copilot_deploy.yml

name: Deploy to AWS
run-name: ${{ github.event_name == 'workflow_dispatch' && format('Deploy to {0}', github.event.inputs.environment) || (github.ref == 'refs/heads/main' && 'Deploy to Test-UAT-Prod' || 'Build & Unit Test') }}

on:
  workflow_dispatch:
    inputs:
      environment:
        description:  Which AWS Account to use
        type: choice
        required: true
        options:
        - dev
        - test
        - uat
        - prod
      run_e2e_tests_assessment:
        required: false
        default: true
        type: boolean
        description: Run assess (node) e2e tests
      run_e2e_tests_application:
        required: false
        default: true
        type: boolean
        description: Run apply (node) e2e tests
      run_e2e_tests_python:
        required: false
        default: true
        type: boolean
        description: Run python e2e tests
  push:

jobs:
  setup:
    uses: communitiesuk/funding-service-design-workflows/.github/workflows/determine-jobs.yml@main
    with:
      environment: ${{ inputs.environment }}

  check_db_migrations:
    name: Check DB migrations
    needs: [setup]
    runs-on: ubuntu-latest
    if: ${{ needs.setup.outputs.jobs_to_run == '[]' }}
    services:
      postgres:
        # Docker Hub image
        image: postgres:16.2@sha256:4aea012537edfad80f98d870a36e6b90b4c09b27be7f4b4759d72db863baeebb
        # Provide the password for postgres
        env:
          POSTGRES_PASSWORD: password  # pragma: allowlist secret
          POSTGRES_DB: pre_award_stores
        # Set health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          # Maps tcp port 5432 on service container to the host
          - 5432:5432
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
    - name: Install the latest version of uv
      uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
      with:
        enable-cache: true
    - name: Check DB is up to date
      env:
        FLASK_ENV: unit_test
      run: uv run --frozen flask db upgrade && uv run --frozen flask db check
    - name: Check that .current-alembic-head is pinned
      env:
        FLASK_ENV: unit_test
      run: |
        uv run --frozen flask db current | grep "$(cat ./db/migrations/.current-alembic-head) (head)"

  unit_tests:
    needs: [setup]
    runs-on: ubuntu-latest
    steps:
      - name: checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - name: Set up Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
        with:
          python-version: 3.10.x
      - name: Install uv
        uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
        with:
          enable-cache: true
      - name: install dependencies
        run: uv sync
      - name: build static assets
        env:
          FLASK_ENV: "development"
        run: uv run python build.py
      - name: run unit tests
        env:
          GOV_NOTIFY_API_KEY: ${{ secrets.GOV_NOTIFY_API_KEY }}
        run: uv run pytest -n 2 .

  type_checking:
    needs: [ setup ]
    runs-on: ubuntu-latest
    steps:
      - name: checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - name: Set up Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5
        with:
          python-version: 3.10.x
      - name: Install uv
        uses: astral-sh/setup-uv@4db96194c378173c656ce18a155ffc14a9fc4355 # v5
        with:
          enable-cache: true
      - name: install dependencies
        run: uv sync
      - name: run type checking
        if: ${{ needs.setup.outputs.jobs_to_run == '[]' }}
        run: uv run mypy

  paketo_build:
    needs: [ setup ]
    permissions:
      packages: write
    uses: communitiesuk/funding-service-design-workflows/.github/workflows/package.yml@main
    with:
      version_to_build: ${{ github.sha }}
      owner: ${{ github.repository_owner }}
      application: funding-service-pre-award
      assets_required: true

  dev_deploy:
    needs: [ setup, unit_tests, type_checking, paketo_build ]
    if: ${{ contains(fromJSON(needs.setup.outputs.jobs_to_run), 'dev') }}
    uses: ./.github/workflows/deploy.yml
    concurrency:
      group: 'fsd-preaward-dev'
      cancel-in-progress: false
    secrets:
      AWS_ACCOUNT: ${{ secrets.AWS_ACCOUNT }}
      FSD_GH_APP_ID: ${{ secrets.FSD_GH_APP_ID }}
      FSD_GH_APP_KEY: ${{ secrets.FSD_GH_APP_KEY }}
      FS_BASIC_AUTH_USERNAME: ${{ secrets.FS_BASIC_AUTH_USERNAME }}
      FS_BASIC_AUTH_PASSWORD: ${{ secrets.FS_BASIC_AUTH_PASSWORD }}
      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
      SLACK_NOTIFICATION_CHANNEL_ID: ${{ secrets.SLACK_NOTIFICATION_CHANNEL_ID }}
      SLACK_DEPLOYMENTS_CHANNEL_ID: ${{ secrets.SLACK_DEPLOYMENTS_CHANNEL_ID }}
    with:
      environment: dev
      image_location: ${{ needs.paketo_build.outputs.image_location }}
      alert_slack_on_failure: false
      notify_slack_on_deployment: false
      run_e2e_tests_assessment: ${{ (github.event_name == 'push' && true) || inputs.run_e2e_tests_assessment }}
      run_e2e_tests_application: ${{ (github.event_name == 'push' && true) || inputs.run_e2e_tests_application }}
      run_e2e_tests_python: ${{ (github.event_name == 'push' && true) || inputs.run_e2e_tests_python }}

