firezone/.github/workflows/cd.yml

name: Continuous Delivery
on:
  push:
    branches:
      - main

env:
  # mark:automatic-version
  VERSION: "1.20231001.0"

# Cancel old workflow runs if new code is pushed
concurrency:
  group: "cd-${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: false

jobs:
  ci:
    uses: ./.github/workflows/ci.yml
    secrets: inherit

  deploy:
    runs-on: ubuntu-latest
    # if: ${{ github.event.workflow_run.conclusion == 'success' }}
    permissions:
      contents: write
    needs:
      - ci
    env:
      TF_CLOUD_ORGANIZATION: "firezone"
      TF_API_TOKEN: "${{ secrets.TF_API_TOKEN }}"
      TF_WORKSPACE: "staging"
    steps:
      - name: Get Terraform Version
        run: |
          TERRAFORM_VERSION=$(cat .tool-versions | grep terraform | awk '{ print $NF; }')
          echo "TERRAFORM_VERSION=${TERRAFORM_VERSION}" >> $GITHUB_ENV
      - uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TERRAFORM_VERSION }}
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      # - name: "Push Changed Application Tags"
      #   env:
      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      #     FILE_TO_COMMIT: terraform/environments/staging/versions.auto.tfvars
      #     DESTINATION_BRANCH: ${{ github.ref_name }}
      #   run: |
      #     sed -ri 's/^(\s*)(api_image_tag\s*=\s*"[^"]*"\s*$)/api_image_tag = "${{ github.sha }}"/' ./terraform/environments/staging/versions.auto.tfvars
      #     sed -ri 's/^(\s*)(web_image_tag\s*=\s*"[^"]*"\s*$)/web_image_tag = "${{ github.sha }}"/' ./terraform/environments/staging/versions.auto.tfvars
      #     cat ./terraform/environments/staging/versions.auto.tfvars

      #     export TODAY=$( date -u '+%Y-%m-%d' )
      #     export SHA=$( git rev-parse $DESTINATION_BRANCH:$FILE_TO_COMMIT )
      #     export CONTENT=$( base64 -i $FILE_TO_COMMIT )

      #     gh api \
      #       --method PUT /repos/${{ github.repository }}/contents/$FILE_TO_COMMIT \
      #       --field message="Push updated container versions [skip actions]" \
      #       --field content="$CONTENT" \
      #       --field encoding="base64" \
      #       --field branch="$DESTINATION_BRANCH" \
      #       --field sha="$SHA"
      - name: Upload Configuration
        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.0.4
        id: apply-upload
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          # Subdirectory is set in the project settings:
          # https://app.terraform.io/app/firezone/workspaces/staging/settings/general
          directory: "./"
      - name: Create Plan Run
        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.0.4
        id: apply-run
        env:
          TF_VAR_api_image_tag: '"${{ env.VERSION }}-${{ github.sha }}"'
          TF_VAR_web_image_tag: '"${{ env.VERSION }}-${{ github.sha }}"'
          TF_VAR_relay_image_tag: '"${{ env.VERSION }}-${{ github.sha }}"'
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          configuration_version:
            ${{ steps.apply-upload.outputs.configuration_version_id }}
      - name: Apply
        uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.0.4
        if: fromJSON(steps.apply-run.outputs.payload).data.attributes.actions.IsConfirmable
        id: apply
        with:
          run: ${{ steps.apply-run.outputs.run_id }}
          comment: "Apply Run from GitHub Actions CI ${{ github.sha }}"
      - name: Report Status
        if: failure()
        uses: rtCamp/action-slack-notify@v2
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_USERNAME: "GitHub Actions"
          SLACK_COLOR: "#ff0000"
          MSG_MINIMAL: "ref,actions url"
          SLACK_TITLE: "Deployment Failed"
          SLACK_MESSAGE:
            "Automatic deployment to ${{ env.TF_WORKSPACE }} failed"
        with:
          status: ${{ job.status }}
          notify_when: "failure"

  update_release_draft:
    needs: deploy
    runs-on: ubuntu-latest
    permissions:
      # write permission is required to create a github release
      contents: write
      # autolabeler
      pull-requests: write
    steps:
      - uses: release-drafter/release-drafter@v5
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          version: ${{ env.VERSION }}