cd.yml

name: CD

on:
  push:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: write
  id-token: write # Tailscale OIDC

env:
  CARGO_TERM_COLOR: always
  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse

jobs:
  build-binaries:
    name: Build ${{ matrix.arch }} binaries
    runs-on: ${{ matrix.runner }}
    strategy:
      matrix:
        include:
          - arch: arm64
            runner: ubuntu-24.04-arm
            target: aarch64-unknown-linux-gnu
    steps:
      - name: Free up space
        run: sudo rm -rf /opt/hostedtoolcache /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup || true
      - uses: actions/checkout@v7.0.0

      - name: Configure toolchain
        run: |
          rustup toolchain install --profile minimal --no-self-update stable
          rustup default stable
          rustup target add ${{ matrix.target }}

      - uses: taiki-e/install-action@v2.82.9
        with:
          tool: just

      - uses: Swatinem/rust-cache@v2
        with:
          key: ${{ matrix.arch }}-release

      # The runner image ships with Node + npm; private-server's build.rs
      # uses them to produce the embedded private-web/dist/ bundle.
      - name: Build binaries
        run: just build-servers-release ${{ matrix.target }}
        env:
          RUSTFLAGS: "-C target-feature=+crt-static"

      - name: Prepare artifacts
        run: |
          mkdir -p artifacts/${{ matrix.arch }}
          cargo metadata --format-version=1 --no-deps \
            | jq -r '.packages[].targets[] | select(.kind | index("bin")) | .name' \
            | while IFS= read -r bin; do
                cp "target/${{ matrix.target }}/release/$bin" "artifacts/${{ matrix.arch }}/"
              done

      - uses: actions/upload-artifact@v7
        with:
          name: binaries-${{ matrix.arch }}
          path: artifacts/${{ matrix.arch }}/
          retention-days: 1

  build-image:
    name: Build container image
    runs-on: ubuntu-24.04
    needs: [build-binaries]
    outputs:
      image-tag: ${{ steps.tag.outputs.value }}
    steps:
      - name: Login to ghcr.io
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin

      - uses: actions/checkout@v7.0.0

      - id: tag
        run: echo "value=sha-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Download ARM64 binaries
        uses: actions/download-artifact@v8
        with:
          name: binaries-arm64
          path: .github/build-context/arm64/

      # Stage the public-server's static assets into the build context.
      - name: Stage static assets
        run: cp -r static .github/build-context/static

      - name: Setup buildkit
        uses: docker/setup-buildx-action@v4.2.0

      - uses: docker/metadata-action@v6.2.0
        id: meta
        with:
          images: ghcr.io/beyondessential/canopy
          tags: |
            type=raw,value=latest
            type=raw,value=${{ steps.tag.outputs.value }}
          labels: |
            org.opencontainers.image.vendor=BES International
            org.opencontainers.image.title=Canopy
            org.opencontainers.image.url=https://www.bes.au/products/tamanu/
            org.opencontainers.image.source=https://github.com/beyondessential/canopy/
            org.opencontainers.image.licenses=GPL-3.0-or-later

      - name: Build and push
        uses: docker/build-push-action@v7.3.0
        with:
          context: .github/build-context
          file: .github/Dockerfile.native
          platforms: linux/arm64
          push: true
          labels: ${{ steps.meta.outputs.labels }}
          tags: ${{ steps.meta.outputs.tags }}

  deploy:
    name: Deploy
    runs-on: ubuntu-24.04
    needs: [build-image]
    steps:
      - name: Checkout ops repo
        uses: actions/checkout@v7.0.0
        with:
          repository: beyondessential/ops
          ssh-key: ${{ secrets.OPS_SSH }}
          ref: ${{ vars.OPS_REF }}
          path: ops

      # Drop ops/.git so pulumi doesn't pick it up as the repo context.
      - name: Strip ops/.git
        run: rm -rf ops/.git

      - name: Connect to Tailscale
        uses: tailscale/github-action@v4.1.3
        with:
          oauth-client-id: ${{ vars.TS_OAUTH_CLIENT_ID }}
          audience: api.tailscale.com/${{ vars.TS_OAUTH_CLIENT_ID }}
          tags: ${{ vars.TS_TAGS }}

      - name: Configure kubeconfig
        run: |
          sudo tailscale set --operator=$USER
          tailscale configure kubeconfig ${{ vars.TS_K8S_OPERATOR_HOSTNAME }}

      - uses: actions/setup-node@v6.4.0
        with:
          node-version: lts/*

      - name: Install pulumi dependencies
        run: |
          cd ops/pulumi
          npm ci

      - name: Install pulumi CLI
        uses: pulumi/actions@v7

      - name: Authenticate to Pulumi Cloud
        uses: pulumi/auth-actions@v2.1.0
        with:
          organization: bes
          requested-token-type: urn:pulumi:token-type:access_token:organization

      - name: Pulumi up
        run: |
          cd ops/${{ vars.OPS_PULUMI_PATH }}
          pulumi stack select ${{ vars.PULUMI_STACK }}
          pulumi config refresh
          pulumi config set imageTag ${{ needs.build-image.outputs.image-tag }}
          pulumi up --yes