ci-cd.yml

name: CI/CD

on:
  push:
    tags: [v*]
    branches:
      - main
  pull_request:
    # By default, a workflow only runs when a pull_request event's activity type is opened,
    # synchronize, or reopened.
    types: [opened, synchronize, reopened, edited]
    branches:
      - main

permissions: read-all

jobs:
  check-auto-tagging-will-work:
    if: |
      github.event_name == 'pull_request' &&
      (! startsWith(github.ref, 'refs/tags') && ! startsWith(github.ref, 'refs/heads/main'))
    uses: climatepolicyradar/reusable-workflows/.github/workflows/check-auto-tagging-will-work.yml@v10

  code-quality:
    if: |
      ! cancelled() && always() &&
      (needs.check-auto-tagging-will-work.result == 'skipped' || needs.check-auto-tagging-will-work.result == 'success') &&
      ! startsWith(github.ref, 'refs/tags')
    needs:
      - check-auto-tagging-will-work
    permissions:
      # For trunk to post annotations
      checks: write
      # For repo checkout
      contents: read
    uses: climatepolicyradar/reusable-workflows/.github/workflows/python-precommit-validator.yml@v13
    with:
      # These ignores are different, since for some reason, the
      # specific one isn't working on this field.
      # trunk-ignore-all: Sometimes the Python version is split at .'s in Actions
      python-version: "3.10"
      # trunk-ignore(yamllint/quoted-strings): Sometimes the Python version is split at .'s in Actions
      poetry-version: "1.8.2"

  non-search-tests:
    if: |
      ! cancelled() && always() &&
      (needs.check-auto-tagging-will-work.result == 'skipped' || needs.check-auto-tagging-will-work.result == 'success') &&
      ! startsWith(github.ref, 'refs/tags')
    needs:
      - check-auto-tagging-will-work
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Use .env.example
        run: cp .env.example .env

      - name: Get python Container
        run: docker pull python:3.10

      - name: Build
        run: |
          docker compose build
          docker images

      - name: Build docker-compose stack
        run: make start_without_vespa_setup

      - name: Wait for backend to open port
        run: ./wait_for_port.sh localhost 8888 60

      - name: Run backend tests
        run: make test_non_search

      - name: Docker debug
        run: |
          docker compose logs
          docker compose ps
          docker ps -a
          ls -la

      - name: Log Dump
        if: always() && ! cancelled()
        run: docker compose logs

  search-tests:
    if: |
      ! cancelled() && always() &&
      (needs.check-auto-tagging-will-work.result == 'skipped' || needs.check-auto-tagging-will-work.result == 'success') &&
      ! startsWith(github.ref, 'refs/tags')
    needs:
      - check-auto-tagging-will-work
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Use .env.example
        run: cp .env.example .env

      - name: Get python Container
        run: docker pull python:3.10

      - name: Install latest Vespa CLI
        env:
          VESPA_CLI_VERSION: 8.250.43
        run: |
          mkdir -p scripts/vespa-cli
          curl -fsSL https://github.com/vespa-engine/vespa/releases/download/v${VESPA_CLI_VERSION}/vespa-cli_${VESPA_CLI_VERSION}_linux_amd64.tar.gz | \
            tar -zxf - -C scripts/vespa-cli --strip-component=1
          echo "scripts/vespa-cli/bin" >> $GITHUB_PATH

      - name: Build
        run: |
          docker compose build
          docker images

      - name: Build docker-compose stack & Setup vespa for search
        run: make start

      - name: Run backend search tests for vespa
        run: make test_search

      - name: Log Dump
        if: always() && ! cancelled()
        run: docker compose logs

  integration-tests:
    if: |
      ! cancelled() && always() &&
      (needs.check-auto-tagging-will-work.result == 'skipped' || needs.check-auto-tagging-will-work.result == 'success') &&
      ! startsWith(github.ref, 'refs/tags')
    needs:
      - check-auto-tagging-will-work
    runs-on: ubuntu-latest
    steps:
      - name: Run Integration Tests
        run: echo TODO-TODO-TODO-TODO-TODO-TODO-TODO-TODO-TODO-TODO-TODO-TODO

  build:
    if: |
      ! cancelled() && always() &&
      (needs.code-quality.result == 'success' &&
      needs.non-search-tests.result == 'success' &&
      needs.search-tests.result == 'success' &&
      needs.integration-tests.result == 'success') &&
      ! startsWith(github.ref, 'refs/tags')
    runs-on: ubuntu-latest
    needs:
      - code-quality
      - non-search-tests
      - search-tests
      - integration-tests
    steps:
      - uses: actions/checkout@v4

      - name: Use .env.example
        run: cp .env.example .env

      - name: Get python Container
        run: docker pull python:3.10

      - name: Build
        run: |
          docker compose build
          docker images

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-west-1

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2.0.1

      - name: Publish initial image based on branch to ECR
        id: retag_and_push_to_ecr
        uses: climatepolicyradar/retag-and-push-to-ecr@v1
        env:
          DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        with:
          repo-name: navigator-backend
          semver-tag: latest

  manual-semver:
    if: ${{ ! cancelled() && always() && startsWith(github.ref, 'refs/tags') }}
    uses: climatepolicyradar/reusable-workflows/.github/workflows/semver.yml@v3
    secrets: inherit
    with:
      repo-name: navigator-backend
      semver-tag: main-${GITHUB_SHA::8}

  tag:
    if: ${{ ! cancelled() && always() && (needs.build.result == 'success')}}
    needs: build
    permissions:
      contents: write
    uses: climatepolicyradar/reusable-workflows/.github/workflows/tag.yml@v3
    with:
      repo-name: navigator-backend
      semver-tag: main-${GITHUB_SHA::8}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}

  release:
    if: ${{ ! cancelled() && always() && (needs.tag.result == 'success' && needs.tag.outputs.new_tag != 'Skip')}}
    needs: tag
    permissions:
      contents: write
    uses: climatepolicyradar/reusable-workflows/.github/workflows/release.yml@v3
    with:
      new_tag: ${{ needs.tag.outputs.new_tag }}