cd.yml

name: CD
run-name: ${{ inputs.model }} CD
# NOTE: This workflow requires:
# permissions.contents:write
# secrets:inherit with an appropriate GitHub Environment for deployment in the caller
on:
  workflow_call:
    inputs:
      model:
        type: string
        required: true
        description: The model that is being tested and deployed
      root-sbd:
        type: string
        required: false
        # default: The ${{ inputs.model }} above
        description: |
          The name of the root Spack Bundle Definition, if it is different from the model name.
          This is often a package named similarly in ACCESS-NRI/spack-packages.
  # Callers usually have the trigger:
  # push:
  #   branches:
  #     - main
  #     - backport/*.*
  #   paths:
  #     - config/**
  #     - spack.yaml

env:
  METADATA_PATH: /opt/metadata
  OUTPUTS_PATH: /opt/outputs
jobs:
  defaults:
    name: Set Defaults
    # Unfortunately, you can't set a dynamic default value based on `inputs` yet
    runs-on: ubuntu-latest
    outputs:
      root-sbd: ${{ steps.root-sbd.outputs.default }}
      targets: ${{ steps.target.outputs.valid-targets }}
    steps:
      - name: root-sbd
        id: root-sbd
        run: |
          if [ -z "${{ inputs.root-sbd }}" ]; then
            echo "default=${{ inputs.model }}" >> $GITHUB_OUTPUT
          else
            echo "default=${{ inputs.root-sbd }}" >> $GITHUB_OUTPUT
          fi

      - name: Generate Deployment Target Matrix
        id: target
        uses: access-nri/build-cd/.github/actions/get-target-matrix@v4
        with:
          targets: ${{ vars.RELEASE_DEPLOYMENT_TARGETS }}

  verify-settings:
    name: Verify Deployment Settings
    runs-on: ubuntu-latest
    needs:
      - defaults
    strategy:
      matrix:
        target: ${{ fromJson(needs.defaults.outputs.targets) }}
    steps:
      - uses: actions/checkout@v4
        with:
          repository: access-nri/build-cd

      - uses: access-nri/build-cd/.github/actions/validate-deployment-settings@v4
        with:
          settings-path: ./config/settings.json
          target: ${{ matrix.target }}
          error-level: error

  push-tag:
    name: Tag Deployment
    runs-on: ubuntu-latest
    needs:
      - verify-settings
    permissions:
      contents: write
    outputs:
      name: ${{ steps.tag.outputs.root-spec-ref }}
    steps:
      - uses: actions/checkout@v4

      - name: Get root spec ref
        id: tag
        uses: access-nri/build-cd/.github/actions/get-spack-root-spec@v4

      - name: Import Commit-Signing Key
        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4  # v6.1.0
        with:
          gpg_private_key: ${{ secrets.GH_ACTIONS_BOT_GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GH_ACTIONS_BOT_GPG_PASSPHRASE }}
          git_config_global: true
          git_committer_name: ${{ vars.GH_ACTIONS_BOT_GIT_USER_NAME }}
          git_committer_email: ${{ vars.GH_ACTIONS_BOT_GIT_USER_EMAIL }}
          git_user_signingkey: true
          git_commit_gpgsign: true
          git_tag_gpgsign: true

      - name: Push Tag
        env:
          TAG: ${{ steps.tag.outputs.root-spec-ref }}
        run: |
          if [[ "${{ env.TAG }}" == "latest" ]]; then
            echo "::error::The version 'latest' is reserved for a spack package that moves often and cannot be used as a release tag. Reset the 'main' or 'backport' branch, reopen the merged PR, and update the version."
            exit 1
          fi

          git tag ${{ env.TAG }} -m "Deployment of ${{ inputs.model }} ${{ env.TAG }} via build-cd 'cd.yml' workflow"
          git push --tags

  deploy-release:
    name: Deploy Release
    needs:
      - defaults
      - push-tag
    strategy:
      matrix:
        target: ${{ fromJson(needs.defaults.outputs.targets) }}
    uses: access-nri/build-cd/.github/workflows/deploy-1-setup.yml@v4
    with:
      deployment-target: ${{ matrix.target }}
      deployment-ref: ${{ github.ref_name }}
      deployment-type: Release
      deployment-version: ${{ needs.push-tag.outputs.name }}
      spack-manifest-path: ./spack.yaml
      spack-manifest-root-sbd: ${{ needs.defaults.outputs.root-sbd }}
    secrets: inherit
    permissions:
      contents: write
      # We require pull-requests:write despite not using it in this path,
      # because it is needed by the pull_request invocation of the workflow.
      pull-requests: write

  release:
    name: Create Release
    needs:
      - defaults
      - push-tag
      - deploy-release
    runs-on: ubuntu-latest
    env:
      TEMPLATED_RELEASE_BODY_PATH: /opt/release-body.md
    outputs:
      url: ${{ steps.release.outputs.url }}
      created-at: ${{ steps.metadata.outputs.created-at }}
    steps:
      - name: Checkout build-cd
        uses: actions/checkout@v4
        with:
          repository: access-nri/build-cd

