name: Deploy to demo environment

on:
  push:
    branches: [ production ]

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: demo
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 2

      - name: Check for changes to Terraform
        id: changed-terraform-files
        uses: tj-actions/changed-files@v1.1.2
        with:
          files: |
            terraform/demo
            terraform/shared
            .github/workflows/deploy-demo.yml
      - name: Terraform init
        if: steps.changed-terraform-files.outputs.any_changed == 'true'
        working-directory: terraform/demo
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.TERRAFORM_STATE_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.TERRAFORM_STATE_SECRET_ACCESS_KEY }}
        run: terraform init
      - name: Terraform apply
        if: steps.changed-terraform-files.outputs.any_changed == 'true'
        working-directory: terraform/demo
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.TERRAFORM_STATE_ACCESS_KEY }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.TERRAFORM_STATE_SECRET_ACCESS_KEY }}
          TF_VAR_cf_user: ${{ secrets.CLOUDGOV_USERNAME }}
          TF_VAR_cf_password: ${{ secrets.CLOUDGOV_PASSWORD }}
        run: terraform apply -auto-approve -input=false

      - uses: ./.github/actions/setup-project

      - name: Create requirements.txt
        run: poetry export --without-hashes --format=requirements.txt > requirements.txt

      - name: Deploy to cloud.gov
        uses: 18f/cg-deploy-action@main
        env:
          DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
          SECRET_KEY: ${{ secrets.SECRET_KEY }}
          ADMIN_CLIENT_SECRET: ${{ secrets.ADMIN_CLIENT_SECRET }}
          NEW_RELIC_LICENSE_KEY: ${{ secrets.NEW_RELIC_LICENSE_KEY }}
          NR_BROWSER_KEY: ${{ secrets.NR_BROWSER_KEY }}
          LOGIN_PEM: ${{ secrets.LOGIN_PEM }}
        with:
          cf_username: ${{ secrets.CLOUDGOV_USERNAME }}
          cf_password: ${{ secrets.CLOUDGOV_PASSWORD }}
          cf_org: gsa-tts-benefits-studio
          cf_space: notify-demo
          push_arguments: >-
            --vars-file deploy-config/demo.yml
            --var DANGEROUS_SALT="$DANGEROUS_SALT"
            --var SECRET_KEY="$SECRET_KEY"
            --var ADMIN_CLIENT_USERNAME="notify-admin"
            --var ADMIN_CLIENT_SECRET="$ADMIN_CLIENT_SECRET"
            --var NEW_RELIC_LICENSE_KEY="$NEW_RELIC_LICENSE_KEY"
            --var NR_BROWSER_KEY="$NR_BROWSER_KEY"
            --var LOGIN_PEM="$LOGIN_PEM"

      - name: Check for changes to egress config
        id: changed-egress-config
        uses: tj-actions/changed-files@v34
        with:
          files: |
            deploy-config/egress_proxy/notify-admin-demo.*.acl
            .github/actions/deploy-proxy/action.yml
            .github/workflows/deploy-demo.yml
      - name: Deploy egress proxy
        if: steps.changed-egress-config.outputs.any_changed == 'true'
        uses: ./.github/actions/deploy-proxy
        with:
          cf_space: notify-demo
          app: notify-admin-demo
