ermnvldmr.com/.github/workflows/services-www-releases-dispatch-release.yml

name: services/www - releases/dispatch-release

on:
  workflow_dispatch:
    inputs:
      skip_ci:
        description: 'Skip CI checks (fast build, push & GitOps deploy)'
        type: boolean
        required: false
        default: false

permissions:
  contents: read
  actions: read

jobs:
  setup-stage:
    name: Setup - Stage
    if: ${{ !inputs.skip_ci }}
    runs-on: ubuntu-latest
    outputs:
      cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3

      - name: Setup Node.js with pnpm cache
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - name: Cache pnpm store
        id: cache-pnpm-store
        uses: actions/cache@v3
        with:
          path: ~/.pnpm-store
          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

  build-configs:
    name: Build - Configs
    needs: setup-stage
    if: ${{ !inputs.skip_ci }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Build Rsbuild config
        run: pnpm --filter @ermnvldmr/rsbuild-config build
      - name: Build Storybook config
        run: pnpm --filter @ermnvldmr/storybook-config build
      - name: Build i18n
        run: pnpm --filter @ermnvldmr/i18n build
      - name: Upload Config Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: config-artifacts
          path: |
            packages/rsbuild-config/dist
            packages/storybook-config/dist
            packages/i18n/dist
          retention-days: 1

  lint-www:
    name: Lint - WWW
    needs: build-configs
    if: ${{ !inputs.skip_ci }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Config Artifacts
        uses: actions/download-artifact@v4
        with:
          name: config-artifacts
          path: packages
      - name: Lint WWW service
        run: pnpm --filter @ermnvldmr/www lint

  typecheck-www:
    name: Typecheck - WWW
    needs: build-configs
    if: ${{ !inputs.skip_ci }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Config Artifacts
        uses: actions/download-artifact@v4
        with:
          name: config-artifacts
          path: packages
      - name: Typecheck WWW service
        run: pnpm --filter @ermnvldmr/www typecheck

  build-storybook:
    name: Build - Storybook
    needs: build-configs
    if: ${{ !inputs.skip_ci }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Config Artifacts
        uses: actions/download-artifact@v4
        with:
          name: config-artifacts
          path: packages
      - name: Build WWW Storybook
        run: pnpm --filter @ermnvldmr/www build-storybook
      - name: Upload Storybook build
        uses: actions/upload-artifact@v4
        with:
          name: storybook-static
          path: services/www/storybook-static/
          retention-days: 1

  test-www:
    name: Test - Unit
    needs: build-configs
    if: ${{ !inputs.skip_ci }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Config Artifacts
        uses: actions/download-artifact@v4
        with:
          name: config-artifacts
          path: packages
      - name: Test WWW service
        run: pnpm --filter @ermnvldmr/www test:coverage

  test-storybook:
    name: Test - Storybook
    needs: build-storybook
    if: ${{ !inputs.skip_ci }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Config Artifacts
        uses: actions/download-artifact@v4
        with:
          name: config-artifacts
          path: packages
      - name: Install Playwright browsers
        run: pnpm --filter @ermnvldmr/www exec playwright install --with-deps chromium
      - name: Download Storybook build
        uses: actions/download-artifact@v4
        with:
          name: storybook-static
          path: services/www/storybook-static/
      - name: Serve Storybook and run tests
        run: pnpm --filter @ermnvldmr/www test:storybook:ci

  build-www:
    name: Build - WWW Service
    needs: build-configs
    if: ${{ !inputs.skip_ci }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9.12.3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Download Config Artifacts
        uses: actions/download-artifact@v4
        with:
          name: config-artifacts
          path: packages
      - name: Build WWW service
        run: pnpm --filter @ermnvldmr/www build

