deploy.yml

---
name: deploy
on:  # yamllint disable-line rule:truthy
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        environment: ["staging", "firefoxci"]
    env:
      TASKCLUSTER_ROOT_URL: ${{vars.TASKCLUSTER_ROOT_URL}}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: pip
      - name: Install dependencies
        run: pip install -r requirements/test.txt
      - name: Set root url
        run: |
          if [ "${{ matrix.environment }}" == "staging" ]; then
            echo "TASKCLUSTER_ROOT_URL=https://stage.taskcluster.nonprod.cloudops.mozgcp.net" >> $GITHUB_ENV;
          elif [ "${{ matrix.environment }}" == "firefoxci" ]; then
            echo "TASKCLUSTER_ROOT_URL=https://firefox-ci-tc.services.mozilla.com" >> $GITHUB_ENV;
          fi
      - name: Run checks
        run: tc-admin check --environment ${{matrix.environment}}

  apply:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    needs: check
    environment: apply-${{matrix.environment}}
    continue-on-error: true
    strategy:
      matrix:
        environment: ["staging", "firefoxci"]
    env:
      TASKCLUSTER_ROOT_URL: ${{vars.TASKCLUSTER_ROOT_URL}}
      TASKCLUSTER_CLIENT_ID: ${{vars.TASKCLUSTER_CLIENT_ID}}
      TASKCLUSTER_ACCESS_TOKEN: ${{secrets.TASKCLUSTER_ACCESS_TOKEN}}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: pip
      - name: Install dependencies
        run: pip install -r requirements/base.txt
      - name: Deploy environment
        id: apply_config
        run: tc-admin apply --environment ${{matrix.environment}}

  notify:
    if: github.event_name == 'push' && always()
    runs-on: ubuntu-latest
    needs: [check, apply]
    steps:
      - name: Notify Slack
        if: always()
        run: |
          WORKFLOW_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
          SLACK_MESSAGE="*Deploy ${{ github.repository }}* (<${WORKFLOW_URL}|view workflow>)"

          if [ "${{ needs.check.result }}" == "success" ]; then
            CHECK_EMOJI=":white_check_mark:"
            CHECK_VERB="succeeded"
          else
            CHECK_EMOJI=":x:"
            CHECK_VERB="failed"
          fi

          if [ "${{ needs.apply.result }}" == "success" ]; then
            APPLY_EMOJI=":white_check_mark:"
            APPLY_VERB="succeeded"
          else
            APPLY_EMOJI=":x:"
            APPLY_VERB="failed"
          fi

          SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7)
          SLACK_MESSAGE=$(cat <<-EOF
            {
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "Deploy of <https://github.com/${{ github.repository }}|${{ github.repository }}> from <https://github.com/${{ github.repository }}/commit/${{ github.sha }}|${SHORT_SHA}> is resolved"
                  }
                },
                {
                  "type": "divider"
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "${CHECK_EMOJI} check ${CHECK_VERB}\n${APPLY_EMOJI} apply ${APPLY_VERB}"
                  }
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "<https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Workflow>"
                  }
                }
              ]
            }
          EOF
          )
          curl -X POST -H 'Content-type: application/json' --data "${SLACK_MESSAGE}" ${{ secrets.SLACK_WEBHOOK_URL }}