deploy.yml

name: Deploy to CloudFront

on:
  push:
    branches: [main, staging]  # main → prod, staging → staging
    paths:
      - 'apps/**'
      - 'packages/**'
  workflow_dispatch:
    inputs:
      apps:
        description: 'Comma-separated list of apps to deploy (leave empty for changed apps only)'
        required: false
        type: string

permissions:
  id-token: write
  contents: read

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      apps: ${{ steps.set-apps.outputs.apps }}
      environment: ${{ steps.set-env.outputs.environment }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Determine environment
        id: set-env
        run: |
          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
            echo "environment=prod" >> $GITHUB_OUTPUT
          else
            echo "environment=staging" >> $GITHUB_OUTPUT
          fi

      - name: Detect changed apps
        id: detect
        run: |
          chmod +x ./infrastructure/scripts/detect-changed-apps.sh
          CHANGED_APPS=$(./infrastructure/scripts/detect-changed-apps.sh)
          echo "changed_apps=$CHANGED_APPS" >> $GITHUB_OUTPUT

      - name: Set apps to deploy
        id: set-apps
        run: |
          # Use manual input if provided, otherwise use detected changes
          if [[ -n "${{ github.event.inputs.apps }}" ]]; then
            # Convert comma-separated string to JSON array (compact single-line format)
            APPS_INPUT="${{ github.event.inputs.apps }}"
            APPS_JSON=$(echo "$APPS_INPUT" | jq -Rc 'split(",") | map(gsub("^\\s+|\\s+$";""))')
            echo "apps=$APPS_JSON" >> $GITHUB_OUTPUT
            echo "Deploying manually specified apps: $APPS_JSON"
          else
            # Pass the JSON directly without expansion issues
            APPS='${{ steps.detect.outputs.changed_apps }}'
            echo "apps=$APPS" >> $GITHUB_OUTPUT
            echo "Deploying changed apps: $APPS"
          fi

  build-and-deploy:
    needs: detect-changes
    if: needs.detect-changes.outputs.apps != '[]' && needs.detect-changes.outputs.apps != ''
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        app: ${{ fromJson(needs.detect-changes.outputs.apps) }}

    steps:
      - name: Debug matrix
        run: |
          echo "Matrix app: ${{ matrix.app }}"
          echo "Apps output: ${{ needs.detect-changes.outputs.apps }}"
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 9.9.0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Determine app path
        id: app-config
        run: |
          APP="${{ matrix.app }}"
          ENV="${{ needs.detect-changes.outputs.environment }}"
          
          # Map app names to their build paths
          # NOTE: Bucket names use pattern: scottjhetrick-${app}-v3-${env}
          case $APP in
            "portfolio")
              DIST_PATH="apps/portfolio/frontend/dist"
              BUCKET_NAME="scottjhetrick-portfolio-v3-$ENV"
              ;;
            "shareme")
              DIST_PATH="apps/shareme/frontend/dist"
              BUCKET_NAME="scottjhetrick-shareme-v3-$ENV"
              ;;
            "su-done-ku")
              DIST_PATH="apps/su-done-ku/frontend/dist"
              BUCKET_NAME="scottjhetrick-su-done-ku-v3-$ENV"
              ;;
            "dread-ui")
              DIST_PATH="packages/dread-ui/dist"
              BUCKET_NAME="scottjhetrick-dread-ui-v3-$ENV"
              ;;
            *)
              DIST_PATH="apps/$APP/dist"
              BUCKET_NAME="scottjhetrick-$APP-v3-$ENV"
              ;;
          esac
          
          echo "dist_path=$DIST_PATH" >> $GITHUB_OUTPUT
          echo "bucket_name=$BUCKET_NAME" >> $GITHUB_OUTPUT
          echo "environment=$ENV" >> $GITHUB_OUTPUT

