Deployment

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://example.com   # shown in the Actions UI and PR deployments
    steps:
      - run: ./deploy.sh
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}   # from 'production' environment

# Only allow main and release/* to deploy to production
# Set in: Settings → Environments → production → Deployment branches
# Pattern: main, release/**

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false    # queue, don't cancel (safe for deploys)

concurrency:
  group: deploy-preview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - run: ./scripts/deploy.sh
        env:
          API_KEY: ${{ secrets.API_KEY }}

on:
  release:
    types: [published]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.release.tag_name }}
      - run: echo "Deploying ${{ github.event.release.tag_name }}"
      - run: ./deploy.sh

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActions
          aws-region: us-east-1

      - uses: aws-actions/amazon-ecr-login@v2

      - run: |
          docker build -t $ECR_URI:${{ github.sha }} .
          docker push $ECR_URI:${{ github.sha }}
        env:
          ECR_URI: 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp

      - run: |
          aws ecs update-service \
            --cluster my-cluster \
            --service my-service \
            --force-new-deployment

permissions:
  id-token: write
  contents: read

steps:
  - uses: google-github-actions/auth@v2
    with:
      workload_identity_provider: projects/123/locations/global/workloadIdentityPools/github/providers/github
      service_account: deployer@my-project.iam.gserviceaccount.com

  - uses: google-github-actions/deploy-cloudrun@v2
    with:
      service: my-service
      image: gcr.io/my-project/app:${{ github.sha }}
      region: us-central1

permissions:
  id-token: write
  contents: read

steps:
  - uses: azure/login@v2
    with:
      client-id: ${{ secrets.AZURE_CLIENT_ID }}
      tenant-id: ${{ secrets.AZURE_TENANT_ID }}
      subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

  - uses: azure/webapps-deploy@v3
    with:
      app-name: my-app
      package: dist/

permissions:
  contents: read
  pages: write
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deploy.outputs.page_url }}
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build

      - uses: actions/upload-pages-artifact@v3
        with:
          path: out/

      - id: deploy
        uses: actions/deploy-pages@v4

on:
  pull_request:
    types: [opened, synchronize, reopened, closed]

jobs:
  deploy-preview:
    if: github.event.action != 'closed'
    runs-on: ubuntu-latest
    environment:
      name: pr-${{ github.event.number }}
      url: https://pr-${{ github.event.number }}.preview.example.com
    steps:
      - run: ./deploy-preview.sh ${{ github.event.number }}

  teardown:
    if: github.event.action == 'closed'
    runs-on: ubuntu-latest
    steps:
      - run: ./teardown-preview.sh ${{ github.event.number }}

- uses: actions/github-script@v7
  with:
    script: |
      github.rest.repos.createDeploymentStatus({
        owner: context.repo.owner,
        repo: context.repo.repo,
        deployment_id: '${{ steps.deploy.outputs.deployment-id }}',
        state: 'success',
        environment_url: 'https://example.com',
        description: 'Deploy complete',
      });

- uses: actions/github-script@v7
  with:
    script: |
      github.rest.issues.createComment({
        issue_number: context.issue.number,
        owner: context.repo.owner,
        repo: context.repo.repo,
        body: '**Deployed to production:** https://example.com',
      });

jobs:
  deploy:
    runs-on: ubuntu-latest
    outputs:
      previous-sha: ${{ steps.get-prev.outputs.sha }}
    steps:
      - id: get-prev
        run: echo "sha=$(git rev-parse HEAD~1)" >> $GITHUB_OUTPUT
      - run: ./deploy.sh ${{ github.sha }}

  rollback:
    needs: deploy
    if: failure()
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh ${{ needs.deploy.outputs.previous-sha }}
        env:
          ROLLBACK: 'true'