      - name: Download Metadata Artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: ${{ needs.deploy-release.outputs.general-metadata-artifact-glob }}
          path: ${{ env.METADATA_PATH }}
          merge-multiple: true

      - name: Download Outputs Artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: ${{ needs.deploy-release.outputs.general-outputs-artifact-glob }}
          path: ${{ env.OUTPUTS_PATH }}
          merge-multiple: true

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.12
          cache: pip

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -q -q -r scripts/jinja_template/requirements.txt

      - name: Generate Release Notes
        id: release-body
        env:
          J2_MODEL: ${{ inputs.model }}
          J2_VERSION: ${{ needs.push-tag.outputs.name }}
          J2_ROOT_SBD: ${{ needs.defaults.outputs.root-sbd }}
        run: |
          python -m scripts.jinja_template.render_deployment_info \
            --template scripts/jinja_template/templates/release-body.md.j2 \
            --deployment-outputs ${{ env.OUTPUTS_PATH }} \
            --output ${{ env.TEMPLATED_RELEASE_BODY_PATH }}

      - name: Create Release
        id: release
        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87  # v2.0.5
        with:
          tag_name: ${{ needs.push-tag.outputs.name }}
          name: ${{ inputs.model}} ${{ needs.push-tag.outputs.name }}
          body_path: ${{ env.TEMPLATED_RELEASE_BODY_PATH }}
          generate_release_notes: true
          fail_on_unmatched_files: true
          files: |
            ${{ env.METADATA_PATH }}/*.spack.yaml
            ${{ env.METADATA_PATH }}/*.spack.lock
            ${{ env.METADATA_PATH }}/*.spack.location
            ${{ env.METADATA_PATH }}/*.spack.location.json

      - name: Release Metadata
        id: metadata
        env:
          GH_TOKEN: ${{ github.token }}
        run: echo "created-at=$(gh release view --json createdAt --jq '.createdAt' --repo ${{ github.repository }})" >> $GITHUB_OUTPUT

  # TODO: This will only upload data related to the Gadi deployment
  build-db:
    name: Build DB Metadata Upload
    needs:
      - defaults
      - deploy-release
      - release
    runs-on: ubuntu-latest
    steps:
      - name: Download Metadata Artifact
        uses: actions/download-artifact@v4
        with:
          pattern: ${{ needs.deploy-release.outputs.general-metadata-artifact-glob }}
          path: ${{ env.METADATA_PATH }}
          merge-multiple: true

      - name: Download Outputs Artifact
        uses: actions/download-artifact@v4
        with:
          pattern: ${{ needs.deploy-release.outputs.general-outputs-artifact-glob }}
          path: ${{ env.OUTPUTS_PATH }}
          merge-multiple: true

      - name: 'Get Gadi spack-* Repo Versions'
        id: spack-versions
        run: |
          echo "packages-version=$(jq --raw-output --compact-output '.spack_packages_version' ${{ env.OUTPUTS_PATH }}/deploy-outputs.Gadi)" >> $GITHUB_OUTPUT
          echo "config-version=$(jq --raw-output --compact-output '.spack_config_version' ${{ env.OUTPUTS_PATH }}/deploy-outputs.Gadi)" >> $GITHUB_OUTPUT

      - name: Checkout Upload Script
        uses: actions/checkout@v4
        with:
          repository: access-nri/build-cd

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ vars.PYTHON_VERSION }}
          cache: pip

      - name: Install Build Metadata Script Requirements
        run: pip install -r tools/release_provenance/requirements.txt

      - name: Upload Build Metadata
        env:
          BUILD_DB_CONNECTION_STR: ${{ secrets.BUILD_DB_CONNECTION_STR }}
        run: |
          ./scripts/generate-build-metadata.bash \
            ${{ needs.release.outputs.url }} ${{ needs.release.outputs.created-at }} \
            ${{ steps.spack-versions.outputs.packages-version }} ${{ steps.spack-versions.outputs.config-version }} \
            ${{ env.METADATA_PATH }} ${{ env.OUTPUTS_PATH }} \
            ${{ needs.defaults.outputs.root-sbd }} ${{ vars.BUILD_DB_PACKAGES }}

          echo "Attempting upload of build_metadata.json"
          python ./tools/release_provenance/save_release.py "${{ env.OUTPUTS_PATH }}/build_metadata.json"