deploy-staging.yml

name: Deploy Kaapi to Staging EC2

on:
  workflow_run:
    workflows: ["Kaapi CI"]
    branches: [main]
    types: [completed]
  workflow_dispatch:

concurrency:
  group: staging-ec2-deploy
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: Staging
    # workflow_dispatch runs unconditionally; workflow_run only on a green CI.
    if: >-
      ${{ github.event_name == 'workflow_dispatch' ||
          github.event.workflow_run.conclusion == 'success' }}

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
          aws-region: ap-south-1

      - name: Trigger deploy on EC2 via SSM
        id: ssm
        env:
          INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
          SECRET_IDs: ${{ vars.SECRET_MANAGER_IDS }}
          APP_DIR: ${{ secrets.APP_DIR }}
          DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
        run: |
          SECRET_IDs=$(echo "$SECRET_IDs" | tr -d '[:space:]')
          : "${APP_DIR:?APP_DIR repo/environment variable is not set}"

          DEPLOY_CMD="cd $APP_DIR \
            && git fetch --all \
            && git checkout $DEPLOY_SHA \
            && SECRET_ID=$SECRET_IDs sh scripts/fetch-secrets.sh \
            && GIT_SHA=$DEPLOY_SHA docker compose -f docker-compose.staging.yml build \
            && docker compose -f docker-compose.staging.yml --profile migrate run --rm migrate \
            && docker compose -f docker-compose.staging.yml up -d --wait --remove-orphans \
            && docker image prune -f"

          CMD_ID=$(aws ssm send-command \
            --instance-ids "$INSTANCE_ID" \
            --document-name "AWS-RunShellScript" \
            --comment "Deploy kaapi-backend kaapi-staging" \
            --parameters commands='["set -eux","sudo -iu ec2-user bash -lc \"'"$DEPLOY_CMD"'\""]' \
            --cloud-watch-output-config CloudWatchOutputEnabled=true \
            --query "Command.CommandId" --output text)
          echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"
          echo "Sent SSM command: $CMD_ID"

      - name: Wait for SSM command to finish
        timeout-minutes: 10
        env:
          INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
          CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
        run: |
          while true; do
            if aws ssm wait command-executed \
              --command-id "$CMD_ID" \
              --instance-id "$INSTANCE_ID"; then
              break   # waiter succeeds only on Status == Success
            fi

            STATUS=$(aws ssm get-command-invocation \
              --command-id "$CMD_ID" \
              --instance-id "$INSTANCE_ID" \
              --query "Status" --output text 2>/dev/null || echo "Pending")

            case "$STATUS" in
              Success) break ;;
              Failed|Cancelled|Cancelling|TimedOut)
                echo "Deployment ended with status: $STATUS"
                aws ssm get-command-invocation \
                  --command-id "$CMD_ID" \
                  --instance-id "$INSTANCE_ID" \
                  --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
                  --output json
                exit 1 ;;
              *) echo "Still running (status: $STATUS) — waiter capped out, re-waiting" ;;
            esac
          done

          echo "Deployment completed successfully."
          aws ssm get-command-invocation \
            --command-id "$CMD_ID" \
            --instance-id "$INSTANCE_ID" \
            --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
            --output json

  notify:
    needs: [deploy]
    if: ${{ always() && needs.deploy.result != 'skipped' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/discord-notify
        with:
          webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
          name: kaapi-backend-staging
          release: "#${{ github.run_number }}"
          sha: ${{ github.event.workflow_run.head_sha || github.sha }}
          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          ok: ${{ needs.deploy.result == 'success' }}