cd.yml

name: CD Pipeline

on:
  push:
    branches: [ "main" ]

env:
  AWS_REGION: us-east-2
  GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
  ECR_REPOSITORY: devops-backend
  GCR_REPOSITORY: devops-backend

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write 
    
    steps:
    - uses: actions/checkout@v4

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: ${{ env.AWS_REGION }}

    - name: Login to Amazon ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v2

    - name: Create ECR repositories if missing
      run: |
        aws ecr describe-repositories --repository-names devops-backend || aws ecr create-repository --repository-name devops-backend
        aws ecr describe-repositories --repository-names devops-frontend || aws ecr create-repository --repository-name devops-frontend

    - name: Build and push Backend to ECR
      if: steps.login-ecr.outcome == 'success'
      uses: docker/build-push-action@v5
      with:
        context: ./backend
        push: true
        tags: |
          ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ github.sha }}
          ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:latest

    - name: Build and push Frontend to ECR
      if: steps.login-ecr.outcome == 'success'
      uses: docker/build-push-action@v5
      with:
        context: ./frontend
        push: true
        tags: |
          ${{ steps.login-ecr.outputs.registry }}/devops-frontend:${{ github.sha }}
          ${{ steps.login-ecr.outputs.registry }}/devops-frontend:latest

    - name: Google Auth
      uses: google-github-actions/auth@v2
      with:
        credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
      continue-on-error: true

    - name: Set up Cloud SDK
      uses: google-github-actions/setup-gcloud@v2
      continue-on-error: true

    - name: Enable GCP Services
      run: gcloud services enable artifactregistry.googleapis.com compute.googleapis.com secretmanager.googleapis.com run.googleapis.com
      continue-on-error: true

    - name: Configure Docker for GCP
      run: gcloud auth configure-docker
      continue-on-error: true

    - name: Build and push Backend to GCR
      if: env.GCP_PROJECT_ID != ''
      uses: docker/build-push-action@v5
      with:
        context: ./backend
        push: true
        tags: |
          gcr.io/${{ env.GCP_PROJECT_ID }}/${{ env.GCR_REPOSITORY }}:${{ github.sha }}
          gcr.io/${{ env.GCP_PROJECT_ID }}/${{ env.GCR_REPOSITORY }}:latest

    - name: Build and push Frontend to GCR
      if: env.GCP_PROJECT_ID != ''
      uses: docker/build-push-action@v5
      with:
        context: ./frontend
        push: true
        tags: |
          gcr.io/${{ env.GCP_PROJECT_ID }}/devops-frontend:${{ github.sha }}
          gcr.io/${{ env.GCP_PROJECT_ID }}/devops-frontend:latest

  deploy-terraform:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Google Auth
        uses: google-github-actions/auth@v2
        with:
          credentials_json: '${{ secrets.GCP_CREDENTIALS }}'

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Create State Bucket
        run: |
          gcloud storage buckets create gs://devops-assignment-tf-state --location=us-central1 2>/dev/null || echo "Bucket already exists"

      - name: Terraform Init GCP
        run: |
          cd terraform/gcp
          terraform init
        env:
          GOOGLE_CREDENTIALS: ${{ secrets.GCP_CREDENTIALS }}
          
      - name: Terraform Apply GCP
        run: |
          cd terraform/gcp
          terraform apply -auto-approve
        env:
          TF_VAR_project_id: ${{ secrets.GCP_PROJECT_ID }}
          TF_VAR_alert_email: ${{ secrets.ALERT_EMAIL }}
          TF_VAR_database_secret: ${{ secrets.DATABASE_SECRET }}
          GOOGLE_CREDENTIALS: ${{ secrets.GCP_CREDENTIALS }}

      - name: Force Redeploy Cloud Run Services
        run: |
          gcloud run services update-traffic devops-frontend-v5 --to-revisions LATEST=100 --region us-central1 --project ${{ secrets.GCP_PROJECT_ID }}
          gcloud run services update-traffic devops-backend-v5 --to-revisions LATEST=100 --region us-central1 --project ${{ secrets.GCP_PROJECT_ID }}
        env:
          GOOGLE_CREDENTIALS: ${{ secrets.GCP_CREDENTIALS }}
        continue-on-error: true

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Create AWS State Bucket
        run: |
          aws s3api create-bucket --bucket devops-assignment-tf-state-aws --region us-east-2 --create-bucket-configuration LocationConstraint=us-east-2 2>/dev/null || echo "Bucket already exists"


      - name: Terraform Init AWS
        run: |
          cd terraform/aws
          terraform init
          
      - name: Force Redeploy ECS Services
        run: |
          aws ecs update-service --cluster devops-cluster --service devops-frontend-service-v2 --force-new-deployment --region ${{ env.AWS_REGION }}
          aws ecs update-service --cluster devops-cluster --service devops-backend-service-v2 --force-new-deployment --region ${{ env.AWS_REGION }}
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: ${{ env.AWS_REGION }}
          
      - name: Terraform Apply AWS
        run: |
          cd terraform/aws
          terraform apply -auto-approve
        env:
          TF_VAR_aws_region: ${{ env.AWS_REGION }}
          TF_VAR_ecr_repository_url: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com
          TF_VAR_db_password: ${{ secrets.DB_PASSWORD }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}