deploy-dev.yml

name: Deploy image to the dev environment
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
      ECR_REGION:
        required: true
        type: string
      ECR_REPOSITORY:
        required: true
        type: string
    secrets:
      ECR_ROLE_TO_ASSUME:
        required: true
      KUBE_CERT:
        required: true
      KUBE_CLUSTER:
        required: true
      KUBE_NAMESPACE:
        required: true
      KUBE_TOKEN:
        required: true


jobs:
  deploy:
    name: Deploy
    environment: ${{ inputs.environment }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write # This is required for requesting the JWT
      contents: read  # This is required for actions/checkout
    steps:
      - name: Checkout GitHub repository
        uses: actions/checkout@v4

      - name: Authenticate to the cluster
        env:
          KUBE_NAMESPACE: ${{ secrets.KUBE_NAMESPACE }}
          KUBE_CLUSTER: ${{ secrets.KUBE_CLUSTER }}
        run: |
          echo "${{ secrets.KUBE_CERT }}" > ca.crt
          kubectl config set-cluster ${KUBE_CLUSTER} --certificate-authority=./ca.crt --server=https://${KUBE_CLUSTER}
          kubectl config set-credentials deploy-user --token=${{ secrets.KUBE_TOKEN }}
          kubectl config set-context ${KUBE_CLUSTER} --cluster=${KUBE_CLUSTER} --user=deploy-user --namespace=${KUBE_NAMESPACE}
          kubectl config use-context ${KUBE_CLUSTER}

      - name: Assume role in Cloud Platform
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.ECR_ROLE_TO_ASSUME }}
          aws-region: ${{ inputs.ECR_REGION }}

      - name: Login to container registry
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Upgrade the Helm chart
        env:
          IMAGE_TAG: ${{ github.sha }}
          REPOSITORY: ${{ inputs.ECR_REPOSITORY }}
          REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          HELM_DIR: "helm_deploy/laa-access-civil-legal-aid"
          DEV_HOST: "access-cla.cloud-platform.service.justice.gov.uk"
          # head_ref is set if the workflow was triggered by a PR, ref_name is used if the workflow was trigged by a push.
          BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
        run: |
          export CLEANED_BRANCH_NAME=$(echo ${BRANCH_NAME} | sed 's/^feature[-/]//' | sed 's:^\w*\/::' | tr -s ' _/[]().' '-' | tr '[:upper:]' '[:lower:]' | cut -c1-28 | sed 's/-$//')
          export HOST_NAME=${CLEANED_BRANCH_NAME}-${DEV_HOST}

          helm upgrade ${CLEANED_BRANCH_NAME} \
          ${HELM_DIR} \
          --namespace=${{ secrets.KUBE_NAMESPACE }} \
          --values ${HELM_DIR}/values/values-${{ inputs.environment }}.yaml \
          --set image.repository=${REGISTRY}/${REPOSITORY} \
          --set image.tag=${IMAGE_TAG} \
          --set fullnameOverride=${CLEANED_BRANCH_NAME} \
          --set ingress.hosts[0].host=${HOST_NAME} \
          --set ingress.tls[0].hosts[0]=${HOST_NAME} \
          --force \
          --install