dev_on_dispatch_release_deploy.yml

name: "0 [on_dispatch/CD] Deploy release or hotfix"

run-name: "Deploy ${{ github.ref }} to ${{ github.event.inputs.target_environment }} by @${{ github.actor }}"

on:
  workflow_dispatch:
    inputs:
      target_environment:
        type: choice
        description: "Environnement cible"
        required: true
        options:
          - staging
          - production
          - testing

permissions: write-all

jobs:
  check-worflow-ref:
    name: "Check worflow ref"
    runs-on: ubuntu-latest
    steps:
      - name: "Check worflow ref"
        run: |
          echo "Deploying to ${{ github.event.inputs.target_environment }} from ref: ${{ github.ref }}"
          if ! [[ ${{ github.ref }} == refs\/tags\/v* ]]; then
            echo "This workflow can only be triggered from a tag (starting with a 'v')"
            exit 1
          fi

  ask-for-review-on-slack:
    name: "Ask for deployment review on Slack"
    runs-on: ubuntu-latest
    needs: check-worflow-ref
    continue-on-error: true
    steps:
      - name: "Authentification to Google"
        uses: 'google-github-actions/auth@v2'
        with:
          workload_identity_provider: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}
      - name: "Get Slackbot token Secret"
        id: 'slackbot-token-secret'
        uses: 'google-github-actions/get-secretmanager-secrets@v2'
        with:
          secrets: |-
            SLACK_BOT_TOKEN:passculture-metier-ehp/passculture-ci-slack-bot-token
      - name: "Post a link to Slack for the deployment review"
        uses: slackapi/slack-github-action@v1.26.0
        with:
          channel-id: "CU0SQ8Y58"
          payload: |
            {
                "blocks": [
                    {
                        "type": "section",
                        "text": {
                            "type": "mrkdwn",
                            "text": ":rocket: Un <https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}|déploiement> de `${{ github.ref_name }}` a été demandé sur `${{ github.event.inputs.target_environment }}` par ${{ github.actor }}"
                        }
                    }
                ]
            }
        env:
          SLACK_BOT_TOKEN: ${{ steps.slackbot-token-secret.outputs.SLACK_BOT_TOKEN }}

  version:
    name: "Version"
    needs: check-worflow-ref
    # `deploy` is an artificial environment with protection rules, which allows a single required review instead of many
    environment:  ${{ fromJSON('["deploy", "testing"]')[github.event.inputs.target_environment == 'testing'] }}
    runs-on: ubuntu-latest
    outputs:
      APP_VERSION: ${{ steps.app-version.outputs.APP_VERSION }}
    steps:
      - name: "Checkout Release"
        uses: actions/checkout@v4.1.7
        with:
          ref: "${{ github.ref }}"
          fetch-depth: 0
      - name: "Get app version"
        id: "app-version"
        run: echo APP_VERSION="$(cat ./api/version.txt)" | tee -a $GITHUB_OUTPUT

  deploy-ehp:
    name: "Deploy on EHP environnement"
    needs: version
    if: github.event.inputs.target_environment != 'production'
    uses: ./.github/workflows/dev_on_workflow_deploy.yml
    with:
      environment: ${{ github.event.inputs.target_environment }}
      app_version: ${{ needs.version.outputs.APP_VERSION }}
      teleport_version: 15.2.5
      teleport_proxy: teleport.ehp.passculture.team:443
      teleport_kubernetes_cluster: passculture-metier-ehp
      deploy_api: true
      deploy_pro: true
      doc-api-entrypoint: 'api/documentation'
    secrets:
      GCP_EHP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
      GCP_EHP_SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}

  deploy-integration:
    name: "Deploy on integration environnement"
    needs: version
    if: github.event.inputs.target_environment == 'production'
    uses: ./.github/workflows/dev_on_workflow_deploy.yml
    with:
      environment: integration
      app_version: ${{ needs.version.outputs.APP_VERSION }}
      teleport_version: 15.2.5
      teleport_proxy: teleport.ehp.passculture.team:443
      teleport_kubernetes_cluster: passculture-metier-ehp
      deploy_api: true
      deploy_pro: true
      doc-api-entrypoint: 'api/documentation'
    secrets:
      GCP_EHP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
      GCP_EHP_SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}

  deploy-prod:
    name: "Deploy on production environnement"
    needs: version
    if: github.event.inputs.target_environment == 'production'
    uses: ./.github/workflows/dev_on_workflow_deploy.yml
    with:
      environment: ${{ github.event.inputs.target_environment }}
      app_version: ${{ needs.version.outputs.APP_VERSION }}
      teleport_version: 15.2.5
      teleport_proxy: teleport.passculture.team:443
      teleport_kubernetes_cluster: passculture-metier-prod
      deploy_api: true
      deploy_pro: true
    secrets:
      GCP_EHP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
      GCP_EHP_SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}

  slack-notification:
    name: "Send Slack notification"
    runs-on: ubuntu-latest
    if: always()
    needs:
      - version
      - deploy-prod
      - deploy-ehp
    steps:
      - uses: technote-space/workflow-conclusion-action@v3
      - name: "Authentification to Google"
        uses: 'google-github-actions/auth@v2'
        with:
          workload_identity_provider: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}
      - name: "Get Secret"
        id: 'secrets'
        uses: 'google-github-actions/get-secretmanager-secrets@v2'
        with:
          secrets: |-
            SLACK_BOT_TOKEN:passculture-metier-ehp/passculture-ci-slack-bot-token
      - name: "Post outcome on #alertes-deploiement"
        if: always()
        uses: slackapi/slack-github-action@v1.26.0
        with:
          channel-id: "CQAMNFVPS"
          payload: |
            {
              "attachments": [
                  {
                    "mrkdwn_in": ["text"],
                    "color": "${{ fromJSON('["#36a64f", "#A30002"]')[ env.WORKFLOW_CONCLUSION == 'failure'] }}",
                    "author_name": "${{github.actor}}",
                    "author_link": "https://github.com/${{github.actor}}",
                    "author_icon": "https://github.com/${{github.actor}}.png",
                    "title": "PCAPI Deployment",
                    "title_link": "https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}",
                    "text": "Le déploiement de la version `v${{ needs.version.outputs.APP_VERSION }}` a ${{ fromJSON('["réussi", "échoué"]')[env.WORKFLOW_CONCLUSION != 'success'] }} sur `${{ github.event.inputs.target_environment }}` ${{ fromJSON('[":muscle:", ":boom:"]')[env.WORKFLOW_CONCLUSION != 'success'] }}"
                  }
              ],
              "unfurl_links": false,
              "unfurl_media": false
            }
        env:
          SLACK_BOT_TOKEN: ${{ steps.secrets.outputs.SLACK_BOT_TOKEN }}
      - name: "Post success on #shérif"
        if: env.WORKFLOW_CONCLUSION == 'success'
        uses: slackapi/slack-github-action@v1.26.0
        with:
          channel-id: "CU0SQ8Y58"
          payload: |
            {
                "blocks": [
                    {
                        "type": "section",
                        "text": {
                            "type": "mrkdwn",
                            "text": ":white_check_mark: La version `v${{ needs.version.outputs.APP_VERSION }}` a été déployée sur `${{ github.event.inputs.target_environment }}`"
                        }
                    }
                ]
            }
        env:
          SLACK_BOT_TOKEN: ${{ steps.secrets.outputs.SLACK_BOT_TOKEN }}