create-release.yml

name: Deploy Kaapi to EC2 Production

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+" # Deploy only when tags like v1.0.0, v2.1.0, etc., are created

concurrency:
  group: production-ec2-deploy
  cancel-in-progress: false

jobs:
  verify-ci:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
    steps:
      - name: Confirm CI passed on the tagged commit
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          SHA="${{ github.sha }}"
          echo "Checking Kaapi CI conclusion for ${SHA}"
          CONCLUSION=$(gh api \
            "repos/${{ github.repository }}/actions/runs?head_sha=${SHA}" \
            --jq 'first(.workflow_runs[]
                    | select(.name == "Kaapi CI" and .status == "completed")
                    | .conclusion) // "missing"')
          echo "Kaapi CI conclusion: ${CONCLUSION}"
          if [ "${CONCLUSION}" != "success" ]; then
            echo "::error::Kaapi CI has not passed for ${SHA} (conclusion: ${CONCLUSION}). Aborting release."
            exit 1
          fi

  deploy:
    needs: verify-ci
    runs-on: ubuntu-latest
    environment: AWS_ENV

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Trigger deploy on EC2 via SSM
        id: ssm
        env:
          BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
          APP_NAME: ${{ secrets.PM2_APP_NAME }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
          DEPLOY_SHA: ${{ github.sha }}
        run: |
          : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"

          REMOTE_CMD="git config --global --add safe.directory $BUILD_DIRECTORY \
            && cd $BUILD_DIRECTORY \
            && git fetch origin --tags --prune \
            && git checkout $DEPLOY_SHA \
            && npm ci \
            && npm run build \
            && pm2 restart $APP_NAME"

          # Build the parameters as JSON so quoting in REMOTE_CMD can't break it.
          PARAMS=$(jq -n --arg cmd "$REMOTE_CMD" '{commands: [$cmd]}')

          CMD_ID=$(aws ssm send-command \
            --instance-ids "$INSTANCE_ID" \
            --document-name "AWS-RunShellScript" \
            --comment "Deploy kaapi-frontend ${{ github.ref_name }}" \
            --parameters "$PARAMS" \
            --region "$AWS_REGION" \
            --query "Command.CommandId" --output text)
          echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"
          echo "Sent SSM command: $CMD_ID"

      - name: Wait for SSM command to finish
        timeout-minutes: 20
        env:
          INSTANCE_ID: ${{ secrets.EC2_INSTANCE_ID }}
          CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
        run: |
          while true; do
            if aws ssm wait command-executed \
              --command-id "$CMD_ID" \
              --instance-id "$INSTANCE_ID"; then
              break   # waiter succeeds only on Status == Success
            fi

            STATUS=$(aws ssm get-command-invocation \
              --command-id "$CMD_ID" \
              --instance-id "$INSTANCE_ID" \
              --query "Status" --output text 2>/dev/null || echo "Pending")

            case "$STATUS" in
              Success) break ;;
              Failed|Cancelled|Cancelling|TimedOut)
                echo "Deployment ended with status: $STATUS"
                aws ssm get-command-invocation \
                  --command-id "$CMD_ID" \
                  --instance-id "$INSTANCE_ID" \
                  --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
                  --output json
                exit 1 ;;
              *) echo "Still running (status: $STATUS) — waiter capped out, re-waiting" ;;
            esac
          done

          echo "Deployment completed successfully."
          aws ssm get-command-invocation \
            --command-id "$CMD_ID" \
            --instance-id "$INSTANCE_ID" \
            --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
            --output json

  notify:
    needs: [verify-ci, deploy]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/discord-notify
        with:
          webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
          name: kaapi-frontend-production
          release: ${{ github.ref_name }}
          sha: ${{ github.sha }}
          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          ok: ${{ needs.deploy.result == 'success' }}
          # Call out the specific case where the release was blocked by CI.
          failure-reason: ${{ needs.verify-ci.result != 'success' && 'CI never passed on the tagged commit — release blocked.' || '' }}