name: Deploy Rapids release

run-name: Deploy Rapids ${{ inputs.infra_sha }}

on:
  workflow_dispatch:
    inputs:
      infra_sha:
        description: "Full infra main commit containing the Rapids candidate"
        required: true
        type: string

permissions:
  contents: read

concurrency:
  group: rapids-release-deploy
  cancel-in-progress: false

jobs:
  deploy:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    environment: toolshed
    permissions:
      contents: read
      id-token: write
    env:
      INFRA_SHA: ${{ inputs.infra_sha }}
      # The validator requires a clean checkout, including untracked files.
      PYTHONDONTWRITEBYTECODE: "1"
    steps:
      - name: 🔎 Validate the infra revision
        id: validate-input
        run: |
          if [[ ! "$INFRA_SHA" =~ ^[0-9a-f]{40}$ ]]; then
            echo '::error::infra_sha must be a full lowercase commit SHA.'
            exit 1
          fi

      - name: 🔑 Create a read-only release evidence token
        id: reader
        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        with:
          app-id: ${{ vars.RAPIDS_APP_ID }}
          private-key: ${{ secrets.RAPIDS_APP_PRIVATE_KEY }}
          owner: commonfabric
          repositories: infra,loom,labs,commonfabric-weaver,gvisor
          permission-contents: read
          permission-actions: read

      # Establish trust before executing any code from the requested checkout.
      - name: 🔎 Verify the infra commit belongs to main
        id: validate-ancestry
        env:
          GH_TOKEN: ${{ steps.reader.outputs.token }}
        run: |
          status=$(gh api "repos/commonfabric/infra/compare/$INFRA_SHA...main" --jq .status)
          case "$status" in
            ahead|identical) ;;
            *) echo '::error::The infra commit is not an ancestor of main.'; exit 1 ;;
          esac

      - name: 📥 Checkout the exact infra candidate commit
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: commonfabric/infra
          ref: ${{ inputs.infra_sha }}
          token: ${{ steps.reader.outputs.token }}
          path: infra
          fetch-depth: 0
          persist-credentials: false

      - name: 📦 Install candidate validation dependencies
        run: python3 -m pip install 'jsonschema[format]==4.23.0'

      - name: 🔑 Authenticate read-only artifact access
        id: artifacts
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: ${{ vars.RAPIDS_ARTIFACT_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ vars.RAPIDS_ARTIFACT_SERVICE_ACCOUNT }}
          token_format: access_token
          create_credentials_file: false

      - name: 🔎 Validate the candidate and producer evidence
        working-directory: infra
        env:
          GH_TOKEN: ${{ steps.reader.outputs.token }}
          RAPIDS_ARTIFACT_ACCESS_TOKEN: ${{ steps.artifacts.outputs.access_token }}
        run: python3 releases/rapids_deploy.py "$INFRA_SHA" --validate-only

      - name: 🚀 Deploy the coordinated Rapids candidate
        id: deploy
        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
        env:
          GH_TOKEN: ${{ steps.reader.outputs.token }}
        with:
          host: ${{ secrets.BASTION_HOST }}
          username: bastion
          key: ${{ secrets.BASTION_SSH_PRIVATE_KEY }}
          command_timeout: 45m
          envs: GH_TOKEN,INFRA_SHA,GITHUB_SHA,GITHUB_REPOSITORY,GITHUB_RUN_ID,GITHUB_RUN_ATTEMPT
          script: /opt/cf/deploy-rapids.sh "$INFRA_SHA"
          capture_stdout: true

      - name: 🔎 Validate and save the deployment receipt
        working-directory: infra
        env:
          GH_TOKEN: ${{ steps.reader.outputs.token }}
          RAPIDS_REMOTE_OUTPUT: ${{ steps.deploy.outputs.stdout }}
        run: python3 releases/rapids_deploy.py "$INFRA_SHA" --save-receipt "$RUNNER_TEMP/receipt.json"

      - name: 📤 Upload verified deployment proof
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: rapids-deployment-${{ github.run_id }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/receipt.json
          if-no-files-found: error
          retention-days: 90