_DATA" | jq -r '.[0].headRefName // empty')
          
          if [[ "$BRANCH_NAME" == fix/* ]]; then
            echo "Detected merged fix/ branch: $BRANCH_NAME"
            echo "Triggering auto-deploy..."
            
            curl --fail-with-body -X POST "$DEPLOY_URL/api/deploy/github" \
              -H "Content-Type: application/json" \
              -H "x-deploy-secret: $DEPLOY_SECRET" \
              -d "{\"commitSha\": \"$COMMIT_SHA\", \"deploymentType\": \"server\"}"
            
            echo "Auto-deploy triggered!"
          else
            echo "Not a fix/ branch (branch: ${BRANCH_NAME:-direct push}), skipping auto-deploy"
          fi

      - name: Auto-deploy staging
        if: github.ref == 'refs/heads/dev' || steps.meta.outputs.deploy_staging_override == 'true'
        env:
          DEPLOY_URL: ${{ secrets.DEPLOY_URL }}
          DEPLOY_SECRET: ${{ secrets.DEPLOY_SECRET }}
          COMMIT_SHA: ${{ github.sha }}
        run: |
          echo "Deploying to staging..."
          curl --fail-with-body -X POST "$DEPLOY_URL/api/deploy/github/staging" \
            -H "Content-Type: application/json" \
            -H "x-deploy-secret: $DEPLOY_SECRET" \
            -d "{\"commitSha\": \"$COMMIT_SHA\"}"
          echo "Staging deploy triggered!"