ci-cd.yml

name: CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel superseded PR runs; never cancel an in-progress main run (which may be deploying).
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  swift-test:
    name: Swift tests
    runs-on: ubuntu-24.04-arm                # free arm64 runner (public repo); matches prod arch
    container: swift:6.3-amazonlinux2023     # exact prod toolchain — same image scripts/build.sh uses; already bundles git + openssl-devel
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - name: swift test
        run: swift test

  python-test:
    name: Python converter tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.14"         # matches converter Lambda runtime
      - name: Install dev deps
        run: pip install -r converter/requirements-dev.txt
      - name: pytest
        working-directory: converter
        run: pytest

  deploy:
    name: Build & deploy (SAM)
    needs: [swift-test, python-test]     # deploy blocked until BOTH pass
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04-arm            # native arm64 Docker: fast Swift cross-compile + converter image
    environment: production              # gives an optional approval gate; scopes OIDC sub (see setup)
    permissions:
      id-token: write                    # required for OIDC
      contents: read
    concurrency:
      group: deploy-nzimageapi           # serialize deploys; never overlap
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ap-southeast-2
      - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
        with:
          use-installer: true            # arch-independent SAM CLI install
      - name: sam build
        run: sam build                   # Swift via Makefile+Docker; converter via Docker image
      # The artefact stores live in the separate `nzimageapi-bootstrap` stack (infra/bootstrap.yaml),
      # which owns their retention lifecycle policies. Read them from that stack's outputs rather
      # than from a hand-maintained repo variable: a stale variable silently sends deploys back to
      # an unmanaged store, which is exactly what happened before this step existed.
      - name: Resolve bootstrap artefact stores
        id: bootstrap
        run: |
          set -euo pipefail
          # `|| outputs='[]'` so a missing stack reaches the guard below (which explains the fix)
          # instead of aborting on a raw ValidationError under `set -e`. The AWS error itself is
          # still printed to the log. `.[]?` does the same for a stack that has no outputs at all.
          outputs=$(aws cloudformation describe-stacks \
            --region ap-southeast-2 \
            --stack-name nzimageapi-bootstrap \
            --query 'Stacks[0].Outputs' --output json) || outputs='[]'
          bucket=$(echo "$outputs" | jq -r '[.[]? | select(.OutputKey=="ArtifactBucketName") | .OutputValue] | first // ""')
          repo=$(echo "$outputs" | jq -r '[.[]? | select(.OutputKey=="ConverterRepositoryUri") | .OutputValue] | first // ""')
          if [ -z "$bucket" ] || [ "$bucket" = "null" ] || [ -z "$repo" ] || [ "$repo" = "null" ]; then
            echo "::error::nzimageapi-bootstrap did not return both ArtifactBucketName and ConverterRepositoryUri. Deploy the bootstrap stack first: aws cloudformation deploy --region ap-southeast-2 --stack-name nzimageapi-bootstrap --template-file infra/bootstrap.yaml"
            exit 1
          fi
          echo "bucket=$bucket" >> "$GITHUB_OUTPUT"
          echo "repo=$repo" >> "$GITHUB_OUTPUT"
          echo "Artefact bucket: $bucket"
          echo "Converter repo:  $repo"
      - name: sam deploy
        run: |
          sam deploy \
            --stack-name nzimageapi \
            --region ap-southeast-2 \
            --s3-bucket ${{ steps.bootstrap.outputs.bucket }} \
            --image-repositories Jp2ConverterFunction=${{ steps.bootstrap.outputs.repo }} \
            --capabilities CAPABILITY_IAM \
            --no-confirm-changeset \
            --no-fail-on-empty-changeset \
            --parameter-overrides \
              DigitalNzApiKey=${{ secrets.DIGITALNZ_API_KEY }} \
              ApiClientSecrets='${{ secrets.API_CLIENT_SECRETS }}' \
              ConverterSigningKey=${{ secrets.CONVERTER_SIGNING_KEY }} \
              AlarmEmail=${{ vars.ALARM_EMAIL }}