deploy.yml

# This workflow will build and push a new container image to Amazon ECR,
# and then will deploy a new task definition for each of the services to Amazon ECS.

# Expected vars:
# The following vars must be set at the repo level. Their values must be JSON and contain one key per
# environment (dev, prod, etc.) and the value for each key must be the value for that environment.
#
#   DEPLOY_APP_NAME: {"dev": "app1", "prod": "app2"}
#   DEPLOY_AWS_REGION: {"dev": "us-west-2", "prod": "us-east-1"}
#   AWS_ACCOUNT: {"dev": "123456789012", "prod": "123456789012"}

# Note: The names of repository, cluster, services match what is configured in https://github.com/dimagi/ocs-deploy

name: Deploy to Amazon ECS

on:
  workflow_dispatch:
    inputs:
      environment:
        description: "Deploy environment"
        required: true
        type: choice
        options:
          - dev
          - prod
  workflow_run:
    workflows: [ Lint and Test ]
    types: [completed]
    branches: [main]

permissions:
  id-token: write
  contents: read
  deployments: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.environment }}
  cancel-in-progress: false

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}

    steps:
    - name: Checkout
      uses: actions/checkout@v6

    - name: Set Deploy Env
      # Set the deploy env based on the input from the event or else from the branch
      run: |
        if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
          DEPLOY_ENV="${{ inputs.environment }}"
        elif [[ "${{github.base_ref}}" == "main" || "${{github.ref}}" == "refs/heads/main" ]]; then
          DEPLOY_ENV="prod"
        else
          DEPLOY_ENV="dev"
        fi

        echo "DEPLOY_ENV=$DEPLOY_ENV" >> "$GITHUB_ENV"

    - name: Set variables
      # Set other variables accordingly
      run: |
        # you can't reference the `env` context when defining other env vars to do it here
        APP_NAME="${{ fromJSON(vars.DEPLOY_APP_NAME)[env.DEPLOY_ENV] }}"
        AWS_REGION="${{ fromJSON(vars.DEPLOY_AWS_REGION)[env.DEPLOY_ENV] }}"
        echo "APP_NAME=$APP_NAME" >> "$GITHUB_ENV"
        echo "AWS_REGION=$AWS_REGION" >> "$GITHUB_ENV"
        echo "ECR_REPOSITORY=$APP_NAME-${{ env.DEPLOY_ENV }}-ecr-repo" >> "$GITHUB_ENV"
        echo "ECS_CLUSTER=$APP_NAME-${{ env.DEPLOY_ENV }}-Cluster" >> "$GITHUB_ENV"
        echo "ECS_SERVICE_DJANGO=$APP_NAME-${{ env.DEPLOY_ENV }}-Django" >> "$GITHUB_ENV"
        echo "ECS_SERVICE_CELERY=$APP_NAME-${{ env.DEPLOY_ENV }}-Celery" >> "$GITHUB_ENV"
        echo "ECS_SERVICE_CELERY_BEAT=$APP_NAME-${{ env.DEPLOY_ENV }}-CeleryBeat" >> "$GITHUB_ENV"
        echo "DJANGO_STACK_NAME=$APP_NAME-${{ env.DEPLOY_ENV }}-$AWS_REGION-django-stack" >> "$GITHUB_ENV"

    - name: Create GitHub deployment
      uses: chrnorm/deployment-action@v2
      id: deployment
      with:
        token: '${{ github.token }}'
        environment: "aws-${{ env.DEPLOY_ENV }}"
        production-environment: ${{ env.DEPLOY_ENV == 'prod' }}
        description: "Deploying ${{ github.head_ref || github.ref }} to AWS ${{ env.DEPLOY_ENV }}"

    - name: configure aws credentials
      uses: aws-actions/configure-aws-credentials@v6.1.0
      with:
        role-to-assume: "arn:aws:iam::${{ fromJSON(vars.AWS_ACCOUNT)[env.DEPLOY_ENV] }}:role/github_deploy"
        role-session-name: GithubDeploy
        aws-region: ${{ fromJSON(vars.DEPLOY_AWS_REGION)[env.DEPLOY_ENV] }}

    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v2.1.4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Get image names
      id: image-name
      env:
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
        IMAGE_TAG: ${{ github.sha }}
      run: |
        echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT
        echo "image_latest=$ECR_REGISTRY/$ECR_REPOSITORY:latest" >> $GITHUB_OUTPUT