  test_deploy:
    needs: [ setup, unit_tests, type_checking, paketo_build ]
    if: ${{ contains(fromJSON(needs.setup.outputs.jobs_to_run), 'test') || contains(fromJSON(needs.setup.outputs.jobs_to_run), 'uat') || contains(fromJSON(needs.setup.outputs.jobs_to_run), 'prod') }}
    uses: ./.github/workflows/deploy.yml
    concurrency:
      group: 'fsd-preaward-test'
      cancel-in-progress: false
    secrets:
      AWS_ACCOUNT: ${{ secrets.AWS_ACCOUNT }}
      FSD_GH_APP_ID: ${{ secrets.FSD_GH_APP_ID }}
      FSD_GH_APP_KEY: ${{ secrets.FSD_GH_APP_KEY }}
      FS_BASIC_AUTH_USERNAME: ${{ secrets.FS_BASIC_AUTH_USERNAME }}
      FS_BASIC_AUTH_PASSWORD: ${{ secrets.FS_BASIC_AUTH_PASSWORD }}
      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
      SLACK_NOTIFICATION_CHANNEL_ID: ${{ secrets.SLACK_NOTIFICATION_CHANNEL_ID }}
      SLACK_DEPLOYMENTS_CHANNEL_ID: ${{ secrets.SLACK_DEPLOYMENTS_CHANNEL_ID }}
    with:
      environment: test
      image_location: ${{ needs.paketo_build.outputs.image_location }}
      alert_slack_on_failure: true
      notify_slack_on_deployment: false
      run_e2e_tests_assessment: ${{ (github.event_name == 'push' && true) || inputs.run_e2e_tests_assessment }}
      run_e2e_tests_application: ${{ (github.event_name == 'push' && true) || inputs.run_e2e_tests_application }}
      run_e2e_tests_python: ${{ (github.event_name == 'push' && true) || inputs.run_e2e_tests_python }}

  uat_deploy:
    needs: [ setup, unit_tests, type_checking, paketo_build, test_deploy ]
    if: ${{ contains(fromJSON(needs.setup.outputs.jobs_to_run), 'uat') || contains(fromJSON(needs.setup.outputs.jobs_to_run), 'prod') }}
    uses: ./.github/workflows/deploy.yml
    concurrency:
      group: 'fsd-preaward-uat'
      cancel-in-progress: false
    secrets:
      AWS_ACCOUNT: ${{ secrets.AWS_ACCOUNT }}
      FSD_GH_APP_ID: ${{ secrets.FSD_GH_APP_ID }}
      FSD_GH_APP_KEY: ${{ secrets.FSD_GH_APP_KEY }}
      FS_BASIC_AUTH_USERNAME: ${{ secrets.FS_BASIC_AUTH_USERNAME }}
      FS_BASIC_AUTH_PASSWORD: ${{ secrets.FS_BASIC_AUTH_PASSWORD }}
      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
      SLACK_NOTIFICATION_CHANNEL_ID: ${{ secrets.SLACK_NOTIFICATION_CHANNEL_ID }}
      SLACK_DEPLOYMENTS_CHANNEL_ID: ${{ secrets.SLACK_DEPLOYMENTS_CHANNEL_ID }}
    with:
      environment: uat
      image_location: ${{ needs.paketo_build.outputs.image_location }}
      alert_slack_on_failure: true
      notify_slack_on_deployment: false
      run_e2e_tests_assessment: ${{ (github.event_name == 'push' && true) || inputs.run_e2e_tests_assessment }}
      run_e2e_tests_application: ${{ (github.event_name == 'push' && true) || inputs.run_e2e_tests_application }}
      run_e2e_tests_python: false  # Never been turned on for UAT yet

  prod_deploy:
    needs: [ setup, unit_tests, type_checking, paketo_build, test_deploy, uat_deploy ]
    if: ${{ contains(fromJSON(needs.setup.outputs.jobs_to_run), 'prod') }}
    uses: ./.github/workflows/deploy.yml
    concurrency:
      group: 'fsd-preaward-prod'
      cancel-in-progress: false
    secrets:
      AWS_ACCOUNT: ${{ secrets.AWS_ACCOUNT }}
      FSD_GH_APP_ID: ${{ secrets.FSD_GH_APP_ID }}
      FSD_GH_APP_KEY: ${{ secrets.FSD_GH_APP_KEY }}
      FS_BASIC_AUTH_USERNAME: ${{ secrets.FS_BASIC_AUTH_USERNAME }}
      FS_BASIC_AUTH_PASSWORD: ${{ secrets.FS_BASIC_AUTH_PASSWORD }}
      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
      SLACK_NOTIFICATION_CHANNEL_ID: ${{ secrets.SLACK_NOTIFICATION_CHANNEL_ID }}
      SLACK_DEPLOYMENTS_CHANNEL_ID: ${{ secrets.SLACK_DEPLOYMENTS_CHANNEL_ID }}
    with:
      environment: prod
      image_location: ${{ needs.paketo_build.outputs.image_location }}
      alert_slack_on_failure: true
      notify_slack_on_deployment: true
      run_e2e_tests_assessment: false
      run_e2e_tests_application: false
      run_e2e_tests_python: false