name: Deploy to Production

on:
  # when a workflow was triggered manually
  workflow_dispatch:
    inputs:
      version:
        description: 'Commit hash to deploy'
        required: true

  # when a workflow was triggered from another workflow
  workflow_call:
    inputs:
      sha:
        required: true
        description: 'Commit hash to deploy'
        type: string
    secrets:
      TOPTAL_DEVBOT_TOKEN:
        required: true
      TOPTAL_BOT_JENKINS_DEPLOYMENT_TOKEN:
        required: true
      HTTP_PROXY:
        required: true

concurrency: deploy-to-production

env:
  GITHUB_TOKEN: ${{ secrets.TOPTAL_DEVBOT_TOKEN }}
  REPOSITORY_NAME: ${{ github.event.repository.name }}
  JENKINS_USER: toptal-bot
  JENKINS_DEPLOY_TOKEN: ${{ secrets.TOPTAL_BOT_JENKINS_DEPLOYMENT_TOKEN }}

jobs:
  check-event:
    name: Check Event
    timeout-minutes: 5
    runs-on: ubuntu-latest
    if: >
      (
        github.event_name == 'workflow_dispatch' && github.event.inputs.version
      ) || (
        inputs.sha
      )
    outputs:
      sha: ${{ steps.specify-sha.outputs.result }}
    steps:
      - id: specify-sha
        uses: toptal/davinci-github-actions/get-workflow-sha@v20.0.0

  trigger-deployment:
    name: Trigger deployment
    timeout-minutes: 10
    runs-on: ubuntu-latest
    needs: [check-event]
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          token: ${{ env.GITHUB_TOKEN }}
          ref: ${{ needs.check-event.outputs.sha }}

      - name: GSM Secrets
        id: secrets_manager
        uses: toptal/actions/gsm-secrets@main
        with:
          workload_identity_provider: projects/858873486241/locations/global/workloadIdentityPools/gha-pool/providers/github-com
          service_account: gha-davinci@toptal-ci.iam.gserviceaccount.com
          secrets_name: |-
            JENKINS_DEPLOYMENT_CLIENT_ID:toptal-ci/JENKINS_CLIENT_ID
            JENKINS_DEPLOYMENT_URL:toptal-ci/JENKINS_URL
            JENKINS_SA_CREDENTIALS:toptal-ci/JENKINS_SA_CREDENTIALS
            TOPTAL_BOT_JENKINS_API_TOKEN:toptal-ci/TOPTAL_BOT_JENKINS_API_TOKEN
            TOPTAL_BOT_USERNAME:toptal-ci/TOPTAL_BOT_USERNAME

      - name: Parse secrets
        id: parse_secrets
        uses: toptal/actions/expose-json-outputs@main
        with:
          json: ${{ steps.secrets_manager.outputs.secrets }}

      - name: Trigger deployment job
        uses: toptal/actions/trigger-jenkins-job@main
        with:
          jenkins_url: ${{ steps.parse_secrets.outputs.JENKINS_DEPLOYMENT_URL }}
          jenkins_user: ${{ steps.parse_secrets.outputs.TOPTAL_BOT_USERNAME }}
          jenkins_token: ${{ steps.parse_secrets.outputs.TOPTAL_BOT_JENKINS_DEPLOYMENT_TOKEN }}
          jenkins_client_id: ${{ steps.parse_secrets.outputs.JENKINS_DEPLOYMENT_CLIENT_ID }}
          jenkins_sa_credentials: ${{ steps.parse_secrets.outputs.JENKINS_SA_CREDENTIALS }}
          job_name: '${{ env.REPOSITORY_NAME }}/job/${{ env.REPOSITORY_NAME }}-production-deployment'
          job_params: |
            {
              "REPOSITORY_NAME": "${{ env.REPOSITORY_NAME }}",
              "TAG": "${{ needs.check-event.outputs.sha }}"
            }
          job_timeout: '1200'