name: Deploy

# Terraform owns Lambda skeletons. This workflow ships zips to prod and calls
# update-function-code. It never creates an HCP run. No GitHub Releases and no
# tagging in this workflow.

on:
  push:
    branches: [main]
    paths-ignore:
      - "terraform/**"
      - "docs/**"
      - "README.md"
      - "SETUP.md"
      - "AGENTS.md"
  workflow_dispatch:
    inputs:
      ref:
        description: "Git ref to build and deploy (tag, branch, or SHA). Empty means the workflow ref."
        required: false
        type: string
        default: ""

permissions:
  contents: read

jobs:
  deploy:
    name: Deploy to prod
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: prod
    concurrency:
      group: deploy-payments-dashboard-prod
      cancel-in-progress: false
    permissions:
      contents: read
      id-token: write
    env:
      AWS_REGION: us-east-1
      DEPLOY_ROLE_ARN: ${{ vars.DEPLOY_ROLE_ARN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || github.sha }}
          persist-credentials: false

      - name: Resolve commit
        id: commit
        run: |
          set -euo pipefail
          sha="$(git rev-parse HEAD)"
          echo "sha=${sha}" >> "$GITHUB_OUTPUT"
          echo "Building ${sha}"

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24"
          cache: npm

      - name: Build function zips
        env:
          GIT_SHA: ${{ steps.commit.outputs.sha }}
        run: |
          set -euo pipefail
          node scripts/package_lambdas.mjs --git-sha "${GIT_SHA}" --out-dir build/packages
          python3 - <<'PY'
          import os, zipfile
          from pathlib import Path
          sha = os.environ["GIT_SHA"]
          names = [
              "process_csv",
              "slack_app_home",
              "fetch_boa",
              "expense_receiver",
              "expense_processor",
          ]
          for name in names:
              path = Path("build/packages") / f"{name}.zip"
              if not path.is_file():
                  raise SystemExit(f"missing {path}")
              with zipfile.ZipFile(path) as zf:
                  info = zf.read("src/buildInfo.js").decode()
                  if sha not in info:
                      raise SystemExit(f"{path} missing GIT_SHA {sha}")
                  if "src/processPaymentCsv.js" not in zf.namelist():
                      raise SystemExit(f"{path} missing src/")
          print("zips ok")
          PY

      - name: Configure AWS credentials using OIDC
        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: ${{ env.DEPLOY_ROLE_ARN }}
          aws-region: us-east-1
          audience: sts.amazonaws.com

      - name: Get deploy parameters
        id: deploy
        run: |
          set -euo pipefail
          prefix=/payments-dashboard/deploy
          ARTIFACTS_BUCKET=$(aws ssm get-parameter --name "${prefix}/artifacts-bucket" --query Parameter.Value --output text)
          {
            echo "artifacts_bucket=${ARTIFACTS_BUCKET}"
            echo "process_csv=$(aws ssm get-parameter --name "${prefix}/process_csv-function-name" --query Parameter.Value --output text)"
            echo "slack_app_home=$(aws ssm get-parameter --name "${prefix}/slack_app_home-function-name" --query Parameter.Value --output text)"
            echo "fetch_boa=$(aws ssm get-parameter --name "${prefix}/fetch_boa-function-name" --query Parameter.Value --output text)"
            echo "expense_receiver=$(aws ssm get-parameter --name "${prefix}/expense_receiver-function-name" --query Parameter.Value --output text)"
            echo "expense_processor=$(aws ssm get-parameter --name "${prefix}/expense_processor-function-name" --query Parameter.Value --output text)"
          } >> "${GITHUB_OUTPUT}"

      - name: Upload zips and update function code
        env:
          ARTIFACTS_BUCKET: ${{ steps.deploy.outputs.artifacts_bucket }}
          GIT_SHA: ${{ steps.commit.outputs.sha }}
          PROCESS_CSV: ${{ steps.deploy.outputs.process_csv }}
          SLACK_APP_HOME: ${{ steps.deploy.outputs.slack_app_home }}
          FETCH_BOA: ${{ steps.deploy.outputs.fetch_boa }}
          EXPENSE_RECEIVER: ${{ steps.deploy.outputs.expense_receiver }}
          EXPENSE_PROCESSOR: ${{ steps.deploy.outputs.expense_processor }}
        run: |
          set -euo pipefail
          keys=(
            process_csv:"${PROCESS_CSV}"
            slack_app_home:"${SLACK_APP_HOME}"
            fetch_boa:"${FETCH_BOA}"
            expense_receiver:"${EXPENSE_RECEIVER}"
            expense_processor:"${EXPENSE_PROCESSOR}"
          )
          for pair in "${keys[@]}"; do
            name="${pair%%:*}"
            fn="${pair#*:}"
            key="functions/${name}/${GIT_SHA}.zip"
            aws s3 cp "build/packages/${name}.zip" "s3://${ARTIFACTS_BUCKET}/${key}"
            aws lambda update-function-code \
              --function-name "${fn}" \
              --s3-bucket "${ARTIFACTS_BUCKET}" \
              --s3-key "${key}" \
              --query '{Function:FunctionName,Sha256:CodeSha256,Updated:LastModified}' \
              --output table
            aws lambda wait function-updated-v2 --function-name "${fn}"
          done