deploy.yaml

name: Deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      environment:
        description: 'Select the environment to deploy to (staging or production)'
        required: true
        default: 'staging'
        type: choice
        options:
          - staging
          - production
      branch:
        description: 'Branch to deploy (production always requires main)'
        required: false
        default: 'main'
        type: string
concurrency:
  group: canonical-com-deploy
  cancel-in-progress: false

env:
  CHARMCRAFT_ENABLE_EXPERIMENTAL_EXTENSIONS: true
  ROCKCRAFT_ENABLE_EXPERIMENTAL_EXTENSIONS: true

jobs:
  pack-charm:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.inputs.branch || github.ref }}

      - name: Setup LXD
        uses: canonical/setup-lxd@main

      - name: Setup Charmcraft
        run: sudo snap install charmcraft --classic --channel=latest/edge

      - name: Pack charm
        run: |
          cd charm
          charmcraft pack -v --project-dir ./

      - name: Upload charm
        uses: actions/upload-artifact@v4
        with:
          name: canonical-com-charm
          path: ./charm/*.charm

  pack-rock:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
        with:
          ref: ${{ github.event.inputs.branch || github.ref }}

      - name: Use Node.js
        uses: actions/setup-node@v3

      - name: Build Assets
        run: |
          yarn install
          yarn run build

      - name: Setup LXD
        uses: canonical/setup-lxd@main

      - name: Setup Rockcraft
        run: sudo snap install rockcraft --classic --revision 4542

      - name: Pack Rock
        run: rockcraft pack

      - name: Upload Rock
        uses: actions/upload-artifact@v4
        with:
          name: canonical-com-rock
          path: ./*.rock

  publish-image:
    runs-on: ubuntu-latest
    needs: pack-rock
    permissions:
      contents: read
      packages: write
    outputs:
      image_url: ${{ steps.set_image_url.outputs.image_url }}
    steps:
      - name: Get Rock
        uses: actions/download-artifact@v4
        with:
          name: canonical-com-rock

      - name: Set image URL
        id: set_image_url
        run: echo "image_url=ghcr.io/canonical/canonical.com:$(date +%s)-${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT

      - name: Push to GHCR
        run: skopeo --insecure-policy copy oci-archive:$(ls *.rock) docker://${{ steps.set_image_url.outputs.image_url }} --dest-creds "canonical:${{ secrets.GITHUB_TOKEN }}"

  deploy-staging:
    runs-on:
      [self-hosted, self-hosted-linux-amd64-noble-private-endpoint-medium]
    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'staging')
    needs: [pack-charm, publish-image]
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Install Dependencies
        run: |
          sudo snap install juju --channel=3.6/stable --classic
          sudo snap install vault --classic

      - name: Download Charm Artifact
        uses: actions/download-artifact@v4
        with:
          name: canonical-com-charm

      - name: Configure Vault and Juju
        run: |
          export VAULT_ADDR=https://vault.admin.canonical.com:8200
          export TF_VAR_login_approle_role_id=${{ secrets.STG_VAULT_APPROLE_ROLE_ID }}
          export TF_VAR_login_approle_secret_id=${{ secrets.STG_VAULT_APPROLE_SECRET_ID }}
          export VAULT_SECRET_PATH_ROLE=secret/prodstack6/roles/stg-staging-canonical-com
          export VAULT_SECRET_PATH_COMMON=secret/prodstack6/juju/common
          VAULT_TOKEN=$(vault write -f -field=token auth/approle/login role_id=${TF_VAR_login_approle_role_id} secret_id=${TF_VAR_login_approle_secret_id}) 
          export VAULT_TOKEN
          mkdir -p ~/.local/share/juju
          vault read -field=controller_config "${VAULT_SECRET_PATH_COMMON}/controllers/juju-controller-36-migration-ps6" | base64 -d > ~/.local/share/juju/controllers.yaml
          USERNAME=$(vault read -field=username "${VAULT_SECRET_PATH_ROLE}/juju")
          PASSWORD=$(vault read -field=password "${VAULT_SECRET_PATH_ROLE}/juju")
          printf "controllers:\n  juju-controller-36-migration-ps6:\n    user: %s\n    password: %s\n" "$USERNAME" "$PASSWORD" > ~/.local/share/juju/accounts.yaml

      - name: Deploy Application to staging
        run: |
          export JUJU_MODEL=admin/stg-staging-canonical-com
          juju refresh canonical-com --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }}
          juju refresh canonical-com-blog --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }}
          juju refresh canonical-com-careers --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }}
          juju wait-for application canonical-com --query='name=="canonical-com" && (status=="active" || status=="idle")'

  deploy-production:
    runs-on: [self-hosted, self-hosted-linux-amd64-noble-private-endpoint-medium]
    if: |
      always() &&
      needs.pack-charm.result == 'success' &&
      needs.publish-image.result == 'success' &&
      (needs.deploy-staging.result == 'success' || needs.deploy-staging.result == 'skipped') &&
      (
        github.event_name == 'push' ||
        (
          github.event_name == 'workflow_dispatch' &&
          github.event.inputs.environment == 'production' &&
          github.event.inputs.branch == 'main'
        )
      )
    needs: [pack-charm, publish-image, deploy-staging]
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Install Dependencies
        run: |
          sudo snap install juju --channel=3.6/stable --classic
          sudo snap install vault --classic

      - name: Download Charm Artifact
        uses: actions/download-artifact@v4
        with:
          name: canonical-com-charm

      - name: Configure Vault and Juju
        run: |
          export VAULT_ADDR=https://vault.admin.canonical.com:8200
          export TF_VAR_login_approle_role_id=${{ secrets.PROD_VAULT_APPROLE_ROLE_ID }}
          export TF_VAR_login_approle_secret_id=${{ secrets.PROD_VAULT_APPROLE_SECRET_ID }}
          export VAULT_SECRET_PATH_ROLE=secret/prodstack6/roles/prod-canonical-com
          export VAULT_SECRET_PATH_COMMON=secret/prodstack6/juju/common
          VAULT_TOKEN=$(vault write -f -field=token auth/approle/login role_id=${TF_VAR_login_approle_role_id} secret_id=${TF_VAR_login_approle_secret_id}) 
          export VAULT_TOKEN
          mkdir -p ~/.local/share/juju
          vault read -field=controller_config "${VAULT_SECRET_PATH_COMMON}/controllers/juju-controller-36-production-ps6" | base64 -d > ~/.local/share/juju/controllers.yaml
          USERNAME=$(vault read -field=username "${VAULT_SECRET_PATH_ROLE}/juju")
          PASSWORD=$(vault read -field=password "${VAULT_SECRET_PATH_ROLE}/juju")
          printf "controllers:\n  juju-controller-36-production-ps6:\n    user: %s\n    password: %s\n" "$USERNAME" "$PASSWORD" > ~/.local/share/juju/accounts.yaml

      - name: Deploy Application to production
        run: |
          export JUJU_MODEL=admin/prod-canonical-com
          juju refresh canonical-com --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }}
          juju refresh canonical-com-blog --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }}
          juju refresh canonical-com-careers --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }}
          juju wait-for application canonical-com --query='name=="canonical-com" && (status=="active" || status=="idle")'