deploy.yml

name: Deploy SAPI Rails API
on:
  push:
    branches:
      - staging
  workflow_dispatch:

jobs:
  deploy:
    runs-on: self-hosted
    environment: staging
    # Only the secrets .kamal/secrets-common actually references. This job
    # previously serialised the entire secrets context into one variable and
    # picked through it at runtime, which handed every repository and
    # environment secret to the job and wrote them all to a file on the
    # self-hosted runner.
    env:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_REGION: ${{ secrets.AWS_REGION }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      CAPTIVE_BREEDING_DATABASE_HOST: ${{ secrets.CAPTIVE_BREEDING_DATABASE_HOST }}
      CAPTIVE_BREEDING_DATABASE_NAME: ${{ secrets.CAPTIVE_BREEDING_DATABASE_NAME }}
      CAPTIVE_BREEDING_DATABASE_PASSWORD: ${{ secrets.CAPTIVE_BREEDING_DATABASE_PASSWORD }}
      CAPTIVE_BREEDING_DATABASE_PORT: ${{ secrets.CAPTIVE_BREEDING_DATABASE_PORT }}
      CAPTIVE_BREEDING_DATABASE_USERNAME: ${{ secrets.CAPTIVE_BREEDING_DATABASE_USERNAME }}
      CERTIFICATE_PEM: ${{ secrets.CERTIFICATE_PEM }}
      MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }}
      MAIL_USERNAME: ${{ secrets.MAIL_USERNAME }}
      PRIVATE_KEY_PEM: ${{ secrets.PRIVATE_KEY_PEM }}
      RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
      SAPI_DATABASE_HOST: ${{ secrets.SAPI_DATABASE_HOST }}
      SAPI_DATABASE_NAME: ${{ secrets.SAPI_DATABASE_NAME }}
      SAPI_DATABASE_PASSWORD: ${{ secrets.SAPI_DATABASE_PASSWORD }}
      SAPI_DATABASE_PORT: ${{ secrets.SAPI_DATABASE_PORT }}
      SAPI_DATABASE_USERNAME: ${{ secrets.SAPI_DATABASE_USERNAME }}
      SAPI_SIDEKIQ_REDIS_CACHE_URL: ${{ secrets.SAPI_SIDEKIQ_REDIS_CACHE_URL }}
      SAPI_SIDEKIQ_REDIS_URL: ${{ secrets.SAPI_SIDEKIQ_REDIS_URL }}
    steps:
      - name: Set workflow start time
        run: |
          echo "START_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_ENV

      - uses: actions/checkout@v5

      - name: Notify deployment start
        id: notify-start
        uses: unepwcmc/devops-actions/.github/actions/slack-notify@v1
        with:
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          slack-channel-id: ${{ secrets.SLACK_CHANNEL_ID }}
          notification-type: started
          action-type: Deploy
          environment: staging
          repository: ${{ github.repository }}
          repository-url: ${{ github.server_url }}/${{ github.repository }}
          action-run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          actor: ${{ github.actor }}
          actor-url: ${{ github.server_url }}/${{ github.actor }}
          workflow-name: ${{ github.workflow }}
          run-id: ${{ github.run_id }}
          commit-message: ${{ github.event.head_commit.message || 'Manual workflow trigger' }}
          runner-name: ${{ runner.name }}
          start-time: ${{ env.START_TIME }}

      - name: Validate kamal secrets
        uses: unepwcmc/devops-actions/.github/actions/validate-secrets@v1
        with:
          secrets-file: .kamal/secrets-common
          environment: staging

      - name: Deploy with Kamal v2
        uses: unepwcmc/devops-actions/.github/actions/kamal-v2.x-deploy@v1
        with:
          environment: staging
          working-directory: .
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: Set workflow end time and calculate duration
        if: always()
        run: |
          echo "END_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> $GITHUB_ENV
          if [[ -n "$START_TIME" ]]; then
            start_timestamp=$(date -d "$START_TIME" +%s)
            end_timestamp=$(date -d "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" +%s)
            duration=$((end_timestamp - start_timestamp))
            echo "DEPLOYMENT_DURATION=${duration}" >> $GITHUB_ENV
          else
            echo "DEPLOYMENT_DURATION=0" >> $GITHUB_ENV
          fi

      - name: Notify deployment success
        if: success()
        uses: unepwcmc/devops-actions/.github/actions/slack-notify@v1
        with:
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          slack-channel-id: ${{ secrets.SLACK_CHANNEL_ID }}
          notification-type: success
          action-type: Deploy
          environment: staging
          repository: ${{ github.repository }}
          repository-url: ${{ github.server_url }}/${{ github.repository }}
          action-run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          actor: ${{ github.actor }}
          actor-url: ${{ github.server_url }}/${{ github.actor }}
          workflow-name: ${{ github.workflow }}
          run-id: ${{ github.run_id }}
          commit-message: ${{ github.event.head_commit.message || 'Manual workflow trigger' }}
          runner-name: ${{ runner.name }}
          start-time: ${{ env.START_TIME }}
          end-time: ${{ env.END_TIME }}
          deployment-duration: ${{ env.DEPLOYMENT_DURATION }}
          update-message-ts: ${{ steps.notify-start.outputs.message-ts }}

      - name: Notify deployment failure
        if: failure()
        uses: unepwcmc/devops-actions/.github/actions/slack-notify@v1
        with:
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          slack-channel-id: ${{ secrets.SLACK_CHANNEL_ID }}
          notification-type: failure
          action-type: Deploy
          environment: staging
          repository: ${{ github.repository }}
          repository-url: ${{ github.server_url }}/${{ github.repository }}
          action-run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          actor: ${{ github.actor }}
          actor-url: ${{ github.server_url }}/${{ github.actor }}
          workflow-name: ${{ github.workflow }}
          run-id: ${{ github.run_id }}
          commit-message: ${{ github.event.head_commit.message || 'Manual workflow trigger' }}
          runner-name: ${{ runner.name }}
          start-time: ${{ env.START_TIME }}
          end-time: ${{ env.END_TIME }}
          deployment-duration: ${{ env.DEPLOYMENT_DURATION }}
          update-message-ts: ${{ steps.notify-start.outputs.message-ts }}