    - name: Build and push
      uses: docker/build-push-action@v7
      with:
        tags: |
          ${{ steps.image-name.outputs.image }}
          ${{ steps.image-name.outputs.image_latest }}
        file: Dockerfile
        cache-from: type=gha
        cache-to: type=gha,mode=max
        outputs: type=image,push=true,oci-mediatypes=true,compression=zstd,compression-level=3,force-compression=true


    - name: Update ECS task def for Django web container
      id: django-web-def
      uses: aws-actions/amazon-ecs-render-task-definition@v1.8.4
      with:
        task-definition-family: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-Django
        container-name: web
        image: ${{ steps.image-name.outputs.image }}

    - name: Update ECS task def for Migration container
      id: migration-def
      uses: aws-actions/amazon-ecs-render-task-definition@v1.8.4
      with:
        task-definition-family: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-Migration
        container-name: migrate
        image: ${{ steps.image-name.outputs.image }}

    - name: Update ECS task def for Celery worker container
      id: celery-worker-def
      uses: aws-actions/amazon-ecs-render-task-definition@v1.8.4
      with:
        task-definition-family: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-CeleryWorkerTask
        container-name: celery-worker
        image: ${{ steps.image-name.outputs.image }}

    - name: Update ECS task def for Celery beat container
      id: celery-beat-def
      uses: aws-actions/amazon-ecs-render-task-definition@v1.8.4
      with:
        task-definition-family: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-CeleryBeatTask
        container-name: celery-beat
        image: ${{ steps.image-name.outputs.image }}

    - name: Get stack outputs for network config
      id: stack-outputs
      run: |
        set -e
        OUTPUTS=$(aws cloudformation describe-stacks \
          --stack-name "$DJANGO_STACK_NAME" \
          --query 'Stacks[0].Outputs' \
          --output json) || { echo "Failed to retrieve CloudFormation stack outputs"; exit 1; }

        SUBNETS=$(echo "$OUTPUTS" | jq -r '.[] | select(.OutputKey | endswith("PrivateSubnets")) | .OutputValue')
        SG=$(echo "$OUTPUTS" | jq -r '.[] | select(.OutputKey | endswith("ServiceSecurityGroup")) | .OutputValue')

        [[ -z "$SUBNETS" ]] && { echo "Error: Could not find subnets in stack outputs"; exit 1; }
        [[ -z "$SG" ]] && { echo "Error: Could not find security group in stack outputs"; exit 1; }

        echo "subnets=$SUBNETS" >> $GITHUB_OUTPUT
        echo "security_group=$SG" >> $GITHUB_OUTPUT

    - name: Run migration task
      id: run-migration
      run: |
        # Strip metadata fields that cause issues when re-registering
        jq 'del(.tags, .registeredAt, .registeredBy, .taskDefinitionArn, .revision, .status, .requiresAttributes, .compatibilities)' \
          ${{ steps.migration-def.outputs.task-definition }} > /tmp/migration-task-def.json

        # Register task definition with new image
        TASK_DEF_ARN=$(aws ecs register-task-definition \
          --cli-input-json file:///tmp/migration-task-def.json \
          --query 'taskDefinition.taskDefinitionArn' \
          --output text)

        # Run the migration task
        TASK_ARN=$(aws ecs run-task \
          --cluster "$ECS_CLUSTER" \
          --task-definition "$TASK_DEF_ARN" \
          --launch-type FARGATE \
          --network-configuration "awsvpcConfiguration={subnets=[${{ steps.stack-outputs.outputs.subnets }}],securityGroups=[${{ steps.stack-outputs.outputs.security_group }}],assignPublicIp=DISABLED}" \
          --query 'tasks[0].taskArn' \
          --output text)

        echo "task_arn=$TASK_ARN" >> $GITHUB_OUTPUT
        echo "Started migration task: $TASK_ARN"

    - name: Wait for migration & output logs
      run: |
        echo "Waiting for migration task to complete..."
        aws ecs wait tasks-stopped \
          --cluster "$ECS_CLUSTER" \
          --tasks "${{ steps.run-migration.outputs.task_arn }}"

        # Check exit code
        EXIT_CODE=$(aws ecs describe-tasks \
          --cluster "$ECS_CLUSTER" \
          --tasks "${{ steps.run-migration.outputs.task_arn }}" \
          --query 'tasks[0].containers[0].exitCode' \
          --output text)

        # Get task details for log configuration
        TASK_ID=$(echo "${{ steps.run-migration.outputs.task_arn }}" | cut -d'/' -f3)

        # Output migration logs
        LOG_STREAM="${LOG_STREAM_PREFIX}/${TASK_ID}"
        echo "Fetching migration logs from CloudWatch..."

