build-and-deploy.yml

name: Build and Deploy
concurrency: build_and_deploy_${{ github.ref_name }}

on:
  push:
   branches:
    - main
  pull_request:
    types: [opened, reopened, synchronize, labeled]

permissions:
  contents: write
  deployments: write
  packages: write
  pull-requests: write

jobs:
  build:
    name: Build
    env:
      DOCKER_IMAGE: ghcr.io/dfe-digital/register-trainee-teachers
      DB_USERNAME: postgres
      DB_PASSWORD: postgres
      DB_HOSTNAME: localhost
    outputs:
      docker-image: ${{ env.DOCKER_IMAGE }}
      image-tag: ${{ env.IMAGE_TAG }}
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build
        uses: ./.github/actions/build/
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
          azure-credentials: ${{ secrets.AZURE_CREDENTIALS_REVIEW }}

  lint:
    name: Lint
    needs: [build]
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        linter-type: [rubocop, scss, dfe_analytics, javascript_lint_and_test]
        include:
          - linter-type: rubocop
            command: docker compose exec -T web /bin/sh -c 'bundle exec rubocop app config db lib spec Gemfile --format clang'
          - linter-type: scss
            command: |
              docker compose exec -T web /bin/sh -c "yarn add stylelint@15.11.0"
              docker compose exec -T web /bin/sh -c "yarn add stylelint-scss@5.3.1"
              docker compose exec -T web /bin/sh -c "yarn add stylelint-config-gds@1.1.0"
              docker compose exec -T web /bin/sh -c "yarn run scss:lint"
          - linter-type: dfe_analytics
            command: |
              docker compose exec -T web /bin/sh -c "bundle exec rails db:setup"
              docker compose exec -T web /bin/sh -c 'bundle exec rake dfe:analytics:check'
          - linter-type: javascript_lint_and_test
            command: |
              docker compose exec -T web /bin/sh -c "yarn add jest@29.3.1"
              docker compose exec -T web /bin/sh -c "yarn run standard $(git ls-files '**.js' | tr '\n' ' ')"
              docker compose exec -T web /bin/sh -c 'yarn run test'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: ${{ matrix.linter-type }}
        uses: ./.github/actions/lint/
        with:
          linter-type: ${{ matrix.linter-type }}
          command: ${{ matrix.command }}
          docker-image: ${{ needs.build.outputs.docker-image }}
          image-tag: ${{ needs.build.outputs.image-tag }}
          slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
          azure-credentials: ${{ secrets.AZURE_CREDENTIALS_REVIEW }}

  test:
    name: Test
    needs: [build]
    uses: ./.github/workflows/tests.yml
    secrets: inherit
    with:
      docker-image: ${{needs.build.outputs.docker-image}}
      image-tag: ${{ needs.build.outputs.image-tag }}
      use-next-academic-year: false

  next_academic_year_test:
    name: Next academic year tests
    needs: [build]
    uses: ./.github/workflows/tests.yml
    secrets: inherit
    with:
      docker-image: ${{needs.build.outputs.docker-image}}
      image-tag: ${{ needs.build.outputs.image-tag }}
      use-next-academic-year: true

  deploy-review-app:
    name: Deployment To Review
    concurrency: deploy_review_${{ github.event.pull_request.number }}
    if: ${{ github.event_name == 'pull_request' && (contains(github.event.pull_request.labels.*.name, 'deploy') || contains(github.event.pull_request.labels.*.name, 'dependencies')) }}
    needs: [build]
    runs-on: ubuntu-latest
    steps:
      - name: Start review-${{ github.event.pull_request.number }} Deployment
        uses: bobheadxi/deployments@v1
        id: deployment
        with:
          env: review-${{ github.event.pull_request.number }}
          ref: ${{ github.head_ref }}
          step:  start
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Checkout
        uses: actions/checkout@v4

      - name: Deploy App to Review
        id: deploy_review
        uses: ./.github/actions/deploy/
        with:
          azure-credentials:  ${{ secrets.AZURE_CREDENTIALS_REVIEW }}
          environment: review
          pr-number: ${{ github.event.pull_request.number }}
          sha: ${{ needs.build.outputs.image-tag }}
          slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

