cd-prod.yml

name: CD - Production

on:
  workflow_dispatch:

env:
  AWS_REGION: ap-northeast-2
  ECS_CLUSTER: Codedang-Api

permissions: # permissions to the job (for the OpenID Connection)
  id-token: write
  contents: read

jobs:
  # TODO: trigger Amplify deployment
  build-client-api:
    name: Build client-api image
    runs-on: ubuntu-latest
    steps:
      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_FOR_ECR_PUSH }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          file: ./apps/backend/Dockerfile
          push: true
          build-args: |
            target=client
            app_env=production
          tags: ${{ steps.login-ecr.outputs.registry }}/codedang-client-api:latest

  build-admin-api:
    name: Build admin-api image
    runs-on: ubuntu-latest
    steps:
      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_FOR_ECR_PUSH }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          file: ./apps/backend/Dockerfile
          push: true
          build-args: |
            target=admin
            app_env=production
          tags: ${{ steps.login-ecr.outputs.registry }}/codedang-admin-api:latest

  build-iris:
    name: Build iris Docker image
    runs-on: ubuntu-latest
    steps:
      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_FOR_ECR_PUSH }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push image (iris)
        uses: docker/build-push-action@v6
        with:
          push: true
          context: '{{defaultContext}}:apps/iris'
          build-args: |
            app_env=production
          tags: ${{ steps.login-ecr.outputs.registry }}/codedang-iris:latest

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    needs: [build-client-api, build-admin-api, build-iris]
    environment: production
    defaults:
      run:
        shell: bash

    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_FOR_DEPLOY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Trigger Amplify Frontend Build
        run: curl -X POST -d {} "${{ secrets.AMPLIFY_WEBHOOK }}" -H "Content-Type:application/json"

      - uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.5.2

      - name: Create Terraform variable file
        working-directory: ./apps/infra/production/codedang
        run: |
          echo "$TFVARS" >> terraform.tfvars
          echo "$OAUTH_GITHUB" >> terraform.tfvars
          echo "$OAUTH_KAKAO" >> terraform.tfvars
        env:
          TFVARS: ${{ secrets.TFVARS }}
          OAUTH_GITHUB: ${{ secrets.OAUTH_GITHUB }}
          OAUTH_KAKAO: ${{ secrets.OAUTH_KAKAO }}

      - name: Terraform Init
        working-directory: ./apps/infra/production/codedang
        run: terraform init

      - name: Terraform Plan
        working-directory: ./apps/infra/production/codedang
        run: terraform plan -input=false -out=plan.out

      - name: Terraform Apply
        working-directory: ./apps/infra/production/codedang
        run: terraform apply -input=false plan.out