        LOGS=$(aws logs get-log-events \
          --log-group-name "$LOG_GROUP" \
          --log-stream-name "$LOG_STREAM" \
          --limit 100 \
          --query 'events[*].message' \
          --output json 2>&1) || LOGS="Could not fetch logs"

        # Output to console
        echo "----------------------------------------"
        echo "$LOGS"
        echo "----------------------------------------"

        # Add to job summary
        {
          echo "## Migration Logs"
          echo ""
          echo "**Task ID:** \`$TASK_ID\`"
          echo "**Log Group:** \`$LOG_GROUP\`"
          echo "**Log Stream:** \`$LOG_STREAM\`"
          echo ""
          echo "<details>"
          echo "<summary>View Logs</summary>"
          echo ""
          echo "\`\`\`json"
          echo "$LOGS"
          echo "\`\`\`"
          echo "</details>"
        } >> $GITHUB_STEP_SUMMARY

        if [ "$EXIT_CODE" != "0" ]; then
          echo "Migration failed with exit code: $EXIT_CODE"
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "❌ **Migration failed with exit code: $EXIT_CODE**" >> $GITHUB_STEP_SUMMARY
          exit 1
        fi

        echo "Migration completed successfully"
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "✅ **Migration completed successfully**" >> $GITHUB_STEP_SUMMARY
      env:
        LOG_GROUP: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-DjangoMigrationLogs
        LOG_STREAM_PREFIX: ${{ env.APP_NAME }}-${{ env.DEPLOY_ENV }}-migrate/migrate

    - name: Deploy Django Web
      uses: aws-actions/amazon-ecs-deploy-task-definition@v2
      with:
        task-definition: ${{ steps.django-web-def.outputs.task-definition }}
        service: ${{ env.ECS_SERVICE_DJANGO }}
        cluster: ${{ env.ECS_CLUSTER }}
        wait-for-service-stability: false

    - name: Deploy Celery Worker
      uses: aws-actions/amazon-ecs-deploy-task-definition@v2
      with:
        task-definition: ${{ steps.celery-worker-def.outputs.task-definition }}
        service: ${{ env.ECS_SERVICE_CELERY }}
        cluster: ${{ env.ECS_CLUSTER }}
        wait-for-service-stability: false

    - name: Deploy Celery Beat
      uses: aws-actions/amazon-ecs-deploy-task-definition@v2
      with:
        task-definition: ${{ steps.celery-beat-def.outputs.task-definition }}
        service: ${{ env.ECS_SERVICE_CELERY_BEAT }}
        cluster: ${{ env.ECS_CLUSTER }}
        wait-for-service-stability: false

    - name: Wait for service stability
      run: |
          # Run the three waiters in parallel. `set -e` (default in GH Actions bash)
          # doesn't apply to background processes, so we capture each exit code via
          # `wait <pid>` and fail only after all three have finished.
          aws ecs wait services-stable --cluster "$ECS_CLUSTER" --services "$ECS_SERVICE_DJANGO" &
          pid_django=$!
          aws ecs wait services-stable --cluster "$ECS_CLUSTER" --services "$ECS_SERVICE_CELERY" &
          pid_celery=$!
          aws ecs wait services-stable --cluster "$ECS_CLUSTER" --services "$ECS_SERVICE_CELERY_BEAT" &
          pid_celery_beat=$!

          rc=0
          wait "$pid_django"      || { echo "Django service failed to stabilise"; rc=1; }
          wait "$pid_celery"      || { echo "Celery service failed to stabilise"; rc=1; }
          wait "$pid_celery_beat" || { echo "CeleryBeat service failed to stabilise"; rc=1; }
          exit $rc

    - name: Update deployment status
      if: always()
      uses: chrnorm/deployment-status@v2
      with:
        token: '${{ github.token }}'
        environment-url: ${{ steps.deployment.outputs.environment_url }}
        deployment-id: ${{ steps.deployment.outputs.deployment_id }}
        state: ${{ job.status == 'success' && 'success' || 'failure' }}

    - name: Create Sentry release
      if: success()
      uses: getsentry/action-release@v3
      env:
        SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
        SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
        SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
      with:
        environment: "${{ env.DEPLOY_ENV == 'prod' && 'production' || 'development' }}"
        ignore_empty: true
        ignore_missing: true