docs/.github/workflows/prod-build-deploy-azure.yml

name: Production (Azure) - Build and Deploy

# **What it does**: Builds and deploys the default branch to production
# **Why we have it**: To enable us to deploy the latest to production whenever necessary rather than relying on PR merges.
# **Who does it impact**: All contributors.

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read
  deployments: write

# This allows a subsequently queued workflow run to take priority over
# previously queued runs but NOT interrupt currently executing runs
concurrency:
  group: '${{ github.workflow }}'
  cancel-in-progress: false

jobs:
  build-and-deploy:
    if: ${{ github.repository == 'github/docs-internal' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      DOCKER_IMAGE: ${{ secrets.PROD_REGISTRY_SERVER }}/${{ github.repository }}:${{ github.sha }}

    steps:
      - name: 'Az CLI login'
        uses: azure/login@66d2e78565ab7af265d2b627085bc34c73ce6abb
        with:
          creds: ${{ secrets.PROD_AZURE_CREDENTIALS }}

      - name: 'Docker login'
        uses: azure/docker-login@81744f9799e7eaa418697cb168452a2882ae844a
        with:
          login-server: ${{ secrets.PROD_REGISTRY_SERVER }}
          username: ${{ secrets.PROD_REGISTRY_USERNAME }}
          password: ${{ secrets.PROD_REGISTRY_PASSWORD }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25

      - name: Check out repo
        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
        with:
          ref: ${{ github.sha }}
          # To prevent issues with cloning early access content later
          persist-credentials: 'false'
          lfs: 'true'

      - name: Check out LFS objects
        run: git lfs checkout

      - name: Setup node
        uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561
        with:
          node-version: 16.13.x
          cache: npm

      - name: Clone early access
        run: npm install dotenv && node script/early-access/clone-for-build.js
        env:
          DOCUBOT_REPO_PAT: ${{ secrets.DOCUBOT_REPO_PAT }}
          GIT_BRANCH: main

      - name: 'Build and push image'
        uses: docker/build-push-action@a66e35b9cbcf4ad0ea91ffcaf7bbad63ad9e0229
        with:
          context: .
          push: true
          target: 'production_early_access'
          tags: ${{ env.DOCKER_IMAGE }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: 'Update docker-compose.prod.yaml template file'
        run: |
          sed 's|#{IMAGE}#|${DOCKER_IMAGE}|g' docker-compose.prod.tmpl.yaml > docker-compose.prod.yaml

      - name: 'Apply updated docker-compose.prod.yaml config to preview slot'
        run: |
          az webapp config container set --multicontainer-config-type COMPOSE --multicontainer-config-file docker-compose.prod.yaml --slot preview -n ghdocs-prod -g docs-prod

      # Watch preview slot instances to see when all the instances are ready
      - name: Check that preview slot is ready
        uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d
        env:
          CHECK_INTERVAL: 10000
        with:
          script: |
            import { execSync } from 'child_process'

            const getStatesForSlot = (slot) => {
              return JSON.parse(
                execSync(
                  `az webapp list-instances --slot ${slot} --query "[].state" -n ghdocs-prod -g docs-prod`,
                  { encoding: 'utf8' }
                )
              )
            }

            let hasStopped = false
            const waitDuration = parseInt(process.env.CHECK_INTERVAL, 10) || 10000
            async function doCheck() {
              const states = getStatesForSlot('preview')
              console.log(`Instance states:`, states)

              // We must wait until at-least 1 instance has STOPPED to know we're looking at the "next" deployment and not the "previous" one
              // That way we don't immediately succeed just because all the previous instances were READY
              if (!hasStopped) {
                hasStopped = states.some((s) => s === 'STOPPED')
              }

              const isAllReady = states.every((s) => s === 'READY')

              if (hasStopped && isAllReady) {
                process.exit(0) // success
              }

              console.log(`checking again in ${waitDuration}ms`)
              setTimeout(doCheck, waitDuration)
            }

            doCheck()

      # TODO - make a request to verify the preview app version aligns with *this* github action workflow commit sha
      - name: 'Swap preview slot to production'
        run: |
          az webapp deployment slot swap --slot preview --target-slot production -n ghdocs-prod -g docs-prod

      # TODO - enable this when we disable the other production deploy
      # - name: Purge Fastly edge cache
      #   env:
      #     FASTLY_TOKEN: ${{ secrets.FASTLY_TOKEN }}
      #     FASTLY_SERVICE_ID: ${{ secrets.FASTLY_SERVICE_ID }}
      #     FASTLY_SURROGATE_KEY: 'every-deployment'
      #   run: npm install got && .github/actions-scripts/purge-fastly-edge-cache.js

      - name: Send Slack notification if workflow failed
        uses: someimportantcompany/github-actions-slack-message@f8d28715e7b8a4717047d23f48c39827cacad340
        if: ${{ failure() }}
        with:
          channel: ${{ secrets.DOCS_ALERTS_SLACK_CHANNEL_ID }}
          bot-token: ${{ secrets.SLACK_DOCS_BOT_TOKEN }}
          color: failure
          text: Production deployment (Azure) failed at commit ${{ github.sha }}. See https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}