Tagged prod releases (#1058)

* feat(ci): require tagged releases for deploy to prod

* feat(ci): maintain scheduled dev-blue deploy as a separate workflow

* chore(ci): bump everything to version 7 of checkout

* refactor(ci): I don't think we actually need checkout?

* refactor(ci): remove redundant workflow_call block.

Author: lemald

.github/workflows/deploy-dev-blue-scheduled.yml

@@ -0,0 +1,28 @@
+name: Scheduled deploy to dev-blue
+
+on:
+  schedule:
+    - cron: "0 5 * * *"
+
+permissions:
+  contents: read # Needed to checkout repo
+
+concurrency:
+  group: deploy-dev-blue
+  cancel-in-progress: true
+
+jobs:
+  call-workflow:
+    name: Call MBTA deploy-ecs workflow
+    permissions:
+      contents: read # Needed to checkout repo
+      id-token: write # Needed to access ECR and ECS
+    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@c76e5ccd9556fbea52bc41548f7ceed5985ad775 # v5.1.0
+    with:
+      app-name: api
+      environment: dev-blue
+      docker-additional-tags: dev-blue
+    secrets:
+      aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+      docker-repo: ${{ secrets.DOCKER_REPO }}
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/deploy-dev-blue.yml

@@ -0,0 +1,43 @@
+name: Deploy to lower environment (dev etc)
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        type: environment
+        default: dev
+        required: true
+  push:
+    branches: master
+
+permissions:
+  contents: read # Needed to checkout repo
+
+concurrency:
+  group: deploy-${{ inputs.environment }}
+  cancel-in-progress: true
+
+jobs:
+  check-env:
+    name: Fail if production environment
+    if: ${{ inputs.environment == 'prod' }}
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          echo "Failing intentionally. Please use the 'Deploy to production' workflow."
+          exit 1
+  call-workflow:
+    name: Call MBTA deploy-ecs workflow
+    if: ${{ inputs.environment != 'prod' }}
+    permissions:
+      contents: read # Needed to checkout repo
+      id-token: write # Needed to access ECR and ECS
+    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@c76e5ccd9556fbea52bc41548f7ceed5985ad775 # v5.1.0
+    with:
+      app-name: api
+      environment: ${{ inputs.environment }}
+      docker-additional-tags: ${{ inputs.environment }}
+    secrets:
+      aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+      docker-repo: ${{ secrets.DOCKER_REPO }}
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/deploy-dev-green.yml

@@ -1,45 +1,39 @@
-name: Deploy to Prod (ECS)
+name: Deploy to Prod
 
-on: workflow_dispatch
+on:
+  workflow_dispatch:
+  release:
+    types:
+      - released
 
-permissions: {}
+permissions:
+  contents: read # Needed to checkout repo
 
 concurrency:
   group: deploy-prod
   cancel-in-progress: true
 
 jobs:
-  deploy:
-    name: Deploy
+  check-ref:
+    name: Fail if not a tag
+    if: ${{ !startsWith(github.ref, 'refs/tags/') }}
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write # Needed to communicate with AWS
-      contents: read # Needed to check out code
-    environment: prod
-    concurrency: prod
-    env:
-      ECS_CLUSTER: api
-      ECS_SERVICE: api-prod
-
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-      - uses: mbta/actions/build-push-ecr@788f8e264e9ebb1b76b927c89e6466d5a162be80 # v2.24
-        id: build-push
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          docker-repo: ${{ secrets.DOCKER_REPO }}
-          docker-additional-tags: prod
-      - name: Deploy to ECS
-        uses: mbta/actions/deploy-ecs@788f8e264e9ebb1b76b927c89e6466d5a162be80 # v2.24
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          ecs-cluster: ${{ env.ECS_CLUSTER }}
-          ecs-service: ${{ env.ECS_SERVICE }}
-          docker-tag: ${{ steps.build-push.outputs.docker-tag }}
-      - uses: mbta/actions/notify-slack-deploy@788f8e264e9ebb1b76b927c89e6466d5a162be80 # v2.24
-        if: ${{ !cancelled() }}
-        with:
-          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
-          job-status: ${{ job.status }}
+      - run: |
+          echo "Failing intentionally. Only tags may be deployed to prod."
+          exit 1
+  call-workflow:
+    name: Call MBTA deploy-ecs workflow
+    if: ${{ startsWith(github.ref, 'refs/tags/') }}
+    permissions:
+      contents: read # Needed to checkout repo
+      id-token: write # Needed to access ECR and ECS
+    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@c76e5ccd9556fbea52bc41548f7ceed5985ad775 # v5.1.0
+    with:
+      app-name: api
+      environment: ${{ inputs.environment }}
+      docker-additional-tags: ${{ inputs.environment }}
+    secrets:
+      aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+      docker-repo: ${{ secrets.DOCKER_REPO }}
+      slack-webhook: ${{ secrets.SLACK_WEBHOOK }}