  release-tag-docker:
    name: Release - Tag & Docker
    needs: [lint-www, typecheck-www, test-www, test-storybook, build-www]
    if: ${{ always() && (inputs.skip_ci || (!contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled'))) }}
    runs-on: ubuntu-latest
    environment: services-www-releases-publish
    permissions:
      contents: write
      packages: write
    outputs:
      version: ${{ steps.version.outputs.version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Calculate Release Version
        id: version
        run: |
          RELEASE_VERSION=$(bash ci/scripts/semantic-release.sh release ${{ github.ref_name }})
          # Extract MAJOR.MINOR for tagging
          MAJOR_MINOR=$(echo "${{ github.ref_name }}" | cut -d/ -f3 | sed 's/^v//')
          MAJOR=$(echo "$MAJOR_MINOR" | cut -d. -f1)
          echo "version=$RELEASE_VERSION" >> $GITHUB_OUTPUT
          echo "major_minor=$MAJOR_MINOR" >> $GITHUB_OUTPUT
          echo "major=$MAJOR" >> $GITHUB_OUTPUT

      - name: Create and Push Tag
        run: |
          TAG_NAME="releases/www/v${{ steps.version.outputs.version }}"
          git tag $TAG_NAME
          git push origin $TAG_NAME

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}/www
          tags: |
            type=raw,value=v${{ steps.version.outputs.version }}
            type=raw,value=v${{ steps.version.outputs.major_minor }}
            type=raw,value=v${{ steps.version.outputs.major }}
            type=raw,value=latest
            type=sha,format=short

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ci/docker/www/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            COMMIT_SHA=sha-$(echo ${{ github.sha }} | cut -c1-7)
            VERSION=v${{ steps.version.outputs.version }}

  deploy:
    name: Deploy - Kubernetes (GitOps)
    needs: release-tag-docker
    runs-on: ubuntu-latest
    environment:
      name: services-www-releases-deploy
      url: https://ermnvldmr.com
    permissions:
      contents: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: next
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Kustomize
        uses: imranismail/setup-kustomize@v2
        with:
          kustomize-version: "5.3.0"

      - name: Deploy via GitOps
        run: |
          WWW_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
          bash ci/scripts/deploy-gitops.sh www "${WWW_TAG}"

  verify-rollout:
    name: Verify - Production Rollout
    needs: [release-tag-docker, deploy]
    runs-on: ubuntu-latest
    steps:
      - name: Await production rollout
        run: |
          TARGET_COMMIT="sha-$(echo ${{ github.sha }} | cut -c1-7)"
          TARGET_VERSION="v${{ needs.release-tag-docker.outputs.version }}"
          ENDPOINT="https://www.ermnvldmr.com/version.json"

          echo "========================================================"
          echo "Verifying production deployment on $ENDPOINT"
          echo "Expected commit:  $TARGET_COMMIT"
          echo "Expected version: $TARGET_VERSION"
          echo "========================================================"

          MAX_ATTEMPTS=30
          ATTEMPT=1

          while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
            echo "Attempt $ATTEMPT/$MAX_ATTEMPTS: Polling $ENDPOINT..."

            RESPONSE=$(curl -sf --max-time 10 "$ENDPOINT" 2>/dev/null || true)

            if [ -n "$RESPONSE" ]; then
              LIVE_COMMIT=$(echo "$RESPONSE" | jq -r '.commit // empty')
              LIVE_VERSION=$(echo "$RESPONSE" | jq -r '.version // empty')

              echo "  Live commit:  ${LIVE_COMMIT:-<none>}"
              echo "  Live version: ${LIVE_VERSION:-<none>}"

              if [ "$LIVE_COMMIT" = "$TARGET_COMMIT" ] || [ "$LIVE_VERSION" = "$TARGET_VERSION" ]; then
                echo "✅ Success! Production has successfully rolled out $TARGET_VERSION ($TARGET_COMMIT)."
                exit 0
              fi
            else
              echo "  Endpoint did not return valid JSON or timed out."
            fi

            ATTEMPT=$((ATTEMPT + 1))
            sleep 10
          done

          echo "❌ Deployment verification timed out after 5 minutes."
          exit 1