build-deploy.yaml

name: Build and Deploy

on:
  workflow_call:
    secrets:
      TMD_APP_ID: {}
      TMD_APP_INSTALLATION_ID: {}
      TMD_APP_PRIVATE_KEY: {}
      TMD_WEBHOOK_SECRET: {}
      TMP_APP_ID: {}
      TMP_APP_INSTALLATION_ID: {}
      TMP_APP_PRIVATE_KEY: {}
      TMP_WEBHOOK_SECRET: {}
      OPENAI_APIKEY: {}
      OPENAI_ORGANIZATION: {}
    inputs:
      webPath:
        description: "Path to the Blazor WebAssembly project"
        required: false
        type: string
      spaSites:
        description: "JSON array of JavaScript SPAs to build (npm ci + npm run build). Supports optional per-SPA env vars with dev/prod values. e.g. [{\"name\":\"docs\",\"path\":\"apps/docs\",\"env\":{\"NEXT_PUBLIC_SITE_URL\":{\"dev\":\"https://dev.example.com\",\"prod\":\"https://www.example.com\"}}}]"
        required: false
        type: string
        default: '[]'
      solution:
        description: "Solution file name"
        required: false
        type: string
      buildPlatform:
        description: "Build platform"
        required: false
        default: "Any CPU"
        type: string
      buildConfiguration:
        description: "Build configuration"
        required: false
        default: "release"
        type: string
      dotnetVersion:
        description: ".NET SDK version"
        required: false
        default: "9.0.x"
        type: string
      lambdaRuntimeVersion:
        description: "AWS Lambda runtime version"
        required: false
        default: "net9.0"
        type: string
      nodeVersion:
        description: "Node version"
        required: false
        default: "18.x"
        type: string
      packageManager:
        description: "Package manager to use for Node.js projects (npm or pnpm)"
        required: false
        default: "npm"
        type: string
      pnpmVersion:
        description: "pnpm version to install (only used when packageManager is pnpm)"
        required: false
        default: "10"
        type: string
      outputPath:
        description: "Output directory for builds"
        required: false
        default: "publish"
        type: string
      hasTests: # ✅ New input to control test execution
        description: "Determines if tests should be run"
        required: false
        default: false
        type: boolean
      runCdk:  # ✅ New input to control CDK execution
        description: "Determines if AWS CDK steps should be run"
        required: false
        default: true
        type: boolean
      stackName:
        description: "Name of the AWS CDK stack"
        required: false
        type: string
      functions:
        description: "JSON array of Lambda functions to build"
        required: false
        type: string
        default: '[]'  # e.g. [{"path": "src/Foo", "name": "foo-func"}, {"path": "src/Bar", "name": "bar-func"}]
      integrationTestSolution:
        description: "Solution file for integration tests to run after CDK deploy. When multiple solution files exist at the root, provide the integration test solution here."
        required: false
        type: string

permissions:
  id-token: write
  contents: write
  
jobs:
  deploy:
    if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    env:
      outputPath: ${{ github.workspace }}/${{ inputs.outputPath }}

    steps:
      - name: Set Default Output Path If Not Provided
        run: |
          if [ -z "${{ inputs.outputPath }}" ]; then
            echo "outputPath=${{ github.workspace }}/publish" >> $GITHUB_ENV
          else
            echo "outputPath=${{ github.workspace}}/${{ inputs.outputPath }}" >> $GITHUB_ENV
          fi

      - name: Compute Build Flags
        run: |
          needs_dotnet=false
          if [ -n "${{ inputs.solution }}" ] || [ -n "${{ inputs.webPath }}" ] || [ "${{ inputs.hasTests }}" = "true" ] || [ '${{ inputs.functions }}' != '[]' ] || [ -n "${{ inputs.integrationTestSolution }}" ]; then
            needs_dotnet=true
          fi

          needs_node=false
          if [ "${{ inputs.runCdk }}" = "true" ] || [ '${{ inputs.spaSites }}' != '[]' ]; then
            needs_node=true
          fi

          echo "NEEDS_DOTNET=$needs_dotnet" >> $GITHUB_ENV
          echo "NEEDS_NODE=$needs_node" >> $GITHUB_ENV

      - name: Validate .NET Inputs
        if: env.NEEDS_DOTNET == 'true' && inputs.solution == ''
        run: |
          echo "❌ .NET steps are required but inputs.solution was not provided."
          echo "   Provide inputs.solution (e.g. MyApp.sln) when using webPath/hasTests/functions." 
          exit 1

