dbmisvc-app-deploy.yml

name: DBMISVC App Deploy

on:
  workflow_call:
    secrets:
      GH_TOKEN:
        required: true
    inputs:
      role:
        required: true
        type: string
      app:
        required: true
        type: string
      bucket:
        required: true
        type: string
      filename:
        required: true
        type: string
      force:
        type: boolean
        default: false
      backmerge:
        type: string
        required: false

env:
  AWS_REGION: us-east-1

permissions:
  id-token: write
  contents: write
  issues: write
  pull-requests: write

jobs:
  metadata:
    runs-on: "ubuntu-latest"
    outputs:
      branch: ${{ steps.set_branch.outputs.branch }}
    steps:
      - name: Set the current branch name
        id: set_branch
        shell: bash
        run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
  deploy:
    runs-on: ubuntu-latest
    needs:
      - "metadata"
    outputs:
      released: ${{ steps.semantic.outputs.new_release_published }}
      channel: ${{ steps.semantic.outputs.new_release_channel }}
    steps:
    - uses: actions/checkout@v4.2.2
    - name: Set up Python 3.11
      uses: actions/setup-python@v5.4.0
      with:
        python-version: 3.11
    - name: Install Python packages
      run: |
        python -m pip install --upgrade pip
    - uses: cycjimmy/semantic-release-action@v4.1.1
      id: semantic
      env:
        GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
        GIT_AUTHOR_NAME: Bryan Larson
        GIT_AUTHOR_EMAIL: bryan_larson@hms.harvard.edu
      with:
        extra_plugins: |
          @semantic-release/exec
          @semantic-release/changelog
          @semantic-release/git
          @semantic-release/github
    - name: Prepare for back merge
      if: steps.semantic.outputs.new_release_published == 'true' && !steps.semantic.outputs.new_release_channel && inputs.backmerge
      run: |
          git config --local user.email "actions@github.com"
          git config --local user.name "Github Actions"
    - name: Back merge
      if: steps.semantic.outputs.new_release_published == 'true' && !steps.semantic.outputs.new_release_channel && inputs.backmerge
      run: |
          git pull
          git checkout ${{ inputs.backmerge }}
          git branch --set-upstream-to origin/${{ inputs.backmerge }}
          git pull
          git merge --no-ff ${{ needs.metadata.outputs.branch }} -m "chore(ci): Merging v${{ steps.semantic.outputs.new_release_version }} back into '${{ inputs.backmerge }}'"
          git push
          git checkout ${{ needs.metadata.outputs.branch }}
    - name: Configure AWS credentials
      if: steps.semantic.outputs.new_release_published == 'true' || inputs.force
      uses: aws-actions/configure-aws-credentials@v4.1.0
      with:
        aws-region: ${{ env.AWS_REGION }}
        role-to-assume: ${{ inputs.role }}
        role-duration-seconds: 900
        role-session-name: GitHubActions-${{ github.run_id }}
    - name: Extract and save commit
      if: steps.semantic.outputs.new_release_published == 'true' || inputs.force
      shell: bash
      run: git rev-parse HEAD > COMMIT
    - name: Zip artifacts
      if: steps.semantic.outputs.new_release_published == 'true' || inputs.force
      uses: thedoctor0/zip-release@0.7.6
      with:
        type: "zip"
        filename: "${{ inputs.filename }}"
    - name: Upload to AWS S3
      if: steps.semantic.outputs.new_release_published == 'true' || inputs.force
      run: |
        echo "Uploading artifacts to S3"
        aws s3 cp ${{ inputs.filename }} s3://${{ inputs.bucket }}/