fly-deployment.yml

name: Fly Deployment

# This workflow is triggered by a pull request or push to the main branch.
# Renovate and Nx migrations are ignored.
# Deployments run when the preview label is present (auto-added on PR open) or when closing PRs for cleanup.
# Can also be triggered manually for re-deployments.

on:
  workflow_dispatch:
    inputs:
      app:
        description: "App to deploy (leave empty for all affected apps)"
        required: false
        type: choice
        options:
          - ""
          - cms
          - web
      tenant:
        description: "Tenant ID (leave empty for all tenants, only applies to multi-tenant apps)"
        required: false
        type: string
      environment:
        description: "Target environment"
        required: true
        type: choice
        options:
          - preview
          - production
        default: production
      console-logs:
        description: "Show native logs from e.g. Fly and Docker"
        required: false
        type: boolean
        default: false
  pull_request:
    types:
      - opened
      - closed
      - reopened
      - synchronize
  push:
    branches:
      - main

env:
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  NX_NO_CLOUD: true
  # Label used to indicate that a preview deployment is enabled for the PR
  FLY_PREVIEW_LABEL: preview-deploy

permissions:
  contents: write
  issues: write
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: false

jobs:
  analyze-conditions:
    runs-on: ubuntu-latest

    outputs:
      skip: ${{ steps.preview.outputs.skip }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/github-script@v7
        id: preview
        env:
          PREVIEW_LABEL: ${{ env.FLY_PREVIEW_LABEL  }}
        with:
          script: |
            const { default: analyze } = await import(`${process.env.GITHUB_WORKSPACE}/scripts/github/analyze-fly-deployment-conditions.js`);
            await analyze({ github, context, core, label: process.env.PREVIEW_LABEL });

  pre-deploy:
    needs: analyze-conditions
    if: ${{ needs.analyze-conditions.outputs.skip != 'true' }}
    runs-on: ubuntu-latest

    outputs:
      apps: ${{ steps.pre-deploy.outputs.apps }}
      environment: ${{ steps.pre-deploy.outputs.environment }}
      app-tenants: ${{ steps.pre-deploy.outputs.app-tenants }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build pre-deploy action
        run: pnpm nx build nx-pre-deploy-action

      - name: Set SHAs for affected calculations
        uses: nrwl/nx-set-shas@v4
        with:
          main-branch-name: main
          set-environment-variables-for-job: true

      - name: Run pre-deploy
        id: pre-deploy
        uses: ./packages/nx-pre-deploy-action
        with:
          infisical-client-id: ${{ secrets.INFISICAL_READ_CLIENT_ID }}
          infisical-client-secret: ${{ secrets.INFISICAL_READ_CLIENT_SECRET }}
          infisical-project-id: ${{ secrets.INFISICAL_PROJECT_ID }}
          manual-app: ${{ github.event.inputs.app }}
          manual-tenant: ${{ github.event.inputs.tenant }}
          manual-environment: ${{ github.event.inputs.environment }}
        env:
          # Must be defined since `github.json` is validated and cms app uses it
          POSTGRES_PREVIEW: ${{ vars.FLY_POSTGRES_PREVIEW }}

  fly-deployment:
    if: ${{ needs.pre-deploy.outputs.environment != '' && needs.pre-deploy.outputs.apps != '[]' }}

    needs: pre-deploy
    runs-on: ubuntu-latest

    # Not possible to provide url since we might have multiple deployments
    environment: ${{ needs.pre-deploy.outputs.environment }}

    steps:
      - uses: actions/create-github-app-token@v1
        id: generate-token
        with:
          app-id: ${{ secrets.CDWR_ACTIONS_BOT_ID }}
          private-key: ${{ secrets.CDWR_ACTIONS_BOT_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build fly deployment action
        run: pnpm nx build nx-fly-deployment-action

      - name: Install Fly CLI
        uses: superfly/flyctl-actions/setup-flyctl@master
        with:
          version: ${{ vars.FLY_CLI_VERSION }}

      - name: Set SHAs for affected calculations
        uses: nrwl/nx-set-shas@v4
        with:
          main-branch-name: main
          set-environment-variables-for-job: true

      - name: Create Sentry release
        if: github.event.action != 'closed'
        uses: getsentry/action-release@v3
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.INF_SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.INF_SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.INF_SENTRY_PROJECT }}
        with:
          environment: ${{ needs.pre-deploy.outputs.environment }}
          release: ${{ github.sha }}
          set_commits: "auto"
          finalize: false

