create-release.yml

name: Deploy Kaapi to ECS Production

on:
  push:
    tags:
      - "v[0-9]+.[0-9]+.[0-9]+" # Deploy only when tags like v1.0.0, v2.1.0, etc., are created

jobs:
  verify-ci:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      actions: read
    steps:
      - name: Confirm CI passed on the tagged commit
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          SHA="${{ github.sha }}"
          echo "Checking Kaapi CI conclusion for ${SHA}"
          CONCLUSION=$(gh api \
            "repos/${{ github.repository }}/actions/runs?head_sha=${SHA}" \
            --jq 'first(.workflow_runs[]
                    | select(.name == "Kaapi CI" and .status == "completed")
                    | .conclusion) // "missing"')
          echo "Kaapi CI conclusion: ${CONCLUSION}"
          if [ "${CONCLUSION}" != "success" ]; then
            echo "::error::Kaapi CI has not passed for ${SHA} (conclusion: ${CONCLUSION}). Aborting release."
            exit 1
          fi

  build:
    needs: verify-ci
    runs-on: ubuntu-latest
    environment: AWS_ENV_VARS

    permissions:
      packages: write
      contents: read
      attestations: write
      id-token: write

    steps:
      - name: Checkout the repo
        uses: actions/checkout@v7

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ap-south-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and Push Docker Image
        env:
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          REPOSITORY: ${{ vars.AWS_RESOURCE_PREFIX }}-repo
          TAG: ${{ github.ref_name }}
        run: |
          docker build \
            --build-arg GIT_SHA=${{ github.sha }} \
            -t $REGISTRY/$REPOSITORY:latest \
            -t $REGISTRY/$REPOSITORY:$TAG \
            ./backend
          docker push $REGISTRY/$REPOSITORY:latest
          docker push $REGISTRY/$REPOSITORY:$TAG

      - name: Run database migrations
        env:
          CLUSTER: ${{ vars.AWS_RESOURCE_PREFIX }}-cluster
          SERVICE: ${{ vars.AWS_RESOURCE_PREFIX }}-service
          TASK_DEF: ${{ vars.AWS_RESOURCE_PREFIX }}-task
        run: |
          CONTAINER_NAME=$(aws ecs describe-task-definition --task-definition $TASK_DEF --query 'taskDefinition.containerDefinitions[0].name' --output text)

          NETWORK_CONFIG=$(aws ecs describe-services --cluster $CLUSTER --services $SERVICE \
            --query 'services[0].networkConfiguration' --output json | jq -c '.')

          TASK_ARN=$(aws ecs run-task \
            --cluster $CLUSTER \
            --launch-type FARGATE \
            --task-definition $TASK_DEF \
            --count 1 \
            --network-configuration "$NETWORK_CONFIG" \
            --overrides "{\"containerOverrides\":[{\"name\":\"$CONTAINER_NAME\",\"command\":[\"uv\",\"run\",\"alembic\",\"upgrade\",\"head\"]}]}" \
            --query 'tasks[0].taskArn' --output text)

          echo "Migration task started: $TASK_ARN"
          aws ecs wait tasks-stopped --cluster $CLUSTER --tasks "$TASK_ARN"

          EXIT_CODE=$(aws ecs describe-tasks --cluster $CLUSTER --tasks "$TASK_ARN" \
            --query "tasks[0].containers[?name=='$CONTAINER_NAME'].exitCode | [0]" --output text)

          if [ "$EXIT_CODE" != "0" ]; then
            echo "Migration failed with exit code $EXIT_CODE"
            aws ecs describe-tasks --cluster $CLUSTER --tasks "$TASK_ARN" \
              --query "tasks[0].{stopCode:stopCode,stoppedReason:stoppedReason,containerReason:containers[?name=='$CONTAINER_NAME'].reason | [0]}" \
              --output json
            exit 1
          fi
          echo "Migration completed successfully"

      - name: Deploy backend service
        timeout-minutes: 15
        uses: ./.github/actions/ecs-deploy
        with:
          cluster: ${{ vars.AWS_RESOURCE_PREFIX }}-cluster
          service: ${{ vars.AWS_RESOURCE_PREFIX }}-service
          task-definition: ${{ vars.AWS_RESOURCE_PREFIX }}-task

      - name: Deploy celery service
        timeout-minutes: 15
        uses: ./.github/actions/ecs-deploy
        with:
          cluster: ${{ vars.AWS_RESOURCE_PREFIX }}-cluster
          service: ${{ vars.AWS_RESOURCE_PREFIX }}-celery-task
          task-definition: ${{ vars.AWS_RESOURCE_PREFIX }}-celery-task

  notify:
    needs: [verify-ci, build]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/discord-notify
        with:
          webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
          name: kaapi-production
          release: ${{ github.ref_name }}
          sha: ${{ github.sha }}
          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          ok: ${{ needs.build.result == 'success' }}
          # Call out the specific case where the release was blocked by CI.
          failure-reason: ${{ needs.verify-ci.result != 'success' && 'CI never passed on the tagged commit — release blocked.' || '' }}