      - name: Build app
        run: |
          # Map app names to package names (some apps have -frontend suffix)
          case "${{ matrix.app }}" in
            "portfolio")
              pnpm build --filter=portfolio-frontend
              ;;
            "shareme")
              pnpm build --filter=shareme-frontend
              ;;
            *)
              pnpm build --filter=${{ matrix.app }}
              ;;
          esac
        env:
          VITE_GIPHY_API_KEY: ${{ secrets.VITE_GIPHY_API_KEY }}
          VITE_FIREBASE_API_KEY: ${{ secrets.VITE_FIREBASE_API_KEY }}
          VITE_FIREBASE_AUTH_DOMAIN: ${{ secrets.VITE_FIREBASE_AUTH_DOMAIN }}
          VITE_FIREBASE_PROJECT_ID: ${{ secrets.VITE_FIREBASE_PROJECT_ID }}
          VITE_FIREBASE_STORAGE_BUCKET: ${{ secrets.VITE_FIREBASE_STORAGE_BUCKET }}
          VITE_FIREBASE_MESSAGING_SENDER_ID: ${{ secrets.VITE_FIREBASE_MESSAGING_SENDER_ID }}
          VITE_FIREBASE_APP_ID: ${{ secrets.VITE_FIREBASE_APP_ID }}
          VITE_VERCEL_TOKEN: ${{ secrets.VITE_VERCEL_TOKEN }}
          VITE_SUDOKU_API_URL: ${{ secrets.VITE_SUDOKU_API_URL }}
          VITE_REACT_APP_SANITY_PROJECT_ID: ${{ secrets.VITE_REACT_APP_SANITY_PROJECT_ID }}
          VITE_REACT_APP_SANITY_TOKEN: ${{ secrets.VITE_REACT_APP_SANITY_TOKEN }}
          VITE_REACT_APP_GOOGLE_API_TOKEN: ${{ secrets.VITE_REACT_APP_GOOGLE_API_TOKEN }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Sync to S3
        run: |
          # Upload all files except HTML files with long cache
          aws s3 sync ${{ steps.app-config.outputs.dist_path }} \
            s3://${{ steps.app-config.outputs.bucket_name }}/ \
            --delete \
            --cache-control "public, max-age=31536000, immutable" \
            --exclude "*.html"
          
          # Upload HTML files with no cache (for immediate updates)
          # This includes index.html and iframe.html (for Storybook apps like dread-ui)
          aws s3 sync ${{ steps.app-config.outputs.dist_path }} \
            s3://${{ steps.app-config.outputs.bucket_name }}/ \
            --cache-control "public, max-age=0, must-revalidate" \
            --exclude "*" \
            --include "*.html"

      - name: Invalidate CloudFront
        run: |
          if [[ "${{ steps.app-config.outputs.environment }}" == "prod" ]]; then
            DISTRIBUTION_ID="${{ secrets.PROD_CLOUDFRONT_ID }}"
            DOMAIN="scottjhetrick.com"
          else
            DISTRIBUTION_ID="${{ secrets.STAGING_CLOUDFRONT_ID }}"
            DOMAIN="staging.scottjhetrick.com"
          fi
          
          # Determine invalidation path
          if [[ "${{ matrix.app }}" == "portfolio" || "${{ matrix.app }}" == "camera-tricks-demo" ]]; then
            # Portfolio and camera-tricks-demo are at root
            INVALIDATION_PATH="/*"
          else
            # Map app name to URL path
            case "${{ matrix.app }}" in
              "home-page")
                INVALIDATION_PATH="/home/*"
                ;;
              *)
                INVALIDATION_PATH="/${{ matrix.app }}/*"
                ;;
            esac
          fi
          
          aws cloudfront create-invalidation \
            --distribution-id $DISTRIBUTION_ID \
            --paths "$INVALIDATION_PATH"
          
          echo "✅ Deployed ${{ matrix.app }} to ${{ steps.app-config.outputs.environment }}"
          echo "🔗 URL: https://$DOMAIN$INVALIDATION_PATH"

      - name: Comment on commit (optional)
        if: github.event_name == 'push'
        run: |
          echo "Deployed ${{ matrix.app }} to ${{ steps.app-config.outputs.environment }}"

  summary:
    needs: [detect-changes, build-and-deploy]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Deployment summary
        run: |
          echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Environment:** ${{ needs.detect-changes.outputs.environment }}" >> $GITHUB_STEP_SUMMARY
          echo "**Apps deployed:** ${{ needs.detect-changes.outputs.apps }}" >> $GITHUB_STEP_SUMMARY
          echo "**Status:** ${{ needs.build-and-deploy.result }}" >> $GITHUB_STEP_SUMMARY