deploy-integration.yml

name: Deploy to Integration

on:
  push:
    branches:
      - master
    paths:
      - 'platform/wab/**'
      - 'platform/loader-bundle-env/**'
      - '.github/**'
  workflow_dispatch:

jobs:
  build:
    name: Build and Push Docker Image
    runs-on: ubuntu-latest
    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
    environment: integration
    permissions:
      contents: read   # Read repo contents
      id-token: write  # Required for AWS OIDC authentication

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ECR_PUSH_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Mask ECR registry URL
        run: |
          echo "::add-mask::${{ steps.login-ecr.outputs.registry }}"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push Docker image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          # Mask sensitive values
          echo "::add-mask::$ECR_REGISTRY"
          echo "::add-mask::$ECR_REPOSITORY"

          # Build the Docker image
          docker build \
            --platform linux/amd64 \
            -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG \
            -f platform/wab/Dockerfile \
            platform/

          # Push to ECR
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

          echo "Pushed image: $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG"

      - name: Trigger GitLab image tag update
        if: success()
        env:
          GITLAB_PIPELINE_TRIGGER_TOKEN: ${{ secrets.GITLAB_PIPELINE_TRIGGER_TOKEN }}
          GITLAB_PROJECT_ID: ${{ secrets.GITLAB_PROJECT_ID }}
          IMAGE_URL: ${{ steps.login-ecr.outputs.registry }}/${{ vars.ECR_REPOSITORY }}:${{ github.sha }}
        run: |
          curl --fail --request POST \
            "https://gitlab.elasticpath.com/api/v4/projects/${GITLAB_PROJECT_ID}/trigger/pipeline" \
            --form "token=${GITLAB_PIPELINE_TRIGGER_TOKEN}" \
            --form "ref=main" \
            --form "variables[UPDATE_IMAGE_TAGS]=true" \
            --form "variables[TARGET_ENV]=integration" \
            --form "variables[CONTAINER_IMAGE]=${IMAGE_URL}"

      - name: Build summary
        if: success()
        run: |
          echo "### ✅ Docker Image Built and Pushed" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Environment:** ${{ vars.ENVIRONMENT }}" >> $GITHUB_STEP_SUMMARY
          echo "**Image Tag:** \`${GITHUB_SHA:0:8}\`" >> $GITHUB_STEP_SUMMARY
          echo "**Full SHA:** \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "GitLab has been notified to deploy this image." >> $GITHUB_STEP_SUMMARY

      - name: Notify on failure
        if: failure()
        run: |
          echo "### ❌ Build Failed" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Environment:** ${{ vars.ENVIRONMENT }}" >> $GITHUB_STEP_SUMMARY
          echo "**Commit:** \`${GITHUB_SHA:0:8}\`" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Check the workflow logs for details."