deploy.yml

name: Deployment

on:
  push:
    branches:
      - main
  pull_request:
    types:
      - labeled

concurrency:
  group: deploy-main
  cancel-in-progress: true

jobs:
  deploy:
    if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.label.name == 'deploy')
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Create SSH key file
        run: |
          mkdir ~/.ssh
          echo "${{ secrets.AWS_EC2_PRIVATE_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa

      - name: Apply Terraform
        uses: ./.github/actions/apply/terraform
        with:
          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          db_username: ${{ secrets.TF_VAR_DB_USERNAME }}
          db_password: ${{ secrets.TF_VAR_DB_PASSWORD }}

      - name: Migrate database
        uses: ./.github/actions/migrate/database
        with:
          db_host: ${{ vars.DB_HOST }}
          db_port: ${{ vars.DB_PORT }}
          db_name: ${{ vars.DB_NAME }}
          db_user: ${{ secrets.DB_USER }}
          db_password: ${{ secrets.DB_PASSWORD }}
#
      - name: Deploy backend to EC2
        uses: ./.github/actions/deploy/backend
        with:
          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws_region: ${{ vars.AWS_REGION }}
          aws_ec2_private_key: ${{ secrets.AWS_EC2_PRIVATE_KEY }}
          aws_ec2_remote_host: ${{ vars.AWS_EC2_REMOTE_HOST }}
          db_host: ${{ vars.DB_HOST }}
          db_port: ${{ vars.DB_PORT }}
          db_user: ${{ vars.DB_USER }}
          db_password: ${{ secrets.DB_PASSWORD }}
          db_name: ${{ vars.DB_NAME }}
          cors_allowed_origin: ${{ vars.CORS_ALLOWED_ORIGIN }}
          server_port: ${{ vars.SERVER_PORT }}
          server_cert_path: ${{ vars.SERVER_CERT_PATH }}
          server_key_path: ${{ vars.SERVER_KEY_PATH }}
          cookie_domain: ${{ vars.COOKIE_DOMAIN }}
          jwt_access_token_key: ${{ secrets.JWT_ACCESS_TOKEN_KEY }}
          jwt_refresh_token_key: ${{ secrets.JWT_REFRESH_TOKEN_KEY }}

      - name: Deploy web to S3
        uses: ./.github/actions/deploy/web
        with:
          aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws_region: ${{ vars.AWS_REGION }}
          aws_bucket_name: ${{ vars.AWS_BUCKET_NAME }}

      - name: Remove deploy label
        if: github.event_name == 'pull_request' && github.event.label.name == 'deploy'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          curl -X DELETE \
            -H "Authorization: Bearer $GITHUB_TOKEN" \
            -H "Accept: application/vnd.github+json" \
            https://api.github.com/repos/${{ github.repository }}/issues/${PR_NUMBER}/labels/deploy