      - name: Update review-${{ github.event.pull_request.number }} status
        if: always()
        uses: bobheadxi/deployments@v1
        with:
          env:  review-${{ github.event.pull_request.number }}
          ref: ${{ github.head_ref }}
          step: finish
          token:  ${{ secrets.GITHUB_TOKEN }}
          status: ${{ job.status }}
          deployment_id: ${{ steps.deployment.outputs.deployment_id }}
          env_url: ${{ steps.deploy_review.outputs.deploy-url }}
          smoke-test-username: ${{ secrets.SMOKE_TEST_USERNAME }}
          smoke-test-password: ${{ secrets.SMOKE_TEST_PASSWORD }}
          basic-auth-username: ${{ secrets.BASIC_AUTH_USERNAME }}
          basic-auth-password: ${{ secrets.BASIC_AUTH_PASSWORD }}

  merge-dependabot:
    name: Merge dependabot
    if: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'dependencies') }}
    needs: [lint, test, next_academic_year_test, deploy-review-app]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Merge minor dependency updates
        uses: fastify/github-action-merge-dependabot@v3
        with:
          github-token: ${{ secrets.API_TOKEN_FOR_GITHUB_ACTION }}
          target: minor
          exclude: 'govuk-components,govuk_design_system_formbuilder,govuk-frontend,@ministryofjustice/frontend,dfe-analytics'
          merge-method: squash

  deploy-before-production:
    name: Parallel deployment before production
    environment:
      name: ${{ matrix.environment }}
      url: ${{ steps.deploy_app_before_production.outputs.deploy-url }}
    if: ${{ success() && github.ref == 'refs/heads/main' }}
    needs: [test, next_academic_year_test]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        environment: [qa, staging]
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Deploy app to ${{ matrix.environment }}
      id: deploy_app_before_production
      uses: ./.github/actions/deploy/
      with:
        azure-credentials: ${{ secrets[format('AZURE_CREDENTIALS_{0}', matrix.environment)] }}
        environment: ${{ matrix.environment }}
        sha: ${{ github.sha }}
        slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
        smoke-test-username: ${{ secrets.SMOKE_TEST_USERNAME }}
        smoke-test-password: ${{ secrets.SMOKE_TEST_PASSWORD }}
        basic-auth-username: ${{ secrets.BASIC_AUTH_USERNAME }}
        basic-auth-password: ${{ secrets.BASIC_AUTH_PASSWORD }}

  deploy-production:
    name: Production deployment
    environment:
      name: production
      url: ${{ steps.deploy_app.outputs.deploy-url }}
    if: ${{ success() && github.ref == 'refs/heads/main' }}
    needs: [deploy-before-production]
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Deploy app to production
      id: deploy_app
      uses: ./.github/actions/deploy/
      with:
        azure-credentials: ${{ secrets.AZURE_CREDENTIALS_PRODUCTION }}
        environment: production
        sha: ${{ github.sha }}
        slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
        smoke-test-username: ${{ secrets.SMOKE_TEST_USERNAME }}
        smoke-test-password: ${{ secrets.SMOKE_TEST_PASSWORD }}
        basic-auth-username: ${{ secrets.BASIC_AUTH_USERNAME }}
        basic-auth-password: ${{ secrets.BASIC_AUTH_PASSWORD }}

  deploy-after-production:
    name: Parallel deployment after production
    environment:
      name: ${{ matrix.environment }}
      url: ${{ steps.deploy_app_after_production.outputs.deploy-url }}
    if: ${{ success() && github.ref == 'refs/heads/main' }}
    needs: [deploy-production]
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        environment: [sandbox, productiondata]
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Deploy app to ${{ matrix.environment }}
      id: deploy_app_after_production
      uses: ./.github/actions/deploy/
      with:
        azure-credentials: ${{ secrets[format('AZURE_CREDENTIALS_{0}', matrix.environment)] }}
        environment: ${{ matrix.environment }}
        sha: ${{ github.sha }}
        slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
        smoke-test-username: ${{ secrets.SMOKE_TEST_USERNAME }}
        smoke-test-password: ${{ secrets.SMOKE_TEST_PASSWORD }}
        basic-auth-username: ${{ secrets.BASIC_AUTH_USERNAME }}
        basic-auth-password: ${{ secrets.BASIC_AUTH_PASSWORD }}