deploy-dev.yml

name: Deploy Dev

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Base version e.g. 1.20.0  (rcN suffix is appended automatically)"
        required: true
        type: string
      reason:
        description: "Why this DEV deploy is being run (optional)"
        required: false
        type: string
        default: ""

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: wrangleworks/wrangles

jobs:
  # ── 1. Validate input, compute the next rcN version ──────────────────────
  compute-version:
    name: Compute RC Version
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # required for OIDC to query CodeArtifact
    outputs:
      rc_version: ${{ steps.compute.outputs.rc_version }}
    steps:
      - name: Validate deployment app configuration
        env:
          DEPLOY_APP_CLIENT_ID: ${{ vars.DEPLOY_APP_CLIENT_ID }}
          DEPLOY_APP_PRIVATE_KEY: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
        run: |
          MISSING=()
          [[ -z "$DEPLOY_APP_CLIENT_ID" ]] && MISSING+=(DEPLOY_APP_CLIENT_ID)
          [[ -z "$DEPLOY_APP_PRIVATE_KEY" ]] && MISSING+=(DEPLOY_APP_PRIVATE_KEY)
          if [[ ${#MISSING[@]} -gt 0 ]]; then
            echo "::error::Deployment app configuration is missing: ${MISSING[*]}. See docs/github-app-deployment.md."
            exit 1
          fi

      # Validate the installation and permissions before running tests or
      # publishing. These tokens are revoked when this job finishes; each
      # later job creates a fresh token immediately before it needs one.
      - name: Verify schema repository app access
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ vars.DEPLOY_APP_CLIENT_ID }}
          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
          owner: wrangleworks
          repositories: wrangleworks.github.io
          permission-contents: write

      - name: Verify Lambda workflow app access
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ vars.DEPLOY_APP_CLIENT_ID }}
          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
          owner: wrangleworks
          repositories: Lambda-Recipes
          permission-actions: write

      - name: Validate version input format
        run: |
          if ! echo "${{ inputs.version }}" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::Version input '${{ inputs.version }}' is invalid. Expected format: MAJOR.MINOR.PATCH (e.g. 1.20.0)"
            exit 1
          fi

      - name: Validate required GitHub Variables
        env:
          AWS_PUBLISH_ROLE_ARN: ${{ vars.AWS_PUBLISH_ROLE_ARN }}
          AWS_REGION: ${{ vars.AWS_REGION }}
          CODEARTIFACT_DOMAIN: ${{ vars.CODEARTIFACT_DOMAIN }}
          CODEARTIFACT_DOMAIN_OWNER: ${{ vars.CODEARTIFACT_DOMAIN_OWNER }}
          CODEARTIFACT_REPOSITORY: ${{ vars.CODEARTIFACT_REPOSITORY }}
        run: |
          MISSING=()
          [[ -z "$AWS_PUBLISH_ROLE_ARN"      ]] && MISSING+=(AWS_PUBLISH_ROLE_ARN)
          [[ -z "$AWS_REGION"                ]] && MISSING+=(AWS_REGION)
          [[ -z "$CODEARTIFACT_DOMAIN"       ]] && MISSING+=(CODEARTIFACT_DOMAIN)
          [[ -z "$CODEARTIFACT_DOMAIN_OWNER" ]] && MISSING+=(CODEARTIFACT_DOMAIN_OWNER)
          [[ -z "$CODEARTIFACT_REPOSITORY"   ]] && MISSING+=(CODEARTIFACT_REPOSITORY)
          if [[ ${#MISSING[@]} -gt 0 ]]; then
            echo "::error::The following GitHub Actions Variables are not set: ${MISSING[*]}"
            exit 1
          fi

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ vars.AWS_PUBLISH_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Compute next RC version from CodeArtifact
        id: compute
        env:
          BASE: ${{ inputs.version }}
          CODEARTIFACT_DOMAIN: ${{ vars.CODEARTIFACT_DOMAIN }}
          CODEARTIFACT_DOMAIN_OWNER: ${{ vars.CODEARTIFACT_DOMAIN_OWNER }}
          CODEARTIFACT_REPOSITORY: ${{ vars.CODEARTIFACT_REPOSITORY }}
        run: |
          # Existing RC versions live in CodeArtifact (RCs are no longer published to PyPI).
          # ResourceNotFoundException means the package has never been published -> treat as rc1.
          # Any other error (auth, permissions, config) is a hard failure.
          CA_STDERR=$(mktemp)
          EXISTING_VERSIONS=$(aws codeartifact list-package-versions \
            --domain "$CODEARTIFACT_DOMAIN" \
            --domain-owner "$CODEARTIFACT_DOMAIN_OWNER" \
            --repository "$CODEARTIFACT_REPOSITORY" \
            --format pypi --package wrangles \
            --query 'versions[].version' --output text 2>"$CA_STDERR") || {
            if grep -q "ResourceNotFoundException" "$CA_STDERR"; then
              echo "Package not yet in CodeArtifact – will start at rc1."
              EXISTING_VERSIONS=""
            else
              echo "::error::CodeArtifact query failed:"
              cat "$CA_STDERR" >&2
              exit 1
            fi
          }
          rm -f "$CA_STDERR"

          RC_VERSION=$(BASE="$BASE" EXISTING_VERSIONS="$EXISTING_VERSIONS" python3 - <<'PYEOF'
          import os, re
          base = os.environ["BASE"]
          versions = os.environ.get("EXISTING_VERSIONS", "").split()
          pat = re.compile(rf"^{re.escape(base)}rc(\d+)$")
          nums = [int(m.group(1)) for v in versions if (m := pat.match(v))]
          print(f"{base}rc{max(nums) + 1 if nums else 1}")
          PYEOF
          )
          echo "rc_version=${RC_VERSION}" >> "$GITHUB_OUTPUT"
          echo "Resolved RC version: ${RC_VERSION}"

