deployment-v2.yml

name: Deployment v2

on:
  push:
    branches: [main]
    tags: [cowswap-*, explorer-*]

concurrency:
  group: ${{ startsWith(github.ref, 'refs/tags/') && format('release-tag-{0}', github.sha) || 'release-branch-sync' }}
  cancel-in-progress: ${{ startsWith(github.ref, 'refs/tags/') }}

permissions:
  contents: write
  pull-requests: write

jobs:
  collect-release-metadata:
    name: Collect release metadata
    if: startsWith(github.ref, 'refs/tags/')
    runs-on: ubuntu-latest
    outputs:
      release-commit: ${{ steps.collect.outputs.release-commit }}
      release-tags: ${{ steps.collect.outputs.release-tags }}
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/heads/main
          fetch-depth: 0
          persist-credentials: false

      - name: Collect tags for release commit
        id: collect
        run: |
          set -euo pipefail

          git fetch --tags origin main

          release_commit="$(git rev-list -n 1 "${GITHUB_REF}")"

          if ! git merge-base --is-ancestor "${release_commit}" "origin/main"; then
            echo "::error::Release tag ${GITHUB_REF_NAME} does not point to a commit reachable from origin/main"
            exit 1
          fi

          release_tags="$(
            git tag --points-at "${release_commit}" \
              | sort \
              | paste -sd ', ' -
          )"

          if [ -z "${release_tags}" ]; then
            release_tags="${GITHUB_REF_NAME}"
          fi

          echo "release-commit=${release_commit}" >> "$GITHUB_OUTPUT"
          echo "release-tags=${release_tags}" >> "$GITHUB_OUTPUT"

  sync-develop:
    name: Sync main to develop
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    env:
      TARGET_BRANCH: develop
      SYNC_BRANCH: automation/sync-main-to-develop
      PR_TITLE: 'chore(sync): merge main into develop'
      PR_BODY: |
        This PR contains an automated merge commit from `main` into `develop`.
    steps:
      - name: Checkout workflow repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/heads/main
          fetch-depth: 0
          persist-credentials: false

      - name: Setup release sync
        id: setup
        uses: ./.github/actions/setup-release-sync
        with:
          app-id: ${{ vars.COWSWAP_RELEASE_SYNC_APP_ID }}
          private-key: ${{ secrets.COWSWAP_RELEASE_SYNC_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repository: ${{ github.event.repository.name }}
          pull-requests-write: 'true'

      - name: Prepare merge branch
        id: prepare
        run: |
          set -euo pipefail

          git config user.name "${APP_SLUG}[bot]"
          git config user.email "${APP_USER_ID}+${APP_SLUG}[bot]@users.noreply.github.com"

          git fetch origin main "${TARGET_BRANCH}"
          git checkout -B "${TARGET_BRANCH}" "origin/${TARGET_BRANCH}"

          before_sha="$(git rev-parse HEAD)"
          git merge --no-ff --no-edit -m "${PR_TITLE}" origin/main
          after_sha="$(git rev-parse HEAD)"

          if [ "${before_sha}" = "${after_sha}" ]; then
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          echo "has_changes=true" >> "$GITHUB_OUTPUT"
        env:
          APP_SLUG: ${{ steps.setup.outputs.app-slug }}
          APP_USER_ID: ${{ steps.setup.outputs.app-user-id }}

      - name: Create or update pull request
        if: steps.prepare.outputs.has_changes == 'true'
        id: create-pr
        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          token: ${{ steps.setup.outputs.token }}
          branch: ${{ env.SYNC_BRANCH }}
          base: ${{ env.TARGET_BRANCH }}
          title: ${{ env.PR_TITLE }}
          body: ${{ env.PR_BODY }}
          commit-message: ${{ env.PR_TITLE }}
          delete-branch: false
          draft: false

      - name: Notify Slack for develop review
        if: steps.prepare.outputs.has_changes == 'true'
        run: |
          curl -X POST -H "Content-type: application/json" \
            --data "{\"text\": \"➡️ Develop sync PR is ready for review. <$PR_URL|Open pull request>.\"}" \
            "$SLACK_WEBHOOK_URL"
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          PR_URL: ${{ steps.create-pr.outputs.pull-request-url }}

  sync-staging:
    name: Fast-forward staging to main
    if: startsWith(github.ref, 'refs/tags/cowswap-') || startsWith(github.ref, 'refs/tags/explorer-')
    needs: collect-release-metadata
    runs-on: ubuntu-latest
    steps:
      - name: Checkout workflow repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/heads/main
          fetch-depth: 0
          persist-credentials: false

      - name: Setup release sync
        id: setup
        uses: ./.github/actions/setup-release-sync
        with:
          app-id: ${{ vars.COWSWAP_RELEASE_SYNC_APP_ID }}
          private-key: ${{ secrets.COWSWAP_RELEASE_SYNC_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repository: ${{ github.event.repository.name }}

      - name: Fast-forward staging
        run: |
          set -euo pipefail

          git fetch origin main staging --tags
          git checkout -B staging origin/staging
          git merge --ff-only "${RELEASE_COMMIT}"
          git push origin staging
        env:
          RELEASE_COMMIT: ${{ needs.collect-release-metadata.outputs.release-commit }}

  notify-production-approval:
    name: Notify Slack for production approval
    if: startsWith(github.ref, 'refs/tags/cowswap-') || startsWith(github.ref, 'refs/tags/explorer-')
    needs: [collect-release-metadata, sync-staging]
    runs-on: ubuntu-latest
    steps:
      - name: Notify Slack
        run: |
          curl -X POST -H "Content-type: application/json" \
            --data "{\"text\": \"⏳ Production release for tag(s) \`${RELEASE_TAGS}\` is waiting for approval. <$SERVER_URL/$REPOSITORY/actions/runs/$RUN_ID|Review the workflow run>.\"}" \
            "$SLACK_WEBHOOK_URL"
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          RELEASE_TAGS: ${{ needs.collect-release-metadata.outputs.release-tags }}
          SERVER_URL: ${{ github.server_url }}
          REPOSITORY: ${{ github.repository }}
          RUN_ID: ${{ github.run_id }}

  sync-production:
    name: Fast-forward production to main
    if: startsWith(github.ref, 'refs/tags/cowswap-') || startsWith(github.ref, 'refs/tags/explorer-')
    needs: [collect-release-metadata, notify-production-approval]
    runs-on: ubuntu-latest
    environment: production # Env configured in GitHub UI. Requires manual approval before this job can run
    steps:
      - name: Checkout workflow repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: refs/heads/main
          fetch-depth: 0
          persist-credentials: false
      - name: Setup release sync
        id: setup
        uses: ./.github/actions/setup-release-sync
        with:
          app-id: ${{ vars.COWSWAP_RELEASE_SYNC_APP_ID }}
          private-key: ${{ secrets.COWSWAP_RELEASE_SYNC_APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repository: ${{ github.event.repository.name }}

      - name: Fast-forward production
        run: |
          set -euo pipefail

          git fetch origin main production --tags
          git checkout -B production origin/production
          git merge --ff-only "${RELEASE_COMMIT}"
          git push origin production
        env:
          RELEASE_COMMIT: ${{ needs.collect-release-metadata.outputs.release-commit }}