lambda-deploy.yml

name: Lambda Deploy

on:
  push:
    branches: [main]
    paths:
      - 'apps/backend/lambdas/**'
      - 'shared/types/**'
  workflow_dispatch:

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      lambdas: ${{ steps.detect.outputs.lambdas }}
      has-changes: ${{ steps.detect.outputs.has-changes }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect changed lambdas
        id: detect
        run: |
          BASE_COMMIT="${{ github.event.before }}"

          all_lambdas=$(ls -d apps/backend/lambdas/*/ | grep -Ev "(tools)/" | sed 's#/$##' | jq -R -s -c 'split("\n") | map(select(. != ""))')
          
          changed_files=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || git diff --name-only HEAD)
          
          changed_lambdas=()
          for lambda_path in apps/backend/lambdas/*/; do
            lambda_name=$(basename "$lambda_path")
            if [[ "$lambda_name" != "tools" ]]; then
              if echo "$changed_files" | grep -q "^apps/backend/lambdas/$lambda_name/"; then
                changed_lambdas+=("$lambda_path")
              fi
            fi
          done
          
          if [[ ${#changed_lambdas[@]} -eq 0 ]]; then
            echo "No specific lambda changes detected, deploying all lambdas"
            lambdas=$all_lambdas
            has_changes="true"
          else
            lambdas=$(printf '%s\n' "${changed_lambdas[@]}" | sed 's#/$##' | jq -R -s -c 'split("\n") | map(select(. != ""))')
            has_changes="true"
          fi
          
          echo "lambdas=$lambdas" >> $GITHUB_OUTPUT
          echo "has-changes=$has_changes" >> $GITHUB_OUTPUT

  # Post the initial "Deploying backend" Slack message before builds run.
  prep:
    needs: detect-changes
    if: needs.detect-changes.outputs.has-changes == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      ts: ${{ steps.slack.outputs.ts }}
      total: ${{ steps.count.outputs.total }}
    steps:
      - uses: actions/checkout@v4
      - name: Count lambdas
        id: count
        env:
          LAMBDAS: ${{ needs.detect-changes.outputs.lambdas }}
        run: echo "total=$(echo "$LAMBDAS" | jq 'length')" >> "$GITHUB_OUTPUT"
      - name: Start deploy notification
        id: slack
        uses: ./.github/actions/slack-deploy
        with:
          mode: start
          component: backend
          total-steps: ${{ steps.count.outputs.total }}
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

  build:
    needs: detect-changes
    if: needs.detect-changes.outputs.has-changes == 'true'
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        lambda: ${{ fromJson(needs.detect-changes.outputs.lambdas) }}
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
      
      - name: Build shared lambda-auth package
        run: npm ci --prefix shared/lambda-auth && npm run build --prefix shared/lambda-auth
      - name: Install dependencies
        working-directory: ${{ matrix.lambda }}
        run: npm ci --legacy-peer-deps
      
      - name: Package lambda
        working-directory: ${{ matrix.lambda }}
        run: npm run package

      - name: Compute artifact name
        id: artifact
        run: echo "name=lambda-$(basename ${{ matrix.lambda }})" >> $GITHUB_OUTPUT

      - name: Upload lambda artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ steps.artifact.outputs.name }}
          path: ${{ matrix.lambda }}/lambda.zip
          if-no-files-found: error

  deploy:
    needs: [detect-changes, prep, build]
    if: needs.detect-changes.outputs.has-changes == 'true'
    runs-on: ubuntu-latest
    environment: production
    permissions:
      id-token: write # assume the OIDC apply role
      contents: read
      actions: read # count completed legs for the live status bar
      pull-requests: read
    strategy:
      fail-fast: false
      matrix:
        lambda: ${{ fromJson(needs.detect-changes.outputs.lambdas) }}
    steps:
      - name: Compute artifact name
        id: artifact
        run: echo "name=lambda-$(basename ${{ matrix.lambda }})" >> $GITHUB_OUTPUT

      - name: Download lambda artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ steps.artifact.outputs.name }}
          path: ${{ matrix.lambda }}

      - name: Configure AWS credentials (write apply role via OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::489881683177:role/branch-ci-apply
          aws-region: us-east-2

      - name: Deploy lambda
        id: deploy
        run: |
          set -o pipefail
          LAMBDA_NAME=$(basename ${{ matrix.lambda }})
          FUNCTION_NAME="branch-${LAMBDA_NAME}"
          {
            echo "Deploying Lambda function: $FUNCTION_NAME"
            aws lambda update-function-code \
              --function-name "$FUNCTION_NAME" \
              --zip-file fileb://${{ matrix.lambda }}/lambda.zip
            echo "✓ Successfully deployed $FUNCTION_NAME"
          } 2>&1 | tee deploy.log

      - name: Compute result name
        id: rname
        if: always()
        run: echo "name=$(basename ${{ matrix.lambda }})" >> "$GITHUB_OUTPUT"

      - name: Save deploy result
        if: always()
        run: |
          mkdir -p lambda-results
          echo "${{ steps.rname.outputs.name }}|${{ steps.deploy.outcome }}" > "lambda-results/${{ steps.rname.outputs.name }}.meta"
          cp deploy.log "lambda-results/${{ steps.rname.outputs.name }}.log" 2>/dev/null \
            || echo "(no deploy output captured)" > "lambda-results/${{ steps.rname.outputs.name }}.log"

      - name: Upload deploy result
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: lambda-result-${{ steps.rname.outputs.name }}
          path: lambda-results/
          if-no-files-found: warn

      - name: Thread step (live)
        if: always()
        uses: ./.github/actions/slack-deploy
        with:
          mode: step
          component: backend
          total-steps: ${{ needs.prep.outputs.total }}
          job-name: deploy
          step-name: Deployed branch-${{ steps.rname.outputs.name }}
          step-status: ${{ steps.deploy.outcome }}
          details-file: deploy.log
          ts: ${{ needs.prep.outputs.ts }}
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}

  notify:
    name: Deployment Notify
    needs: [detect-changes, prep, deploy]
    if: always() && needs.detect-changes.outputs.has-changes == 'true'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download deploy results
        uses: actions/download-artifact@v4
        with:
          pattern: lambda-result-*
          path: lambda-results
          merge-multiple: true

      - name: Finalize deploy notification
        uses: ./.github/actions/slack-deploy
        with:
          mode: finalize
          component: backend
          total-steps: ${{ needs.prep.outputs.total }}
          results-dir: lambda-results
          ts: ${{ needs.prep.outputs.ts }}
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}