      - name: Checkout Repository
        uses: actions/checkout@v5

      - name: Setup .NET
        if: env.NEEDS_DOTNET == 'true'
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: ${{ inputs.dotnetVersion }}

      - name: Restore Dependencies
        if: env.NEEDS_DOTNET == 'true'
        run: dotnet restore ${{ inputs.solution }}

      - name: Build Code
        if: env.NEEDS_DOTNET == 'true'
        run: dotnet build ${{ inputs.solution }} --configuration ${{ inputs.buildConfiguration }} --no-restore

      - name: Test Code
        if: env.NEEDS_DOTNET == 'true' && inputs.hasTests == true
        run: |
          SOLUTION="${{ inputs.solution }}"
          SOLUTION_ARGS=()
          [ -n "$SOLUTION" ] && SOLUTION_ARGS+=(--solution "$SOLUTION")
          dotnet test "${SOLUTION_ARGS[@]}" --no-restore --configuration ${{ inputs.buildConfiguration }}

      - name: Setup Local .NET Tools
        if: env.NEEDS_DOTNET == 'true' && inputs.functions != '[]'
        run: |
          dotnet new tool-manifest --force
          dotnet tool install Amazon.Lambda.Tools

      - name: Build and Publish Blazor WebAssembly
        if: env.NEEDS_DOTNET == 'true' && inputs.webPath != ''
        run: |
          WASM_ENV="Development"
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            WASM_ENV="Production"
          fi
          dotnet publish ${{ inputs.webPath }} --configuration ${{ inputs.buildConfiguration }} --no-restore --output ${{ env.outputPath }} -p:WasmApplicationEnvironmentName=$WASM_ENV

      - name: Install jq
        if: inputs.functions != '[]' || inputs.spaSites != '[]'
        run: sudo apt-get update && sudo apt-get install -y jq

      - name: Build and Package All Lambda Functions
        if: env.NEEDS_DOTNET == 'true' && inputs.functions != '[]'
        run: |
          FUNCTIONS='${{ inputs.functions }}'
          COUNT=$(echo "$FUNCTIONS" | jq length)
          
          for i in $(seq 0 $((COUNT - 1))); do
            NAME=$(echo "$FUNCTIONS" | jq -r ".[$i].name")
            FUNC_PATH=$(echo "$FUNCTIONS" | jq -r ".[$i].path")
            ZIP_PATH="${{ env.outputPath }}/${NAME}.zip"
          
            echo "Packaging $NAME from FUNC_PATH..."
            dotnet tool run dotnet-lambda package -pl "$FUNC_PATH" --configuration ${{ inputs.buildConfiguration }} --no-restore --framework ${{ inputs.lambdaRuntimeVersion }} --output-package "$ZIP_PATH"
          
            echo "Packaged: $ZIP_PATH"
          done

      - name: Detect JS lockfile for caching
        if: env.NEEDS_NODE == 'true'
        id: nodecache
        shell: bash
        run: |
          set -e

          # Prefer pnpm lockfile if present and packageManager is pnpm
          if [ "${{ inputs.packageManager }}" = "pnpm" ] && ls **/pnpm-lock.yaml 1> /dev/null 2>&1; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
            echo "dep=**/pnpm-lock.yaml" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Otherwise look for npm lockfile
          if [ "${{ inputs.packageManager }}" = "npm" ] && ls **/package-lock.json 1> /dev/null 2>&1; then
            echo "enabled=true" >> "$GITHUB_OUTPUT"
            echo "dep=**/package-lock.json" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # No lockfile found => disable caching
          echo "enabled=false" >> "$GITHUB_OUTPUT"
          echo "dep=" >> "$GITHUB_OUTPUT"
          
      - name: Setup pnpm
        if: env.NEEDS_NODE == 'true' && inputs.packageManager == 'pnpm'
        uses: pnpm/action-setup@v4
        with:
          version: ${{ inputs.pnpmVersion }}
      
      - name: Enable Corepack (pnpm)
        if: env.NEEDS_NODE == 'true' && inputs.packageManager == 'pnpm'
        run: corepack enable
      
      - name: Setup Node.js (no cache)
        if: env.NEEDS_NODE == 'true' && steps.nodecache.outputs.enabled != 'true'
        uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.nodeVersion }}

      - name: Setup Node.js (with cache)
        if: env.NEEDS_NODE == 'true' && steps.nodecache.outputs.enabled == 'true'
        uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.nodeVersion }}
          cache: ${{ inputs.packageManager }}
          cache-dependency-path: ${{ steps.nodecache.outputs.dep }}

      - name: Build JavaScript SPAs
        if: inputs.spaSites != '[]'
        run: |
          set -euo pipefail

          SITES='${{ inputs.spaSites }}'
          COUNT=$(echo "$SITES" | jq length)

          if [ "$COUNT" -eq 0 ]; then
            echo "No SPAs configured."
            exit 0
          fi

          echo "Building $COUNT JavaScript SPA(s)..."

          for i in $(seq 0 $((COUNT - 1))); do
            NAME=$(echo "$SITES" | jq -r ".[$i].name // empty")
            SPA_PATH=$(echo "$SITES" | jq -r ".[$i].path // empty")
            BUILD_DIR=$(echo "$SITES" | jq -r ".[$i].buildDir // \"dist\"")
            INSTALL_CMD=$(echo "$SITES" | jq -r ".[$i].installCommand // \"npm ci\"")
            BUILD_CMD=$(echo "$SITES" | jq -r ".[$i].buildCommand // \"npm run build\"")
            OUTPUT_SUBDIR=$(echo "$SITES" | jq -r ".[$i].outputSubdir // empty")

            if [ -z "$NAME" ]; then
              echo "❌ spaSites[$i].name is required"
              exit 1
            fi
            if [ -z "$SPA_PATH" ]; then
              echo "❌ spaSites[$i].path is required (site: $NAME)"
              exit 1
            fi
            if [ ! -f "$SPA_PATH/package.json" ]; then
              echo "❌ package.json not found at $SPA_PATH (site: $NAME)"
              exit 1
            fi

            if [ -z "$OUTPUT_SUBDIR" ]; then
              OUTPUT_SUBDIR="websites/$NAME"
            fi

            echo "---"
            echo "Site: $NAME"
            echo "Path: $SPA_PATH"
            echo "Build dir: $BUILD_DIR"
            echo "Output subdir: $OUTPUT_SUBDIR"

            ENV_SPEC=$(echo "$SITES" | jq -c ".[$i].env // {}")
            ENV_KEYS=$(echo "$ENV_SPEC" | jq -r 'keys[]')
            ENV_KEYS_SET=()
            ENV_PREV_SET=()
            ENV_PREV_VAL=()
            ENV_TARGET="dev"
            if [[ "${{ github.ref }}" == refs/tags/* ]]; then
              ENV_TARGET="prod"
            fi

            if [ -n "$ENV_KEYS" ]; then
              echo "Env ($ENV_TARGET):"
              for KEY in $ENV_KEYS; do
                if [[ ! "$KEY" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
                  echo "❌ Invalid env var name in spaSites[$i].env: $KEY (site: $NAME)"
                  exit 1
                fi

                RAW_VAL=$(echo "$ENV_SPEC" | jq -r --arg k "$KEY" --arg t "$ENV_TARGET" '.[ $k ] | if type=="object" then (.[$t]) else . end')
                if [ "$RAW_VAL" = "null" ]; then
                  echo "❌ Missing spaSites[$i].env.$KEY.$ENV_TARGET value (site: $NAME)"
                  exit 1
                fi
                VAL=$(printf "%s" "$RAW_VAL")
                if [ -z "$VAL" ]; then
                  echo "❌ Missing spaSites[$i].env.$KEY.$ENV_TARGET value (site: $NAME)"
                  exit 1
                fi

                if [ "${!KEY+x}" ]; then
                  ENV_PREV_SET+=("1")
                  ENV_PREV_VAL+=("${!KEY}")
                else
                  ENV_PREV_SET+=("0")
                  ENV_PREV_VAL+=("")
                fi
                ENV_KEYS_SET+=("$KEY")
                export "$KEY=$VAL"
                echo "- $KEY=***"
              done
            fi

            echo "Installing deps: $INSTALL_CMD"
            (cd "$SPA_PATH" && bash -lc "$INSTALL_CMD")

            echo "Building: $BUILD_CMD"
            (cd "$SPA_PATH" && bash -lc "$BUILD_CMD")

            BUILD_OUT="$SPA_PATH/$BUILD_DIR"
            if [ ! -d "$BUILD_OUT" ]; then
              echo "❌ Build output directory not found: $BUILD_OUT (site: $NAME)"
              exit 1
            fi

            SITE_OUT="${{ env.outputPath }}/$OUTPUT_SUBDIR"
            rm -rf "$SITE_OUT"
            mkdir -p "$SITE_OUT"
            cp -a "$BUILD_OUT/." "$SITE_OUT/"

            echo "✅ Built $NAME -> $SITE_OUT"

            if [ ${#ENV_KEYS_SET[@]} -gt 0 ]; then
              for IDX in "${!ENV_KEYS_SET[@]}"; do
                KEY="${ENV_KEYS_SET[$IDX]}"
                if [ "${ENV_PREV_SET[$IDX]}" = "1" ]; then
                  export "$KEY=${ENV_PREV_VAL[$IDX]}"
                else
                  unset "$KEY"
                fi
              done
            fi
          done

      - name: Install AWS CDK Locally
        if: inputs.runCdk == true
        run: npm install aws-cdk
        
      - name: Determine CDK Stack
        if: inputs.runCdk == true
        id: set-cdk-stack
        run: |
          STACK_BASE=${{ inputs.stackName }}
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            echo "DEPLOY_ENV=$STACK_BASE-prod" >> $GITHUB_ENV
          else
            echo "DEPLOY_ENV=$STACK_BASE-dev" >> $GITHUB_ENV
          fi

          echo "Deployment Environment: $DEPLOY_ENV"

          
      - name: Set Release Version
        id: set-release-version
        run: |
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
          else
            BASE_VERSION=$(date +'%Y.%m.%d')
            echo "RELEASE_VERSION=v${BASE_VERSION}.${{ github.run_id }}" >> $GITHUB_ENV
          fi

          echo "Release Version: $RELEASE_VERSION"
          

      - name: Configure AWS Credentials via OIDC
        if: inputs.runCdk == true
        uses: aws-actions/configure-aws-credentials@v4
        with:
          audience: sts.amazonaws.com
          aws-region: us-east-1
          role-to-assume: arn:aws:iam::403542860824:role/github-deploy-role

      - name: Run AWS CDK Deploy
        if: inputs.runCdk == true
        # ✅ Pass the GitHub App secrets to the CDK workflow
        env:
          TMD_APP_ID: ${{ secrets.TMD_APP_ID }}
          TMD_APP_INSTALLATION_ID: ${{ secrets.TMD_APP_INSTALLATION_ID }}
          TMD_APP_PRIVATE_KEY: ${{ secrets.TMD_APP_PRIVATE_KEY }}
          TMD_WEBHOOK_SECRET: ${{ secrets.TMD_WEBHOOK_SECRET }}
          TMP_APP_ID: ${{ secrets.TMP_APP_ID }}
          TMP_APP_INSTALLATION_ID: ${{ secrets.TMP_APP_INSTALLATION_ID }}
          TMP_APP_PRIVATE_KEY: ${{ secrets.TMP_APP_PRIVATE_KEY }}
          TMP_WEBHOOK_SECRET: ${{ secrets.TMP_WEBHOOK_SECRET }}
          OPENAI_APIKEY: ${{ secrets.OPENAI_APIKEY }}
          OPENAI_ORGANIZATION: ${{ secrets.OPENAI_ORGANIZATION }}
        run: |
          SYNTH_TARGET_ARG=""
          if [ -n "${{ inputs.stackName }}" ]; then
            SYNTH_TARGET_ARG="--context stackGroup=${{ inputs.stackName }}"
          fi
          npx aws-cdk deploy --require-approval never --context releaseVersion=${{ env.RELEASE_VERSION }} $SYNTH_TARGET_ARG ${{ env.DEPLOY_ENV }}

      - name: Restore Integration Test Dependencies
        if: inputs.integrationTestSolution != '' && !startsWith(github.ref, 'refs/tags/')
        run: dotnet restore ${{ inputs.integrationTestSolution }}

      - name: Run Integration Tests
        if: inputs.integrationTestSolution != '' && !startsWith(github.ref, 'refs/tags/')
        run: dotnet test --solution ${{ inputs.integrationTestSolution }} --no-restore --configuration ${{ inputs.buildConfiguration }}

      - name: Tag Branch with Release Version
        if: startsWith(github.ref, 'refs/tags/') == false  # ✅ Run only if NOT a tag build
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git config --global user.name "github-actions"
          git config --global user.email "github-actions@github.com"
          
          git tag ${{ env.RELEASE_VERSION }}  # ✅ Create tag
          git push origin ${{ env.RELEASE_VERSION }}  # ✅ Push tag to GitHub