ci.yaml

name: deploy-probot-terraform

on:
  pull_request:
  workflow_dispatch:
  push:
    branches:
      - "pull-request/[0-9]+"
      - "main"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    name: Deploy Probot Application
    runs-on: ubuntu-latest

    steps:
      - name: Get AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.SERVERLESS_AWS_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: Install npm dependencies
        run: npm ci

      - name: Test Probot
        run: npm run test

      - name: Build Probot
        run: npm run build

      - name: Copy release draft template
        run: cp src/plugins/ReleaseDrafter/draft_template.njk dist/plugins/ReleaseDrafter

      - name: Package Lambda functions
        run: |
          zip -r probot.zip .
          zip -r authorizer.zip . -x "probot.zip"

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: "1.9.2"

      - name: Terraform Format Check
        working-directory: terraform
        run: terraform fmt -check

      - name: Terraform Init
        working-directory: terraform
        run: terraform init

      - name: Terraform Validate
        working-directory: terraform
        run: terraform validate

      - name: Terraform Plan
        id: plan
        working-directory: terraform
        run: terraform plan -out tfplan
        env:
          TF_VAR_app_id: ${{ secrets.APP_ID }}
          TF_VAR_webhook_secret: ${{ secrets.WEBHOOK_SECRET }}
          TF_VAR_private_key: ${{ secrets.PRIVATE_KEY }}
          TF_VAR_gputester_pat: ${{ secrets.GPUTESTER_PAT }}

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
        working-directory: terraform
        run: terraform apply -auto-approve tfplan