deploy-staging.yml

name: Deploy Kaapi to EC2 Staging

on:
  workflow_run:
    workflows: ["Kaapi CI"]
    branches: [main]
    types: [completed]
  workflow_dispatch:

concurrency:
  group: staging-ec2-deploy
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: Staging
    # workflow_dispatch runs unconditionally; workflow_run only on a green CI from a push to main (not PRs).
    if: >-
      ${{ github.event_name == 'workflow_dispatch' ||
          github.event.workflow_run.conclusion == 'success' }}

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.DEPLOY_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Trigger deploy on EC2 via SSM
        id: ssm
        env:
          BUILD_DIRECTORY: ${{ secrets.BUILD_DIRECTORY }}
          APP_NAME: ${{ secrets.PM2_APP_NAME }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          INSTANCE_ID: ${{ secrets.INSTANCE_ID }}
          ROOT_USER: ${{ secrets.USER }}
          DEPLOY_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
        run: |
          : "${BUILD_DIRECTORY:?BUILD_DIRECTORY secret is not set}"
          : "${ROOT_USER:?USER secret is not set}"

          REMOTE_CMD="export HOME=/home/$ROOT_USER \
            && export NVM_DIR=/home/$ROOT_USER/.nvm \
            && . \$NVM_DIR/nvm.sh \
            && git config --global --add safe.directory $BUILD_DIRECTORY \
            && cd $BUILD_DIRECTORY \
            && git fetch origin --tags --prune \
            && git checkout $DEPLOY_SHA \
            && npm ci \
            && npm run build \
            && sudo -iu $ROOT_USER pm2 restart $APP_NAME"

          # Build the parameters as JSON so quoting in REMOTE_CMD can't break it.
          PARAMS=$(jq -n --arg cmd "$REMOTE_CMD" '{commands: [$cmd]}')

          CMD_ID=$(aws ssm send-command \
            --instance-ids "$INSTANCE_ID" \
            --document-name "AWS-RunShellScript" \
            --comment "Deploy kaapi-frontend kaapi-staging" \
            --parameters "$PARAMS" \
            --region "$AWS_REGION" \
            --query "Command.CommandId" --output text)
          echo "cmd_id=$CMD_ID" >> "$GITHUB_OUTPUT"
          echo "Sent SSM command: $CMD_ID"

      - name: Wait for SSM command to finish
        timeout-minutes: 20
        env:
          INSTANCE_ID: ${{ secrets.INSTANCE_ID }}
          CMD_ID: ${{ steps.ssm.outputs.cmd_id }}
        run: |
          : "${INSTANCE_ID:?INSTANCE_ID secret is not set}"
          : "${CMD_ID:?SSM command ID missing from previous step}"
          while true; do
            if aws ssm wait command-executed \
              --command-id "$CMD_ID" \
              --instance-id "$INSTANCE_ID"; then
              break   # waiter succeeds only on Status == Success
            fi

            STATUS=$(aws ssm get-command-invocation \
              --command-id "$CMD_ID" \
              --instance-id "$INSTANCE_ID" \
              --query "Status" --output text 2>/dev/null || echo "Pending")

            case "$STATUS" in
              Success) break ;;
              Failed|Cancelled|Cancelling|TimedOut)
                echo "Deployment ended with status: $STATUS"
                aws ssm get-command-invocation \
                  --command-id "$CMD_ID" \
                  --instance-id "$INSTANCE_ID" \
                  --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
                  --output json
                exit 1 ;;
              *) echo "Still running (status: $STATUS) — waiter capped out, re-waiting" ;;
            esac
          done

          echo "Deployment completed successfully."
          aws ssm get-command-invocation \
            --command-id "$CMD_ID" \
            --instance-id "$INSTANCE_ID" \
            --query '{Status:Status,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' \
            --output json

  notify:
    needs: [deploy]
    if: ${{ always() && needs.deploy.result != 'skipped' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/discord-notify
        with:
          webhook-url: ${{ secrets.DISCORD_WEBHOOK_URL }}
          name: kaapi-frontend-staging
          release: "#${{ github.run_number }}"
          sha: ${{ github.event.workflow_run.head_sha || github.sha }}
          run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          ok: ${{ needs.deploy.result == 'success' }}