      - name: Run Deployment to Fly
        id: deployment
        uses: ./packages/nx-fly-deployment-action
        with:
          fly-api-token: ${{ secrets.FLY_API_TOKEN }}
          fly-org: ${{ vars.FLY_ORG }}
          fly-region: ${{ vars.FLY_REGION }}
          fly-trace-cli: ${{ vars.FLY_TRACE_CLI }}
          fly-console-logs: ${{ github.event.inputs.console-logs == 'true' && 'true' || vars.FLY_CONSOLE_LOGS }}
          token: ${{ steps.generate-token.outputs.token }}
          apps: ${{ needs.pre-deploy.outputs.apps }}
          environment: ${{ needs.pre-deploy.outputs.environment }}
          app-details: ${{ needs.pre-deploy.outputs.app-tenants }}
          # Build arguments for Docker build (client-side vars + Sentry source map upload)
          build-args: |
            NEXT_PUBLIC_DEPLOY_ENV=${{ needs.pre-deploy.outputs.environment }}
            NEXT_PUBLIC_SENTRY_DSN=${{ secrets.INF_SENTRY_DSN }}
            NEXT_PUBLIC_SENTRY_RELEASE=${{ github.sha }}
            SENTRY_ORG=${{ secrets.INF_SENTRY_ORG }}
            SENTRY_PROJECT=${{ secrets.INF_SENTRY_PROJECT }}
            SENTRY_RELEASE=${{ github.sha }}
            SENTRY_AUTH_TOKEN=${{ secrets.INF_SENTRY_AUTH_TOKEN }}
          # Runtime environment variables
          env: |
            INFISICAL_SITE=${{ vars.INFISICAL_SITE }}
            SENTRY_DSN=${{ secrets.INF_SENTRY_DSN }}
            SENTRY_ORG=${{ secrets.INF_SENTRY_ORG }}
            SENTRY_PROJECT=${{ secrets.INF_SENTRY_PROJECT }}
            SENTRY_RELEASE=${{ github.sha }}
          # Sensitive secrets are also passed to app env on deployment
          secrets: |
            INFISICAL_CLIENT_ID=${{ secrets.INFISICAL_READ_CLIENT_ID }}
            INFISICAL_CLIENT_SECRET=${{ secrets.INFISICAL_READ_CLIENT_SECRET }}
            INFISICAL_PROJECT_ID=${{ secrets.INFISICAL_PROJECT_ID }}
            SENTRY_AUTH_TOKEN=${{ secrets.INF_SENTRY_AUTH_TOKEN }}
          opt-out-depot-builder: ${{ vars.FLY_OPT_OUT_DEPOT }}
        env:
          # Postgres preview cluster defined in `github.json`
          POSTGRES_PREVIEW: ${{ vars.FLY_POSTGRES_PREVIEW }}

      - name: Finalize Sentry release
        if: github.event.action != 'closed' && success()
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.INF_SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: ${{ secrets.INF_SENTRY_ORG }}
          SENTRY_PROJECT: ${{ secrets.INF_SENTRY_PROJECT }}
        run: pnpm sentry-cli releases finalize "${{ github.sha }}"

  summary:
    needs: [analyze-conditions, pre-deploy, fly-deployment]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Deployment Summary
        env:
          SKIPPED: ${{ needs.analyze-conditions.outputs.skip }}
          ENVIRONMENT: ${{ needs.pre-deploy.outputs.environment }}
          DEPLOY_RESULT: ${{ needs.fly-deployment.result }}
          IS_CLOSED_PR: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }}
          IS_MANUAL: ${{ github.event_name == 'workflow_dispatch' }}
          MANUAL_APP: ${{ github.event.inputs.app }}
          MANUAL_TENANT: ${{ github.event.inputs.tenant }}
          CONSOLE_LOGS: ${{ github.event.inputs.console-logs }}
        run: |
          if [ "$IS_MANUAL" = "true" ]; then
            echo "🔧 Manual deployment triggered" >> $GITHUB_STEP_SUMMARY
            [ -n "$MANUAL_APP" ] && echo "  - App: $MANUAL_APP" >> $GITHUB_STEP_SUMMARY
            [ -n "$MANUAL_TENANT" ] && echo "  - Tenant: $MANUAL_TENANT" >> $GITHUB_STEP_SUMMARY
            echo "  - Environment: $ENVIRONMENT" >> $GITHUB_STEP_SUMMARY
            [ "$CONSOLE_LOGS" = "true" ] && echo "  - Console logs: enabled" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
          fi

          if [ "$IS_CLOSED_PR" = "true" ]; then
            echo "🚪 PR closed - running cleanup deployment" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
          fi

          if [ "$SKIPPED" = "true" ]; then
            echo "⏭️ Deployment skipped - conditions not met" >> $GITHUB_STEP_SUMMARY
            exit 0
          elif [ "$ENVIRONMENT" = "" ]; then
            echo "⏭️ No affected apps" >> $GITHUB_STEP_SUMMARY
            exit 0
          elif [ "$DEPLOY_RESULT" = "success" ]; then
            echo "✅ Deployment completed successfully" >> $GITHUB_STEP_SUMMARY
          elif [ "$DEPLOY_RESULT" = "skipped" ]; then
            echo "⏭️ No apps to deploy" >> $GITHUB_STEP_SUMMARY
            exit 0
          else
            echo "❌ Deployment failed or was cancelled" >> $GITHUB_STEP_SUMMARY
            exit 1
          fi