develop.yml

name: Build & Deploy das-web-react (develop)
on:
  push:
    branches:
      - develop

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  actions: read
  contents: read
  id-token: write

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.node-version'
      - name: Install dependencies
        run: yarn install --immutable
      - name: Run tests
        run: yarn test-ci

  config:
    runs-on: ubuntu-latest
    outputs:
      build-args: ${{ steps.env-vars.outputs.build-args }}
      image-tag: ${{ steps.tag.outputs.value }}
    steps:
      - uses: actions/checkout@v7
      - name: Setup Node
        uses: actions/setup-node@v6
        with:
          node-version-file: '.node-version'
      - run: |
          npm pkg set "buildbranch"="${{ github.ref_name }}"
          npm pkg set "buildnum"="${{ github.run_number }}"

      - name: Select env file for build
        id: env-vars
        run: echo "build-args=ENV_FILE=.env.development" >> $GITHUB_OUTPUT

      - name: Generate image tag
        id: tag
        run: |
          SHORT_SHA="${GITHUB_SHA:0:7}"
          BRANCH_SAFE=$(echo "${GITHUB_REF_NAME}" | tr '/' '-' | tr '[:upper:]' '[:lower:]')
          echo "value=${BRANCH_SAFE}-${SHORT_SHA}" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@v7
        with:
          name: npm-config
          path: package.json

  build:
    needs: config
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/download-artifact@v8
        with:
          name: npm-config
          path: .

      - name: GCP Auth
        id: auth
        uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ vars.WORKLOAD_IDENTITY_PROVIDER }}

      - name: Configure Docker
        run: gcloud auth configure-docker europe-west3-docker.pkg.dev

      - uses: docker/setup-buildx-action@v4
        with:
          driver-opts: |
            image=europe-west3-docker.pkg.dev/serca-artifact-registry/virtual-docker/moby/buildkit:buildx-stable-1

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: |
            europe-west3-docker.pkg.dev/serca-artifact-registry/earthranger/das-web-react
          tags: |
            type=raw,value=${{ needs.config.outputs.image-tag }}

      # Artifact Registry has tag immutability enabled: re-pushing an existing
      # {branch}-{sha} tag fails. The tag is keyed on the commit SHA, so an
      # existing image is the same source; skip the rebuild and let the deploy
      # jobs reuse it.
      - name: Check if image already exists
        id: image-check
        run: |
          IMAGE="europe-west3-docker.pkg.dev/serca-artifact-registry/earthranger/das-web-react:${{ needs.config.outputs.image-tag }}"
          if gcloud artifacts docker images describe "${IMAGE}" --quiet; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "Image does not exist yet; proceeding with build."
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Read node version
        id: node-ver
        run: echo "value=$(cat .node-version)" >> $GITHUB_OUTPUT

      - name: Build and push
        if: steps.image-check.outputs.exists != 'true'
        uses: docker/build-push-action@v7
        with:
          push: true
          context: .
          file: Dockerfile.mt
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            ${{ needs.config.outputs.build-args }}
            NODE_VERSION=${{ steps.node-ver.outputs.value }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy-dev:
    needs: [config, build, test]
    uses: ./.github/workflows/_update-argo.yml
    with:
      app-name: das-web-react
      app-subdir: earthranger
      environment: er-dev
      image-tag: ${{ needs.config.outputs.image-tag }}
    secrets:
      ARGOCD_APPS_SSH_KEY: ${{ secrets.ARGOCD_APPS_SSH_KEY }}

  sync-dev:
    needs: [config, deploy-dev]
    uses: ./.github/workflows/_sync-argo.yml
    with:
      app-name: das-web-react-er-dev
    secrets:
      ARGOCD_AUTH_TOKEN: ${{ secrets.ARGOCD_AUTH_TOKEN }}

  # Tells the ER Core team in Slack when mainline `develop` breaks (DASOPS-2238).
  #
  # `needs` lists every job in this workflow. It cannot move into the reusable
  # workflow: the gate below reads *this* workflow's `needs.*.result`, so a job
  # added here and left out of the list contributes nothing to the trigger, and
  # if it is the only failure no alert fires at all.
  #
  # The condition is deliberately not `failure()`. A run that gets superseded and
  # cancelled mid-flight is not a broken build, and `!cancelled()` is what keeps
  # those quiet. `contains(needs.*.result, 'failure')` then fires on a real
  # failure even when some other job was skipped.
  notify-failure:
    needs: [test, config, build, deploy-dev, sync-dev]
    if: ${{ !cancelled() && contains(needs.*.result, 'failure') }}
    # Local copy, not the shared serca-pipelines one: this repo is public and
    # that repo is internal, so the cross-repo call is a startup failure. See the
    # header of _slack-notify-failure.yml for the evidence.
    #
    # The workflow reads this run's jobs API. A called workflow's permissions
    # must be a subset of the caller's, so granting it here keeps this working if
    # the workflow is ever hardened with a top-level block.
    permissions:
      actions: read
    uses: ./.github/workflows/_slack-notify-failure.yml
    with:
      title: "das-web-react develop build failed"
    secrets:
      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}