  # ── 2. Pip-install smoke test ─────────────────────────────────────────────
  test-pip-install:
    name: smoke test
    runs-on: ubuntu-latest
    needs: [compute-version]
    permissions:
      contents: read
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"

      - name: Test pip install
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-full.txt
          pip install .
          wrangles.recipe tests/samples/generate-data.wrgl.yml

  # ── 3. Generate and test schema ──────────────────────────────────────────
  test-generate-schema:
    name: Generate and Test Schema
    runs-on: ubuntu-latest
    needs: [compute-version]
    permissions:
      contents: read
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.13'

      - name: Install Dependencies
        run: |
          pip install -r requirements-full.txt
          pip install jsonschema

      - name: Generate and Test Schema
        run: cd schema && python generate_recipe_schema.py

      - name: Save schema as schema_dev.json
        run: cp schema/schema.json schema/schema_dev.json

      - name: Create schema publishing token
        id: schema-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ vars.DEPLOY_APP_CLIENT_ID }}
          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
          owner: wrangleworks
          repositories: wrangleworks.github.io
          permission-contents: write

      - name: Checkout wrangleworks.github.io
        uses: actions/checkout@v5
        with:
          repository: wrangleworks/wrangleworks.github.io
          token: ${{ steps.schema-token.outputs.token }}
          path: wrangleworks.github.io

      - name: Copy schema_dev.json to wrangleworks.github.io
        run: cp schema/schema_dev.json wrangleworks.github.io/schema/recipes/schema_dev.json

      - name: Commit and push schema_dev.json
        working-directory: wrangleworks.github.io
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add schema/recipes/schema_dev.json
          if git diff --cached --quiet; then
            echo "No changes to schema_dev.json, skipping commit."
          else
            git commit -m "Update dev recipe schema"
            git push
          fi

      - name: Save Schema as Artifact
        uses: actions/upload-artifact@v6
        with:
          name: schema
          path: schema/schema_dev.json

  # ── 4. Publish Python package to CodeArtifact ────────────────────────────
  publish-codeartifact:
    name: Publish RC Package
    runs-on: ubuntu-latest
    needs: [compute-version, test-pip-install, test-generate-schema]
    permissions:
      contents: read
      id-token: write   # required for OIDC AssumeRoleWithWebIdentity
    env:
      RC_VERSION: ${{ needs.compute-version.outputs.rc_version }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v5

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"

      - name: Patch version in setup.py
        run: |
          sed -i "s/^\(\s*version\s*=\s*\).*/\1'${RC_VERSION}',/" setup.py
          echo "setup.py version line after patch:"
          grep "version" setup.py

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ vars.AWS_PUBLISH_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Install build tooling
        run: python -m pip install build twine --user

      - name: Build sdist and wheel
        run: python -m build --sdist --wheel --outdir dist/ .

      - name: Log in to CodeArtifact (twine)
        run: |
          aws codeartifact login --tool twine \
            --domain ${{ vars.CODEARTIFACT_DOMAIN }} \
            --domain-owner ${{ vars.CODEARTIFACT_DOMAIN_OWNER }} \
            --repository ${{ vars.CODEARTIFACT_REPOSITORY }}

      - name: Publish to CodeArtifact
        run: twine upload --repository codeartifact dist/*

  # ── 5. Trigger DEV deployment in Lambda-Recipes ───────────────────────────
  # The deployment app issues a short-lived token limited to Lambda-Recipes
  # workflow access. Installation and configuration: docs/github-app-deployment.md.
  trigger-deploy-dev:
    name: Trigger DEV Deploy
    runs-on: ubuntu-latest
    needs: [compute-version, publish-codeartifact]
    steps:
      - name: Record deploy attribution
        run: |
          {
            echo "## DEV deploy attribution"
            echo ""
            echo "| Field | Value |"
            echo "|-------|-------|"
            echo "| **deploy_user** | \`${{ github.actor }}\` |"
            echo "| **reason** | \`${{ inputs.reason }}\` |"
            echo "| **wrangles_version** | \`${{ needs.compute-version.outputs.rc_version }}\` |"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Build Lambda-Recipes dispatch payload
        id: dispatch
        env:
          WRANGLES_VERSION: ${{ needs.compute-version.outputs.rc_version }}
          DEPLOY_USER: ${{ github.actor }}
          REASON: ${{ inputs.reason }}
        run: |
          if [ -z "$DEPLOY_USER" ]; then
            echo "::error::deploy_user is empty"
            exit 1
          fi
          payload=$(jq -nc \
            --arg wrangles_version "$WRANGLES_VERSION" \
            --arg deploy_user "$DEPLOY_USER" \
            --arg reason "$REASON" \
            '{wrangles_version: $wrangles_version, deploy_user: $deploy_user, reason: $reason}')
          echo "payload=$payload" >> "$GITHUB_OUTPUT"

      - name: Create Lambda deployment token
        id: deploy-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
        with:
          client-id: ${{ vars.DEPLOY_APP_CLIENT_ID }}
          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
          owner: wrangleworks
          repositories: Lambda-Recipes
          permission-actions: write

      - name: Deploy Dev
        uses: convictional/trigger-workflow-and-wait@f69fa9eedd3c62a599220f4d5745230e237904be # v1.6.5
        with:
          owner: wrangleworks
          repo: Lambda-Recipes
          workflow_file_name: deploy-dev.yml
          github_token: ${{ steps.deploy-token.outputs.token }}
          ref: main
          wait_interval: 15
          client_payload: ${{ steps.dispatch.outputs.payload }}
          propagate_failure: true
          trigger_workflow: true
          wait_workflow: true