deploy.yml

---
name: Deploy

env:
    IMAGE_NAME: opencodelists
    HOST: dokku3.ebmdatalab.net
    PUBLIC_IMAGE_NAME: ghcr.io/opensafely-core/opencodelists
    REGISTRY: ghcr.io
    SSH_AUTH_SOCK: /tmp/agent.sock

on:
  push:
    branches: [main]

concurrency: deploy-production

jobs:
  test-and-build-docker-image:
    uses: ./.github/workflows/main.yml

  deploy:
    needs: [test-and-build-docker-image]

    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    if: github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - uses: opensafely-core/setup-action@v1
        with:
          install-just: true

      - name: Download docker image
        uses: actions/download-artifact@v8
        with:
          name: opencodelists-image
          path: /tmp/image

      - name: Import docker image
        run: docker image load --input /tmp/image/opencodelists.tar.zst

      - name: Test image we imported from previous job works
        run: |
            SKIP_BUILD=1 just docker-serve prod -d
            sleep 5
            just docker-smoke-test || {
              echo "Smoke test failed, attempting to show logs for all containers:"
              for c in $(docker ps -a --format '{{.Names}}'); do
                echo "Logs for $c:";
                docker logs "$c" || true;
              done
              exit 1
            }

      - name: Publish docker image
        run: |
            echo ${{ secrets.GITHUB_TOKEN }} | docker login $REGISTRY -u ${{ github.actor }} --password-stdin
            docker tag $IMAGE_NAME $PUBLIC_IMAGE_NAME:latest
            docker push $PUBLIC_IMAGE_NAME:latest

      - name: Create Sentry release
        uses: getsentry/action-release@dab6548b3c03c4717878099e43782cf5be654289  # v3.5.0
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_RELEASE_INTEGRATION_TOKEN }}
          SENTRY_ORG: ebm-datalab
          SENTRY_PROJECT: opencodelists
        with:
          environment: production
          ignore_empty: true
          finalize: false

      - name: Setup SSH Agent
        run: |
            ssh-agent -a $SSH_AUTH_SOCK > /dev/null
            ssh-add - <<< "${{ secrets.DOKKU3_DEPLOY_SSH_KEY }}"

      - name: Deploy
        run: |
            set -euo pipefail

            # Find the full qualified "repo digest" for this image
            IMAGE_DIGEST="$(
              docker inspect --format='{{join .RepoDigests "\n"}}' "$PUBLIC_IMAGE_NAME:latest" \
                | grep --fixed-strings "$PUBLIC_IMAGE_NAME" || true
            )"
            # Fail if we have none or more than one (as indicated by the presence of whitespace)
            if [[ -z "$IMAGE_DIGEST" || "$IMAGE_DIGEST" =~ [[:space:]] ]]; then
              echo "Expected exactly one value in IMAGE_DIGEST, got: $IMAGE_DIGEST"
              echo
              echo "Debug info:"
              set -x
              docker inspect --format='{{join .RepoDigests "\n"}}' "$PUBLIC_IMAGE_NAME:latest"
              exit 1
            fi
            echo "Deploying $IMAGE_DIGEST to $HOST"
            ssh -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" "dokku@$HOST" \
              git:from-image opencodelists "$IMAGE_DIGEST"

      - name: Create Sentry release
        uses: getsentry/action-release@dab6548b3c03c4717878099e43782cf5be654289  # v3.5.0
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_RELEASE_INTEGRATION_TOKEN }}
          SENTRY_ORG: ebm-datalab
          SENTRY_PROJECT: opencodelists
        with:
          environment: production
          ignore_empty: true
          finalize: true