branch-to-staging.yml

name: Branch to Staging

# Used to manually deploy a branch to staging

on:
  workflow_dispatch: # manually executed by a user

jobs:
  api:
    uses: ./.github/workflows/_deploy-api.yml
    with:
      deploy_env: "staging"
      ECR_REPO_URI: ${{ vars.ECR_REPO_URI_STAGING }}
      ECS_CLUSTER: ${{ vars.ECS_CLUSTER_STAGING }}
      ECS_SERVICE: ${{ vars.ECS_SERVICE_STAGING }}
      AWS_REGION: ${{ vars.API_REGION_STAGING }}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

  infra-api-lambdas:
    uses: ./.github/workflows/_deploy-cdk.yml
    with:
      deploy_env: "staging"
      is-branch-to-staging: true
      secrets_cdk_stack: ${{ vars.SECRET_STACK_NAME_STAGING }}
      location_services_cdk_stack: ${{ vars.LOCATION_SERVICES_STACK_NAME_STAGING }}
      cdk_stack: ${{ vars.API_STACK_NAME_STAGING }}
      ihe_stack: ${{ vars.IHE_STACK_NAME }}
      AWS_REGION: ${{ vars.API_REGION_STAGING }}
    secrets:
      SERVICE_PAT: ${{ secrets.SERVICE_PAT }}
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

  redeploy-api-gw:
    uses: ./.github/workflows/_redeploy_api-gw.yml
    needs: [infra-api-lambdas]
    with:
      deploy_env: "staging"
      AWS_REGION: ${{ vars.API_REGION_STAGING }}
      API_GW_ID: ${{ vars.API_GW_ID_STAGING }}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

  e2e-tests:
    uses: ./.github/workflows/_e2e-tests.yml
    needs: [api, infra-api-lambdas, redeploy-api-gw]
    # run even if one of the dependencies didn't
    # can't use ${{ ! failure() && success() }} because `success()` "Returns true when none of the previous steps have failed or been canceled."
    # can't use ${{ ! failure() && contains(needs.*.result, 'success') }} because if anything that came before succeeded, even if not a direct dependency, it will run
    if: ${{ !failure() && (needs.api.result == 'success' || needs.infra-api-lambdas.result == 'success' || needs.redeploy-api-gw.result == 'success') }}
    with:
      deploy_env: "staging"
      api_url: ${{ vars.API_URL_STAGING }}
      fhir_url: ${{ vars.FHIR_SERVER_URL_STAGING }}
      test_patient_id: ${{ vars.TEST_PATIENT_ID }}
    secrets:
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      TEST_API_KEY: ${{ secrets.TEST_API_KEY_STAGING }}
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
      NGROK_AUTHTOKEN: ${{ secrets.NGROK_AUTHTOKEN }}
      CW_CERTIFICATE: ${{ secrets.CW_CERTIFICATE_STAGING }}
      CW_PRIVATE_KEY: ${{ secrets.CW_PRIVATE_KEY_STAGING }}
      CW_MEMBER_CERTIFICATE: ${{ secrets.CW_MEMBER_CERTIFICATE_STAGING }}
      CW_MEMBER_PRIVATE_KEY: ${{ secrets.CW_MEMBER_PRIVATE_KEY_STAGING }}
      CW_MEMBER_NAME: ${{ secrets.CW_MEMBER_NAME_STAGING }}
      CW_MEMBER_OID: ${{ secrets.CW_MEMBER_OID_STAGING }}