data-replication-pipeline.yml

name: Deploy data replication
run-name: Deploy data replication from ${{ inputs.git_ref_to_deploy || github.ref_name }} to ${{ inputs.environment }}

on:
  workflow_dispatch:
    inputs:
      environment:
        description: Deployment environment
        required: true
        type: choice
        options:
          - training
          - production
          - test
          - qa
          - sandbox-alpha
          - sandbox-beta
      git_ref_to_deploy:
        description:
          | # Use blank unicode character (U+2800) to force line-break
          Use code from: ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
          (Git ref to deploy, for example, a tag, branch name or commit SHA. Will use workflow ref if not provided.)
        type: string

permissions: {}

env:
  environment: ${{ inputs.environment }}
  deployment_type: ${{ inputs.deployment_type }}
  db_snapshot_arn: ${{ inputs.db_snapshot_arn }}
  egress_cidr: ${{ inputs.egress_cidr }}
  take_db_snapshot: ${{ inputs.take_db_snapshot }}
  git_ref_to_deploy: ${{ inputs.git_ref_to_deploy || github.sha }}
  aws_role: ${{ inputs.environment == 'production'
    && 'arn:aws:iam::820242920762:role/GithubDeployDataReplicationInfrastructure'
    || 'arn:aws:iam::393416225559:role/GithubDeployDataReplicationInfrastructure' }}
  aws_account_id: ${{ inputs.environment == 'production' && '820242920762' || '393416225559' }}

concurrency:
  group: deploy-data-replica-${{ inputs.environment }}

jobs:
  validate-inputs:
    runs-on: ubuntu-latest
    permissions: {}
    steps:
      - name: Validate inputs
        run: |
          if [[ "$environment" == "preview" || "$environment" == "production" ]]; then
            if [[ -z "$git_ref_to_deploy" ]]; then
              echo "Error: git_ref_to_deploy is required for preview and production environments."
              exit 1
            fi
          fi

  determine-git-sha:
    runs-on: ubuntu-latest
    permissions: {}
    needs: validate-inputs
    outputs:
      git-sha: ${{ steps.get-git-sha.outputs.git-sha }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ env.git_ref_to_deploy }}
      - name: Get git sha
        id: get-git-sha
        run: echo "git-sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT

  build-and-push-image:
    permissions:
      id-token: write
    needs: determine-git-sha
    uses: ./.github/workflows/build-and-push-image.yml
    with:
      git_sha: ${{ needs.determine-git-sha.outputs.git-sha }}

  prepare-deployment:
    name: Prepare deployment
    runs-on: ubuntu-latest
    needs: [build-and-push-image, determine-git-sha]
    permissions:
      id-token: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v5
        with:
          ref: ${{ env.git_ref_to_deploy }}
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ env.aws_role }}
          aws-region: eu-west-2
      - name: Get image digest
        id: get-image-digest
        run: |
          digest=$(aws ecr describe-images \
            --repository-name mavis/webapp \
            --image-ids imageTag=${{ needs.determine-git-sha.outputs.git-sha }} \
            --query 'imageDetails[0].imageDigest' \
            --output text)
          echo "digest=$digest" >> $GITHUB_OUTPUT
      - name: Parse environment variables
        id: parse-environment-variables
        env:
          MAVIS__PDS__RATE_LIMIT_PER_SECOND: ${{ inputs.environment == 'production' && 50 || 5 }}
        run: |
          {
            echo 'parsed_env_vars<<EOF'
            echo "MAVIS__SPLUNK__ENABLED=false"
            echo "MAVIS__CIS2__ENABLED=false"
            echo "MAVIS__PDS__ENQUEUE_BULK_UPDATES=false"
            echo "MAVIS__PDS__RATE_LIMIT_PER_SECOND=$MAVIS__PDS__RATE_LIMIT_PER_SECOND"
            echo 'EOF'
          } >> "$GITHUB_OUTPUT"
      - name: Populate web task definition
        id: create-task-definition
        uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition-family: "mavis-data-replication-task-definition-${{ inputs.environment }}-template"
          container-name: "application"
          image: "${{ env.aws_account_id }}.dkr.ecr.eu-west-2.amazonaws.com/mavis/webapp@${{ steps.get-image-digest.outputs.digest }}"
          environment-variables: ${{ steps.parse-environment-variables.outputs.parsed_env_vars }}
      - name: Rename task definition file
        run: mv ${{ steps.create-task-definition.outputs.task-definition }} ${{ runner.temp }}/data-replication-task-definition.json
      - name: Upload artifact for data-replication task definition
        uses: actions/upload-artifact@v5
        with:
          name: ${{ inputs.environment }}-data-replication-task-definition
          path: ${{ runner.temp }}/data-replication-task-definition.json

  notify-approval-required:
    name: Notify on approval required
    runs-on: ubuntu-latest
    needs: prepare-deployment
    if: ${{ inputs.environment == 'production' }}
    steps:
      - name: Notify pending approval
        if: inputs.environment == 'production'
        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a
        with:
          webhook: ${{ secrets.SLACK_MAVIS_TECH_WEBHOOK_URL }}
          webhook-type: incoming-webhook
          payload: |
            text: ":hourglass: Approval required :hourglass:"
            blocks:
              - type: "section"
                text:
                  type: "mrkdwn"
                  text: "${{ github.workflow }} requires approval"
              - type: "section"
                fields:
                  - type: "mrkdwn"
                    text: "<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View workflow run>"
                  - type: "mrkdwn"
                    text: "*Triggered by:*\n${{ github.actor }}"

  approve-deployments:
    name: Wait for approval if required
    runs-on: ubuntu-latest
    needs: prepare-deployment
    environment: ${{ inputs.environment }}
    steps:
      - run: echo "Proceeding with deployment to $environment environment"

  deploy-data-replication:
    name: Deploy data-replication service
    runs-on: ubuntu-latest
    needs: [prepare-deployment, approve-deployments]
    permissions:
      id-token: write
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ env.aws_role }}
          aws-region: eu-west-2
      - name: Download data-replication task definition artifact
        uses: actions/download-artifact@v6
        with:
          path: ${{ runner.temp }}
          name: ${{ inputs.environment }}-data-replication-task-definition
      - name: Change family of task definition
        run: |
          file_path="${{ runner.temp }}/data-replication-task-definition.json"
          family_name="mavis-data-replication-task-definition-$environment"
          echo "$(jq --arg f "$family_name" '.family = $f' "$file_path")" > "$file_path"
      - name: Deploy data-replication service
        id: ecs-deploy
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: ${{ runner.temp }}/data-replication-task-definition.json
          cluster: mavis-${{ inputs.environment }}-data-replication
          service: mavis-${{ inputs.environment }}-data-replication
          force-new-deployment: true
          wait-for-service-stability: true
      - name: Check if deployment was successful
        run: |
          current_task_definition_arn=$(aws ecs describe-services --cluster mavis-$environment-data-replication --services mavis-$environment-data-replication --query services[0].deployments[0].taskDefinition | jq -r ".")
          new_task_definition_arn=${{ steps.ecs-deploy.outputs.task-definition-arn }}
          echo "Current task definition arn: $current_task_definition_arn"
          echo "Expected task definition arn after deployment: $new_task_definition_arn"
          if [ "$current_task_definition_arn" != "$new_task_definition_arn" ]; then
            echo "Task definition arns don't match, likely due to a rollback to the previous version. Deployment failed."
            exit 1
          fi