shoc-backend/.github/workflows/deploy.yml

name: Validate and deploy dev

on:
  pull_request:
    branches: [dev]
  push:
    branches: [dev]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate:
    name: Validate deployable source bundle
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        # actions/checkout @ v7.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0

      - name: Set up .NET
        # actions/setup-dotnet @ v6.0.0
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
          dotnet-version: "8.0.x"

      - name: Set up Node.js
        # actions/setup-node @ v6.5.0
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
        with:
          node-version: "22.22.1"
          cache: npm
          cache-dependency-path: infra/cdk/package-lock.json

      - name: Repository quality gate
        run: bash scripts/governance-check.sh

      - name: Validate CDK deployment infrastructure
        run: |
          npm ci --prefix infra/cdk
          npm run synth --prefix infra/cdk

      - name: Build Elastic Beanstalk source bundle
        run: bash scripts/package-elastic-beanstalk.sh

      - name: Inspect source bundle contract
        run: |
          set -euo pipefail
          unzip -t .artifacts/elastic-beanstalk/site.zip
          unzip -Z1 .artifacts/elastic-beanstalk/site.zip \
            > .artifacts/elastic-beanstalk/zip-contents.txt
          grep -Fxq "efbundle" .artifacts/elastic-beanstalk/zip-contents.txt
          grep -Fxq ".ebextensions/01_migrations.config" \
            .artifacts/elastic-beanstalk/zip-contents.txt

  deploy:
    name: Deploy shoc-backend to Elastic Beanstalk dev
    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/dev')
    needs: validate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    environment:
      name: dev
    concurrency:
      group: deploy-dev
      cancel-in-progress: false
    steps:
      - name: Checkout
        # actions/checkout @ v7.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

      - name: Set up .NET
        # actions/setup-dotnet @ v6.0.0
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
        with:
          dotnet-version: "8.0.x"

      - name: Build Elastic Beanstalk source bundle
        run: bash scripts/package-elastic-beanstalk.sh

      - name: Configure AWS credentials (OIDC)
        # aws-actions/configure-aws-credentials @ v6.2.3
        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: us-east-1
          audience: sts.amazonaws.com

      - name: Capture current environment version
        run: |
          set -euo pipefail
          prev="$(aws elasticbeanstalk describe-environments \
            --environment-names shoc-backend-dev \
            --region us-east-1 \
            --query 'Environments[0].VersionLabel' \
            --output text)"
          echo "$prev" > .artifacts/elastic-beanstalk/previous-version.txt
          echo "Previous version label: $prev"

      - name: Deploy prebuilt bundle to existing environment
        # aws-actions/aws-elasticbeanstalk-deploy @ v1.0.6
        uses: aws-actions/aws-elasticbeanstalk-deploy@cfad3e5e4452cd9c8923cbee2f862e96ba4b52c4
        with:
          aws-region: us-east-1
          application-name: shoc-backend
          environment-name: shoc-backend-dev
          version-label: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}
          deployment-package-path: .artifacts/elastic-beanstalk/site.zip
          s3-bucket-name: elasticbeanstalk-us-east-1-396287094661
          create-application-if-not-exists: "false"
          create-environment-if-not-exists: "false"
          create-s3-bucket-if-not-exists: "false"
          use-existing-application-version-if-available: "false"
          wait-for-deployment: "true"
          wait-for-environment-recovery: "true"

      - name: Post-deploy smoke
        run: bash scripts/smoke-elastic-beanstalk.sh https://api.dev.seahaven.com

      - name: Restore previous application version on failure (schema is not reverted)
        if: failure()
        run: |
          set -euo pipefail
          prev_file=".artifacts/elastic-beanstalk/previous-version.txt"
          if [ ! -f "$prev_file" ]; then
            echo "No previous version captured; nothing to roll back." >&2
            exit 0
          fi
          prev="$(cat "$prev_file")"
          if [ -z "$prev" ] || [ "$prev" = "null" ] || [ "$prev" = "None" ] || [ "$prev" = "N/A" ]; then
            echo "No previous version recorded; nothing to roll back." >&2
            exit 0
          fi

          echo "Waiting for any in-flight environment update to settle..."
          status="Unknown"
          current="Unknown"
          health="Unknown"
          for _ in $(seq 1 80); do
            read -r status current health < <(
              aws elasticbeanstalk describe-environments \
                --environment-names shoc-backend-dev \
                --region us-east-1 \
                --query 'Environments[0].[Status,VersionLabel,Health]' \
                --output text
            )
            echo "environment status: $status; version: $current; health: $health"
            if [ "$status" = "Ready" ]; then
              break
            fi
            sleep 15
          done

          if [ "$status" != "Ready" ]; then
            echo "Environment did not settle before rollback." >&2
            exit 1
          fi
          if [ "$current" = "$prev" ]; then
            echo "Environment is already on previous version $prev."
            exit 0
          fi

          echo "Restoring shoc-backend-dev application code to version label: $prev"
          echo "Database migrations are not reverted; deployable migrations must follow the expand/contract policy."
          aws elasticbeanstalk update-environment \
            --environment-name shoc-backend-dev \
            --version-label "$prev" \
            --region us-east-1

          echo "Waiting for previous version to become healthy..."
          for _ in $(seq 1 80); do
            read -r status current health < <(
              aws elasticbeanstalk describe-environments \
                --environment-names shoc-backend-dev \
                --region us-east-1 \
                --query 'Environments[0].[Status,VersionLabel,Health]' \
                --output text
            )
            echo "environment status: $status; version: $current; health: $health"
            if [ "$status" = "Ready" ]; then
              if [ "$current" = "$prev" ] && { [ "$health" = "Green" ] || [ "$health" = "Yellow" ]; }; then
                echo "Application version restore complete; previous code is Ready and healthy."
                exit 0
              fi
              echo "Rollback reached Ready in an unexpected version/health state." >&2
              exit 1
            fi
            sleep 15
          done

          echo "Environment did not return to Ready within rollback window." >&2
          exit 1