deploy.yml

name: deploy
run-name: Open infrastructure PR for ${{ github.event.release.tag_name }}

on:
  release:
    types: [published]

env:
  INFRA_REPO: Gaucho-Racing/infrastructure
  KUSTOMIZATION: infra/kubernetes/gr-foundry/manifests/notify/kustomization.yaml
  SERVICES: "server web"

jobs:
  infra-pr:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout Notify
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Pull secrets
        id: vault
        uses: Gaucho-Racing/vault-pull-secrets@v1
        with:
          secrets: infrastructure.pr_token

      - name: Checkout infrastructure
        uses: actions/checkout@v4
        with:
          repository: ${{ env.INFRA_REPO }}
          token: ${{ fromJSON(steps.vault.outputs.secrets_json).PR_TOKEN }}
          path: infra

      - name: Resolve versions
        id: versions
        run: |
          NEW_TAG="${{ github.event.release.tag_name }}"
          NEW="${NEW_TAG#v}"
          OLD="$(yq '.images[] | select(.name == "ghcr.io/gaucho-racing/notify-server") | .newTag' "$KUSTOMIZATION")"
          echo "new_tag=$NEW_TAG" >> "$GITHUB_OUTPUT"
          echo "new=$NEW" >> "$GITHUB_OUTPUT"
          echo "old=$OLD" >> "$GITHUB_OUTPUT"
          echo "old_tag=v$OLD" >> "$GITHUB_OUTPUT"
          echo "short_sha=$(git rev-parse --short "$GITHUB_SHA")" >> "$GITHUB_OUTPUT"
          if [ "$NEW" = "$OLD" ]; then
            echo "Infrastructure is already at $NEW."
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Bump image tags
        if: steps.versions.outputs.skip == 'false'
        env:
          NEW: ${{ steps.versions.outputs.new }}
        run: |
          awk -v new="$NEW" '
            $0 ~ "- name: ghcr.io/gaucho-racing/notify-(server|web)$" { innotify=1; print; next }
            innotify==1 && $1=="newTag:" { sub(/newTag:[[:space:]]*.*/, "newTag: " new); innotify=0 }
            { print }
          ' "$KUSTOMIZATION" > "$KUSTOMIZATION.tmp" && mv "$KUSTOMIZATION.tmp" "$KUSTOMIZATION"
          git -C infra diff -- kubernetes/gr-foundry/manifests/notify/kustomization.yaml

      - name: Build changelog
        if: steps.versions.outputs.skip == 'false'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NOTIFY_REPO: ${{ github.repository }}
          NEW_TAG: ${{ steps.versions.outputs.new_tag }}
          OLD_TAG: ${{ steps.versions.outputs.old_tag }}
        run: |
          emit_commits() {
            for sha in $(git rev-list --no-merges "$@"); do
              short="$(git rev-parse --short "$sha")"
              subject="$(git show -s --format=%s "$sha" | sed -E 's/ \(#[0-9]+\)$//')"
              login="$(gh api "repos/$NOTIFY_REPO/commits/$sha" --jq '.author.login // empty' 2>/dev/null || true)"
              pr="$(gh api "repos/$NOTIFY_REPO/commits/$sha/pulls" --jq '.[0].number // empty' 2>/dev/null || true)"
              line="- \`$short\` $subject"
              [ -n "$login" ] && line="$line - @$login"
              [ -n "$pr" ] && line="$line ([#$pr](https://github.com/$NOTIFY_REPO/pull/$pr))"
              echo "$line"
            done
          }
          {
            echo "Bumps the Notify service images to **${NEW_TAG#v}**:"
            echo
            for service in $SERVICES; do echo "- \`notify-$service\` → \`${NEW_TAG#v}\`"; done
            echo
            echo "## Changes since ${OLD_TAG}"
            echo
            if git rev-parse "$OLD_TAG" >/dev/null 2>&1; then
              COMMITS="$(emit_commits "${OLD_TAG}..${NEW_TAG}")"
              if [ -n "$COMMITS" ]; then echo "$COMMITS"; else echo "_No non-merge commits between ${OLD_TAG} and ${NEW_TAG}._"; fi
            else
              echo "_Previous tag ${OLD_TAG} not found in history; showing the latest commits instead._"
              echo
              emit_commits -20 "$NEW_TAG"
            fi
            echo
            echo "**[View all changes](https://github.com/${NOTIFY_REPO}/compare/${OLD_TAG}...${NEW_TAG})**"
            echo
            echo "_Opened automatically by the deploy workflow on release ${NEW_TAG}._"
          } > "$RUNNER_TEMP/pr-body.md"
          cat "$RUNNER_TEMP/pr-body.md"

      - name: Create pull request
        if: steps.versions.outputs.skip == 'false'
        working-directory: infra
        env:
          GH_TOKEN: ${{ fromJSON(steps.vault.outputs.secrets_json).PR_TOKEN }}
          NEW: ${{ steps.versions.outputs.new }}
          NEW_TAG: ${{ steps.versions.outputs.new_tag }}
          SHORT_SHA: ${{ steps.versions.outputs.short_sha }}
          RELEASE_AUTHOR: ${{ github.event.release.author.login }}
        run: |
          BRANCH="bot/bump-notify-${NEW}"
          git config user.name "GR Admin"
          git config user.email "team@gauchoracing.com"
          git switch -C "$BRANCH"
          git commit -am "Deploy: notify to ${NEW_TAG} (${SHORT_SHA})"
          git push -f -u origin "$BRANCH"
          PR="$(gh pr list --repo "$INFRA_REPO" --head "$BRANCH" --state open --json number -q '.[0].number')"
          if [ -n "$PR" ]; then
            echo "PR #$PR already open for $BRANCH; pushed the updated branch."
          else
            gh pr create \
              --repo "$INFRA_REPO" \
              --base main \
              --head "$BRANCH" \
              --title "Deploy: notify to ${NEW_TAG} (${SHORT_SHA})" \
              --body-file "$RUNNER_TEMP/pr-body.md"
            PR="$(gh pr list --repo "$INFRA_REPO" --head "$BRANCH" --state open --json number -q '.[0].number')"
          fi
          if [ -n "$PR" ] && [ -n "$RELEASE_AUTHOR" ]; then
            gh pr edit "$PR" --repo "$INFRA_REPO" --add-reviewer "$RELEASE_AUTHOR" \
              || echo "Could not request review from @$RELEASE_AUTHOR."
          fi