name: Deploy Storybook to Staging

on:
  # when PR was merged to master/main branch
  push:
    branches:
      - master
      - main
  # when a workflow was triggered manually
  workflow_dispatch:
    inputs:
      version:
        description: 'Commit hash to deploy'
        required: true

concurrency:
  group: storybook-staging-${{ github.head_ref }}
  cancel-in-progress: true

env:
  REPOSITORY_NAME: ${{ github.event.repository.name }}

jobs:
  check-event:
    name: Check Event
    timeout-minutes: 5
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    if: >
      github.event_name == 'push' || (
        github.event_name == 'workflow_dispatch' && github.event.inputs.version
      )
    outputs:
      sha: ${{ steps.specify-sha.outputs.result }}
      should-deploy-to-staging: ${{ steps.deployment-necessity.outputs.should-deploy-to-staging }}
    steps:
      - name: GSM Secrets
        id: secrets_manager
        uses: toptal/actions/gsm-secrets@main
        with:
          workload_identity_provider: projects/858873486241/locations/global/workloadIdentityPools/gha-pool/providers/github-com
          service_account: gha-caliber@toptal-ci.iam.gserviceaccount.com
          secrets_name: |-
            GCR_ACCOUNT_KEY:toptal-ci/GCR_ACCOUNT_KEY
            TOPTAL_DEVBOT_TOKEN:toptal-ci/TOPTAL_DEVBOT_TOKEN
            TOPTAL_JENKINS_BUILD_TOKEN:toptal-ci/TOPTAL_JENKINS_BUILD_TOKEN

      - name: Parse secrets
        id: parse_secrets
        uses: toptal/actions/expose-json-outputs@main
        with:
          json: ${{ steps.secrets_manager.outputs.secrets }}

      - name: Set ENV Variables
        run: |-
          echo "GITHUB_TOKEN=${{ steps.parse_secrets.outputs.TOPTAL_DEVBOT_TOKEN }}" >> $GITHUB_ENV
          echo "JENKINS_DEPLOY_TOKEN=${{ steps.parse_secrets.outputs.TOPTAL_JENKINS_BUILD_TOKEN }}" >> $GITHUB_ENV
          echo 'GCR_ACCOUNT_KEY<<EOF' >> $GITHUB_ENV
          echo '${{ steps.parse_secrets.outputs.GCR_ACCOUNT_KEY }}' >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV

      - id: specify-sha
        uses: toptal/davinci-github-actions/get-workflow-sha@v20.0.0

      - name: Checkout
        uses: actions/checkout@v3
        with:
          token: ${{ env.GITHUB_TOKEN }}
          ref: ${{ steps.specify-sha.outputs.result }}

      - name: Read davinci configuration
        id: davinci-config-data
        if: hashFiles('davinci.yaml') != ''
        uses: KJ002/read-yaml@1.6
        with:
          file: './davinci.yaml'
          key-path: '["master"]'

      - name: Check if it should be deployed
        id: deployment-necessity
        uses: actions/github-script@v7
        env:
          DAVINCI_CONFIG_DATA: ${{ steps.davinci-config-data.outputs.data }}
          EVENT_NAME: ${{ github.event_name }}
        with:
          github-token: ${{ env.GITHUB_TOKEN }}
          result-encoding: string
          script: |
            const {DAVINCI_CONFIG_DATA, EVENT_NAME} = process.env
            const configData = DAVINCI_CONFIG_DATA ? JSON.parse(DAVINCI_CONFIG_DATA) : null
            const shouldDeployToStaging = EVENT_NAME === 'workflow_dispatch' ? true : configData ? configData.deploy_storybook_staging : false
            core.setOutput('should-deploy-to-staging', shouldDeployToStaging)

  deploy-storybook-staging:
    name: Build & Deploy Storybook image
    if: ${{ fromJSON(needs.check-event.outputs.should-deploy-to-staging) == true }}
    needs: [ check-event ]
    timeout-minutes: 45
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: GSM Secrets
        id: secrets_manager
        uses: toptal/actions/gsm-secrets@main
        with:
          workload_identity_provider: projects/858873486241/locations/global/workloadIdentityPools/gha-pool/providers/github-com
          service_account: gha-caliber@toptal-ci.iam.gserviceaccount.com
          secrets_name: |-
            GCR_ACCOUNT_KEY:toptal-ci/GCR_ACCOUNT_KEY
            JENKINS_CLIENT_ID:toptal-ci/JENKINS_CLIENT_ID
            JENKINS_SA_CREDENTIALS:toptal-ci/JENKINS_SA_CREDENTIALS
            JENKINS_URL:toptal-ci/JENKINS_URL
            TOPTAL_DEVBOT_TOKEN:toptal-ci/TOPTAL_DEVBOT_TOKEN
            TOPTAL_DEVBOT_TRIGGER_TOKEN:toptal-ci/TOPTAL_DEVBOT_TRIGGER_TOKEN
            TOPTAL_TRIGGERBOT_TOKEN:toptal-ci/TOPTAL_TRIGGERBOT_TOKEN
            TOPTAL_TRIGGERBOT_USERNAME:toptal-ci/TOPTAL_TRIGGERBOT_USERNAME

      - name: Parse secrets
        id: parse_secrets
        uses: toptal/actions/expose-json-outputs@main
        with:
          json: ${{ steps.secrets_manager.outputs.secrets }}

      - name: Set ENV Variables
        run: |-
          echo "GITHUB_TOKEN=${{ steps.parse_secrets.outputs.TOPTAL_DEVBOT_TOKEN }}" >> $GITHUB_ENV
          echo "JENKINS_DEPLOY_TOKEN=${{ steps.parse_secrets.outputs.TOPTAL_DEVBOT_TRIGGER_TOKEN }}" >> $GITHUB_ENV
          echo 'GCR_ACCOUNT_KEY<<EOF' >> $GITHUB_ENV
          echo '${{ steps.parse_secrets.outputs.GCR_ACCOUNT_KEY }}' >> $GITHUB_ENV
          echo 'EOF' >> $GITHUB_ENV

      - name: Checkout
        uses: actions/checkout@v3
        with:
          token: ${{ env.GITHUB_TOKEN }}
          ref: ${{ needs.check-event.outputs.sha }}

      - uses: toptal/actions/deploy-storybook@main
        with:
          jenkins_url: ${{ steps.parse_secrets.outputs.JENKINS_URL }}
          jenkins_user: ${{ steps.parse_secrets.outputs.TOPTAL_TRIGGERBOT_USERNAME }}
          jenkins_token: ${{ steps.parse_secrets.outputs.TOPTAL_TRIGGERBOT_TOKEN }}
          jenkins_client_id: ${{ steps.parse_secrets.outputs.JENKINS_CLIENT_ID }}
          jenkins_sa_credentials: ${{ steps.parse_secrets.outputs.JENKINS_SA_CREDENTIALS }}
          sha: ${{ needs.check-event.outputs.sha }}
          environment: staging