deploy-production-api.yml

### !!!
# This file is automatically generated using Terraform.
# Do not update it manually. If changes need to be made,
# please request help from a maintainer to generate the
# updated version.
### !!!

name: "Deployment: production-api"

on:
  workflow_dispatch:
    inputs:
      tag:
        type: string
        required: true
        description: Image tag to deploy.
  workflow_call:
    inputs:
      tag:
        type: string
        required: true
        description: Image tag to deploy.
    secrets:
      ACCESS_TOKEN:
        required: true
        description: GitHub access token.
      AWS_ACCESS_KEY_ID:
        required: true
        description: AWS access key ID.
      AWS_SECRET_ACCESS_KEY:
        required: true
        description: AWS secret access key.
      SLACK_WEBHOOK_URL:
        required: true
        description: Slack webhook URL.
      GH_SLACK_USERNAME_MAP:
        required: true
        description: JSON mapping of GitHub usernames to Slack user IDs.

# Only allow a single deployment workflow (service + environment) to happen at a time
# If you need to stop an in-progress deployment of a service to force another for
# the same environment, you'll need to manually cancel it
concurrency: ${{ github.workflow }}

jobs:
  deploy:
    name: Deploy production-api
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Validate initiation user
        uses: actions/github-script@v6
        with:
          github-token: ${{ secrets.ACCESS_TOKEN }}
          script: |
            const { data: members } = await github.rest.teams.listMembersInOrg({
              org: 'WordPress',
              team_slug: 'openverse-maintainers',
            });
            const isAllowed = members.some(m => m.login === "${{ github.actor }}")
            if (!isAllowed) {
              throw new Error(
                "Only GitHub users in the @WordPress/openverse-maintainers "
                + "team are allowed to run this workflow. If you need to run "
                + "this workflow, please reach out to that group for help."
              )
            }

      - name: Set the Slack user
        shell: python
        env:
          GH_SLACK_USERNAME_MAP: ${{ secrets.GH_SLACK_USERNAME_MAP }}
        run: |
          import json
          import os
          mapping = json.loads('${{ env.GH_SLACK_USERNAME_MAP }}')
          github_user = "${{ github.actor }}"
          slack_id = mapping[github_user]
          with open(os.getenv('GITHUB_ENV'), "a") as env_file:
              env_file.write(f"SLACK_USER_ID={slack_id}")

      - name: Notify deployment start
        uses: slackapi/slack-github-action@v1.23.0
        if: success() || failure()
        with:
          payload: |
            {
              "text": "Starting deployment of production-api",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":spinning-cd: A deployment of *production-api* triggered by <@${{ env.SLACK_USER_ID }}> is starting using the `${{ inputs.tag }}` tag."
                  }
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|Click here to monitor the deployment>."
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Validate `tag` input for Nginx
        uses: actions/github-script@v6
        with:
          script: |
            let exists = undefined,
              page = 0
            while (!exists) {
              page += 1
              const { data: versions } =
                await github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg({
                  package_type: 'container',
                  package_name: 'openverse-api_nginx',
                  org: 'WordPress',
                  page,
                  // max of `per_page`
                  per_page: 100,
                })
              if (!versions.length) {
                break
              }
              exists = versions.some((v) => v.metadata.container.tags.includes('${{ inputs.tag }}'))
            }
            if (!exists) {
              throw new Error(
                `'${{ inputs.tag }}' does not appear to be a valid tag for the ghcr.io/wordpress/openverse-api_nginx image.`
              )
            }

      - name: Validate `tag` input for Django
        uses: actions/github-script@v6
        with:
          script: |
            let exists = undefined,
              page = 0
            while (!exists) {
              page += 1
              const { data: versions } =
                await github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg({
                  package_type: 'container',
                  package_name: 'openverse-api',
                  org: 'WordPress',
                  page,
                  // max of `per_page`
                  per_page: 100,
                })
              if (!versions.length) {
                break
              }
              exists = versions.some((v) => v.metadata.container.tags.includes('${{ inputs.tag }}'))
            }
            if (!exists) {
              throw new Error(
                `'${{ inputs.tag }}' does not appear to be a valid tag for the ghcr.io/wordpress/openverse-api image.`
              )
            }

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        if: success() || failure()
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1

      - name: Download task definition template and update family name
        shell: bash
        run: |
          aws ecs describe-task-definition \
            --task-definition production-api-template \
            --query taskDefinition > task-definition.json

          # Remove template from the family name (the render action does not support this)
          sed -i 's/"family": "production-api-template"/"family": "production-api"/g' task-definition.json

      - name: "Fill in the new nginx image ID in the Amazon ECS task definition"
        id: "task-def-nginx"
        uses: "aws-actions/amazon-ecs-render-task-definition@v1"
        with:
          task-definition: task-definition.json
          container-name: nginx
          image: "ghcr.io/wordpress/openverse-api_nginx:${{ inputs.tag }}"

      - name: "Fill in the new django image ID in the Amazon ECS task definition"
        id: "task-def-django"
        uses: "aws-actions/amazon-ecs-render-task-definition@v1"
        with:
          task-definition: ${{ steps.task-def-nginx.outputs.task-definition }}
          container-name: django
          image: "ghcr.io/wordpress/openverse-api:${{ inputs.tag }}"

      - name: Deploy Amazon ECS task definition
        uses: aws-actions/amazon-ecs-deploy-task-definition@v1
        with:
          task-definition: ${{ steps.task-def-django.outputs.task-definition }}
          service: production-api
          cluster: production-default
          wait-for-service-stability: true
          wait-for-minutes: 10

      - name: Notify deployment finished
        uses: slackapi/slack-github-action@v1.23.0
        with:
          payload: |
            {
              "text": "Deployment of production-api successful",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":tadaco: The deployment of *production-api* triggered by <@${{ env.SLACK_USER_ID }}> using the `${{ inputs.tag }}` tag *succeeded*."
                  }
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|Click here to review the completed deployment workflow>."
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Notify deployment failure
        if: failure()
        uses: slackapi/slack-github-action@v1.23.0
        with:
          payload: |
            {
              "text": "Deployment of production-api failed!",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":alert: The deployment of *production-api* triggered by <@${{ env.SLACK_USER_ID }}> using the `${{ inputs.tag }}` tag *failed* :alert:"
                  }
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|Click here to review the failed deployment workflow>."
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK