deploy-staged.yml

name: Release to Modal

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      new_app_target:
        description: "Where to deploy the newly built worker app"
        required: true
        default: frontier
        type: choice
        options:
          - frontier
          - current
          - both
          - none
      promote_existing_frontier:
        description: "Move the existing frontier worker to current before deploying a new frontier"
        required: true
        default: true
        type: boolean
      cleanup_target:
        description: "Modal app group to stop after updating the manifest"
        required: true
        default: retired
        type: choice
        options:
          - none
          - retired
          - frontier
          - current

env:
  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
  MODAL_WORKSPACE: policyengine
  PYTHON_VERSION: "3.13"

concurrency:
  group: household-api-modal-release
  cancel-in-progress: false

jobs:
  lint-and-test:
    name: Lint and test
    runs-on: ubuntu-latest
    if: |
      github.repository == 'PolicyEngine/policyengine-household-api' &&
      (
        github.event_name == 'workflow_dispatch' ||
        github.event.head_commit.message == 'Update PolicyEngine Household API'
      )

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: make install

      - name: Run Ruff format check
        run: make format-check

      - name: Run tests without auth
        run: make test

      - name: Run tests with auth
        run: make test-with-auth
        env:
          AUTH__ENABLED: true
          AUTH0_ADDRESS_NO_DOMAIN: ${{ secrets.AUTH0_ADDRESS_NO_DOMAIN }}
          AUTH0_AUDIENCE_NO_DOMAIN: ${{ secrets.AUTH0_AUDIENCE_NO_DOMAIN }}
          AUTH0_TEST_TOKEN_NO_DOMAIN: ${{ secrets.AUTH0_TEST_TOKEN_NO_DOMAIN }}
          AUTH0_TEST_TOKEN_SCOPES: ${{ secrets.AUTH0_TEST_TOKEN_SCOPES }}

  resolve-modal-release-config:
    name: Resolve Modal release config
    runs-on: ubuntu-latest
    if: |
      github.repository == 'PolicyEngine/policyengine-household-api' &&
      (
        github.event_name == 'workflow_dispatch' ||
        github.event.head_commit.message == 'Update PolicyEngine Household API'
      )
    permissions:
      contents: read
      pull-requests: read
    outputs:
      should_deploy: ${{ steps.resolve.outputs.should_deploy }}
      source: ${{ steps.resolve.outputs.source }}
      deploy_mode: ${{ steps.resolve.outputs.deploy_mode }}
      new_app_target: ${{ steps.resolve.outputs.new_app_target }}
      promote_existing_frontier: ${{ steps.resolve.outputs.promote_existing_frontier }}
      cleanup_target: ${{ steps.resolve.outputs.cleanup_target }}
      config_json: ${{ steps.resolve.outputs.config_json }}

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: pip install -e .

      - name: Resolve Modal release config
        id: resolve
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python .github/scripts/resolve_modal_release_config.py \
            --output-json modal-release-config.json

  deploy-modal-staging:
    name: Deploy Modal release to staging
    runs-on: ubuntu-latest
    needs: [lint-and-test, resolve-modal-release-config]
    if: needs.resolve-modal-release-config.outputs.should_deploy == 'true'
    environment: staging
    permissions:
      contents: read
    env:
      MODAL_ENVIRONMENT: staging
      MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
      MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
      ANALYTICS__ENABLED: "true"
      USER_ANALYTICS_DB_CONNECTION_NAME: ${{ secrets.USER_ANALYTICS_DB_CONNECTION_NAME }}
      USER_ANALYTICS_DB_USERNAME: ${{ secrets.USER_ANALYTICS_DB_USERNAME }}
      USER_ANALYTICS_DB_PASSWORD: ${{ secrets.USER_ANALYTICS_DB_PASSWORD }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud for analytics database
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        uses: astral-sh/setup-uv@v5

      - name: Sync dependencies
        run: uv sync --extra dev

      - name: Ensure Modal staging environment exists
        run: uv run modal environment create staging 2>/dev/null || true

