deploy-backend.yml

name: Deploy Backend

on:
  workflow_call:
    inputs:
      apigee_environment:
        required: true
        type: string
      build_recordprocessor_image:
        required: false
        type: boolean
        default: false
      recordprocessor_image_version:
        required: false
        type: string
        default: ""
      diff_base_sha:
        required: false
        type: string
        default: ""
      diff_head_sha:
        required: false
        type: string
        default: ""
      run_diff_check:
        required: false
        type: boolean
        default: false
      create_mns_subscription:
        required: false
        type: boolean
        default: true
      environment:
        required: true
        type: string
      sub_environment:
        required: true
        type: string
    outputs:
      recordprocessor_image_version:
        description: Selected immutable image selector used for recordprocessor deployment
        value: ${{ jobs.deploy-recordprocessor-image.outputs.image_uri }}
  workflow_dispatch:
    inputs:
      apigee_environment:
        type: choice
        description: Select the Apigee proxy environment
        options:
          - internal-dev
          - internal-qa
          - int
          - ref
          - prod
      create_mns_subscription:
        description: Create an MNS Subscription programatically. Only available in AWS dev
        required: false
        type: boolean
        default: true
      environment:
        type: choice
        description: Select the AWS backend environment
        options:
          - dev
          - preprod
          - prod
      build_recordprocessor_image:
        description: Build and publish a new recordprocessor image
        required: true
        type: boolean
        default: true
      recordprocessor_image_version:
        description: Existing immutable recordprocessor image selector (tag, digest, or image URI) for reuse mode
        required: false
        type: string
        default: ""
      diff_base_sha:
        description: Base commit SHA for diff checks
        required: false
        type: string
        default: ""
      diff_head_sha:
        description: Head commit SHA for diff checks
        required: false
        type: string
        default: ""
      run_diff_check:
        description: Enable diff checks to auto-build on code changes
        required: true
        type: boolean
        default: false
      sub_environment:
        type: string
        description: Set the sub environment name e.g. pr-xxx, or green/blue in higher environments

env: # Sonarcloud - do not allow direct usage of untrusted data
  APIGEE_ENVIRONMENT: ${{ inputs.apigee_environment }}
  ENVIRONMENT: ${{ inputs.environment }}
  SUB_ENVIRONMENT: ${{ inputs.sub_environment }}

run-name: Deploy Backend - ${{ inputs.environment }} ${{ inputs.sub_environment }}

jobs:
  deploy-recordprocessor-image:
    name: Deploy recordprocessor image
    uses: ./.github/workflows/deploy-lambda-artifact.yml
    with:
      lambda_name: recordprocessor
      environment: ${{ inputs.environment }}
      sub_environment: ${{ inputs.sub_environment }}
      build_image: ${{ inputs.build_recordprocessor_image }}
      image_version: ${{ inputs.recordprocessor_image_version }}
      run_diff_check: ${{ inputs.run_diff_check }}
      diff_base_sha: ${{ inputs.diff_base_sha }}
      diff_head_sha: ${{ inputs.diff_head_sha }}
      lambda_paths: |
        lambdas/recordprocessor/
      shared_paths: |
        lambdas/shared/src/common/
      docker_context_path: lambdas
      dockerfile_path: lambdas/recordprocessor/Dockerfile
      ecr_repository: imms-recordprocessor-repo
      image_tag_prefix: ${{ inputs.sub_environment }}-
      allow_implicit_tag_prefix_reuse: ${{ inputs.sub_environment == 'internal-dev' || startsWith(inputs.sub_environment, 'pr-') }}

  terraform-plan:
    permissions:
      id-token: write
      contents: read
    needs:
      - deploy-recordprocessor-image
    if: ${{ !cancelled() && needs.deploy-recordprocessor-image.result == 'success' }}
    outputs:
      recordprocessor_image_uri: ${{ needs.deploy-recordprocessor-image.outputs.image_uri }}
    runs-on: ubuntu-latest
    env:
      TF_VAR_recordprocessor_image_uri: ${{ needs.deploy-recordprocessor-image.outputs.image_uri }}
    environment:
      name: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98

      - name: Connect to AWS
        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
        with:
          aws-region: eu-west-2
          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/auto-ops
          role-session-name: github-actions

      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85
        with:
          terraform_version: "1.12.2"

      - name: Terraform Init
        working-directory: infrastructure/instance
        run: make init

      - name: Terraform Plan
        # Ignore cancellations to prevent Terraform from being killed while it holds a state lock
        # A stuck process can still be killed with the force-cancel API operation
        if: ${{ !failure() }}
        working-directory: infrastructure/instance
        run: make plan-ci

      - name: Save Terraform Plan
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        with:
          name: ${{ env.ENVIRONMENT }}-${{ env.SUB_ENVIRONMENT }}-tfplan
          path: infrastructure/instance/tfplan

  terraform-apply:
    permissions:
      id-token: write
      contents: read
    needs: terraform-plan
    if: ${{ !cancelled() && needs.terraform-plan.result == 'success' }}
    runs-on: ubuntu-latest
    env:
      TF_VAR_recordprocessor_image_uri: ${{ needs.terraform-plan.outputs.recordprocessor_image_uri }}
    environment:
      name: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98

      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37
        with:
          aws-region: eu-west-2
          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/auto-ops
          role-session-name: github-actions

      - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85
        with:
          terraform_version: "1.12.2"

      - name: Retrieve Terraform Plan
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
        with:
          name: ${{ env.ENVIRONMENT }}-${{ env.SUB_ENVIRONMENT }}-tfplan
          path: infrastructure/instance

      - name: Terraform Init
        working-directory: infrastructure/instance
        run: make init

      - name: Terraform Apply
        # Ignore cancellations to prevent Terraform from being killed while it holds a state lock
        # A stuck process can still be killed with the force-cancel API operation
        if: ${{ !failure() }}
        working-directory: infrastructure/instance
        run: |
          make apply-ci
          echo "ID_SYNC_QUEUE_ARN=$(make -s output name=id_sync_queue_arn)" >> $GITHUB_ENV

      - name: Install poetry
        if: ${{ inputs.environment == 'dev' && inputs.create_mns_subscription }}
        run: pip install poetry==2.1.4

      - uses: actions/setup-python@v6.2.0
        if: ${{ inputs.environment == 'dev' && inputs.create_mns_subscription }}
        with:
          python-version: 3.11
          cache: "poetry"
          cache-dependency-path: |
            lambdas/mns_subscription/poetry.lock
            lambdas/shared/poetry.lock

      - name: Create MNS Subscription
        if: ${{ inputs.environment == 'dev' && inputs.create_mns_subscription }}
        working-directory: "./lambdas/mns_subscription"
        env:
          APIGEE_ENVIRONMENT: int
          SQS_ARN: ${{ env.ID_SYNC_QUEUE_ARN }}
        run: |
          poetry install --no-root
          echo "Subscribing SQS to MNS for notifications..."
          make subscribe