finishReleaseCycle.yml

name: Prepare production deploy

on:
  issues:
    types: [closed]

# The updateProduction and createNewStagingDeployCash jobs are executed when a StagingDeployCash is closed.
jobs:
  validate:
    runs-on: ubuntu-latest
    if: contains(github.event.issue.labels.*.name, 'StagingDeployCash')
    outputs:
      isValid: ${{ fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) && !fromJSON(steps.checkDeployBlockers.outputs.HAS_DEPLOY_BLOCKERS) }}
    steps:
      - name: Validate actor is deployer
        id: isDeployer
        run: |
          if gh api /orgs/Expensify/teams/mobile-deployers/memberships/${{ github.actor }} --silent; then
            echo "IS_DEPLOYER=true" >> "$GITHUB_OUTPUT"
          else
            echo "IS_DEPLOYER=false" >> "$GITHUB_OUTPUT"
          fi
        env:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}

      - name: Reopen and comment on issue
        if: ${{ !fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) }}
        uses: Expensify/App/.github/actions/javascript/reopenIssueWithComment@main
        with:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          COMMENT: |
            Sorry, only members of @Expensify/Mobile-Deployers can close deploy checklists.
            Reopening!

      - name: Check for any deploy blockers
        if: ${{ fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) }}
        id: checkDeployBlockers
        uses: Expensify/App/.github/actions/javascript/checkDeployBlockers@main
        with:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}

      - name: Reopen and comment on issue
        if: ${{ fromJSON(steps.isDeployer.outputs.IS_DEPLOYER) && fromJSON(steps.checkDeployBlockers.outputs.HAS_DEPLOY_BLOCKERS) }}
        uses: Expensify/App/.github/actions/javascript/reopenIssueWithComment@main
        with:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          COMMENT: |
            This issue either has unchecked items or has not yet been marked with the `:shipit:` emoji of approval.
            Reopening!

      - if: ${{ failure() }}
        uses: Expensify/App/.github/actions/composite/announceFailedWorkflowInSlack@main
        with:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

  # Update the production branch to trigger the production deploy.
  updateProduction:
    runs-on: ubuntu-latest
    needs: validate
    if: ${{ fromJSON(needs.validate.outputs.isValid) }}
    steps:
      - uses: actions/checkout@v3
        with:
          ref: staging
          token: ${{ secrets.OS_BOTIFY_TOKEN }}

      - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
        with:
          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Update production branch
        run: |
          # Re-create the production branch from staging
          git switch -c production

          # Force-update the remote production branch.
          git push --force origin production

      - if: ${{ failure() }}
        uses: Expensify/App/.github/actions/composite/announceFailedWorkflowInSlack@main
        with:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

  # Create a new patch version to prep for next release cycle
  createNewPatchVersion:
    needs: validate
    if: ${{ fromJSON(needs.validate.outputs.isValid) }}
    uses: Expensify/App/.github/workflows/createNewVersion.yml@main
    secrets: inherit
    with:
      SEMVER_LEVEL: PATCH

  # Update the staging branch to trigger a staging deploy
  updateStaging:
    runs-on: ubuntu-latest
    needs: [updateProduction, createNewPatchVersion]
    steps:
      - uses: actions/checkout@v3
        with:
          ref: main
          token: ${{ secrets.OS_BOTIFY_TOKEN }}

      - uses: Expensify/App/.github/actions/composite/setupGitForOSBotify@main
        with:
          GPG_PASSPHRASE: ${{ secrets.LARGE_SECRET_PASSPHRASE }}

      - name: Update staging branch to trigger staging deploy
        run: |
          # Re-create the staging branch from main
          git switch -c staging

          # Force-update the remote staging branch
          git push --force origin staging

      - if: ${{ failure() }}
        uses: Expensify/App/.github/actions/composite/announceFailedWorkflowInSlack@main
        with:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

  # Create a new StagingDeployCash for the next release cycle.
  createNewStagingDeployCash:
    runs-on: ubuntu-latest
    needs: [updateStaging, createNewPatchVersion]
    steps:
      - uses: actions/checkout@v3
        with:
          ref: staging
          token: ${{ secrets.OS_BOTIFY_TOKEN }}

        # Create a local git tag so that GitUtils.getPullRequestsMergedBetween can use `git log` to generate a
        # list of pull requests that were merged between this version tag and another.
        # NOTE: This tag is only used locally and shouldn't be pushed to the remote.
        # If it was pushed, that would trigger the staging deploy which is handled in a separate workflow (deploy.yml)
      - name: Tag version
        run: git tag ${{ needs.createNewPatchVersion.outputs.NEW_VERSION }}

      - name: Create new StagingDeployCash
        uses: Expensify/App/.github/actions/javascript/createOrUpdateStagingDeploy@main
        with:
          GITHUB_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
          NPM_VERSION: ${{ needs.createNewPatchVersion.outputs.NEW_VERSION }}

      - if: ${{ failure() }}
        uses: Expensify/App/.github/actions/composite/announceFailedWorkflowInSlack@main
        with:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}