      - name: Deploy Modal app set
        id: deploy
        env:
          APP__ENVIRONMENT: staging
          AUTH__ENABLED: "true"
          AUTH0_ADDRESS_NO_DOMAIN: ${{ secrets.AUTH0_ADDRESS_NO_DOMAIN }}
          AUTH0_AUDIENCE_NO_DOMAIN: ${{ secrets.AUTH0_AUDIENCE_NO_DOMAIN }}
          AI__ENABLED: "true"
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GCP_CREDENTIALS_JSON: ${{ secrets.GCP_SA_KEY }}
        run: |
          bash .github/scripts/modal-deploy-release.sh \
            '${{ needs.resolve-modal-release-config.outputs.config_json }}' \
            '${{ needs.resolve-modal-release-config.outputs.deploy_mode }}'

  integration-tests-staging:
    name: Integration tests against Modal staging (${{ matrix.channel }}, ${{ matrix.route_mode }})
    runs-on: ubuntu-latest
    needs: [deploy-modal-staging]
    environment: staging
    env:
      MODAL_ENVIRONMENT: staging
      MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
      MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
    strategy:
      fail-fast: false
      matrix:
        channel: [current, frontier]
        route_mode: [channel, exact]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        uses: astral-sh/setup-uv@v5

      - name: Sync dependencies
        run: uv sync --extra dev

      - name: Fetch Auth0 test token
        env:
          AUTH0_DOMAIN: ${{ secrets.AUTH0_ADDRESS_NO_DOMAIN }}
          AUTH0_AUDIENCE: ${{ secrets.AUTH0_AUDIENCE_NO_DOMAIN }}
          AUTH0_CLIENT_ID: ${{ secrets.AUTH0_TEST_TOKEN_CLIENT_ID }}
          AUTH0_CLIENT_SECRET: ${{ secrets.AUTH0_TEST_TOKEN_CLIENT_SECRET }}
          AUTH0_TEST_TOKEN_SCOPES: ${{ secrets.AUTH0_TEST_TOKEN_SCOPES }}
        run: python .github/scripts/fetch_auth0_test_token.py

      - name: Run deployed integration tests for route
        run: |
          bash .github/scripts/run-deployed-tests-for-modal-route.sh \
            "${{ matrix.channel }}" \
            "${{ matrix.route_mode }}"

  deploy-modal-production:
    name: Deploy Modal release to production
    runs-on: ubuntu-latest
    needs: [resolve-modal-release-config, integration-tests-staging]
    if: needs.resolve-modal-release-config.outputs.should_deploy == 'true'
    environment: production
    permissions:
      contents: read
    env:
      MODAL_ENVIRONMENT: main
      MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
      MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
      ANALYTICS__ENABLED: "true"
      USER_ANALYTICS_DB_CONNECTION_NAME: ${{ secrets.USER_ANALYTICS_DB_CONNECTION_NAME }}
      USER_ANALYTICS_DB_USERNAME: ${{ secrets.USER_ANALYTICS_DB_USERNAME }}
      USER_ANALYTICS_DB_PASSWORD: ${{ secrets.USER_ANALYTICS_DB_PASSWORD }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud for analytics database
        uses: google-github-actions/auth@v2
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        uses: astral-sh/setup-uv@v5

      - name: Sync dependencies
        run: uv sync --extra dev

      - name: Deploy Modal app set
        id: deploy
        env:
          APP__ENVIRONMENT: production
          AUTH__ENABLED: "true"
          AUTH0_ADDRESS_NO_DOMAIN: ${{ secrets.AUTH0_ADDRESS_NO_DOMAIN }}
          AUTH0_AUDIENCE_NO_DOMAIN: ${{ secrets.AUTH0_AUDIENCE_NO_DOMAIN }}
          AI__ENABLED: "true"
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GCP_CREDENTIALS_JSON: ${{ secrets.GCP_SA_KEY }}
        run: |
          bash .github/scripts/modal-deploy-release.sh \
            '${{ needs.resolve-modal-release-config.outputs.config_json }}' \
            '${{ needs.resolve-modal-release-config.outputs.deploy_mode }}'

  publish:
    name: Publish to PyPI
    runs-on: ubuntu-latest
    if: |
      github.repository == 'PolicyEngine/policyengine-household-api' &&
      github.event_name == 'push' &&
      github.event.head_commit.message == 'Update PolicyEngine Household API'
    needs: [deploy-modal-production]
    environment:
      name: pypi
      url: https://pypi.org/p/policyengine-household-api
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install uv
        uses: astral-sh/setup-uv@v5

      - name: Build package
        run: uv build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

  tag-release:
    name: Publish git tag
    runs-on: ubuntu-latest
    if: |
      github.repository == 'PolicyEngine/policyengine-household-api' &&
      github.event_name == 'push' &&
      github.event.head_commit.message == 'Update PolicyEngine Household API'
    needs: [publish]
    permissions:
      contents: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Publish Git tag
        run: bash .github/publish-git-tag.sh