name: Deploy Infra

on:
  push:
    branches:
      - main
      - develop
    paths:
      - "packages/infra/**"
      - "!packages/infra/terraform/stacks/hashpass-wordpress-multisite/**"
      - "apps/mobile-app/app/api/**"
      - "apps/mobile-app/lib/**"
      - "apps/mobile-app/config/**"
      - "packages/auth/**"
      - "packages/config/**"
      - "packages/tools/scripts/deploy-api-lambda.sh"
      - "packages/tools/scripts/package-lambda.sh"
      - "packages/types/**"
      - "db/migrations/**"
      - "db/migrations-mobile-bootstrap/**"
      - "packages/tools/scripts/config/database-profiles.json"
      - "packages/tools/scripts/migrate-tenant-db.mjs"
      - "packages/tools/scripts/db-backup/**"
      - ".github/actions/apply-core-db-migrations/**"
      - "package.json"
      - "pnpm-lock.yaml"
  workflow_dispatch: {}

jobs:
  migrate-database:
    name: Migrate core database (${{ github.ref_name == 'main' && 'production' || 'development' }})
    if: github.repository == 'hashpass-tech/hashpass.tech' && (github.ref_name == 'main' || github.ref_name == 'develop')
    runs-on: ubuntu-latest
    environment: ${{ github.ref_name == 'main' && 'production' || 'development' }}
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Apply core database migrations before deployment
        uses: ./.github/actions/apply-core-db-migrations
        with:
          profile: ${{ github.ref_name == 'main' && 'core-production' || 'core-development' }}
          database-url: ${{ github.ref_name == 'main' && secrets.SUPABASE_DB_URL_PROD || secrets.SUPABASE_DB_URL_DEV }}
          backup-writer-role-arn: ${{ vars.DB_BACKUP_WRITER_ROLE_ARN }}
          backup-bucket: ${{ vars.DB_BACKUP_BUCKET }}
          aws-account-id: ${{ vars.AWS_TARGET_ACCOUNT_ID }}

  deploy:
    needs: migrate-database
    if: github.repository == 'hashpass-tech/hashpass.tech' && (github.ref_name == 'main' || github.ref_name == 'develop')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    env:
      EXPECTED_AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID }}
      HASHPASS_INFRA_TARGET: bsl
      AWS_WEB_PIPELINE_ROLE_ARN: ${{ vars.AWS_WEB_PIPELINE_ROLE_ARN }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          cache: "pnpm"

      - name: Setup Bun for SST
        run: |
          npm install --global bun@1.2.23
          bun --version

      - name: Install dependencies
        run: |
          rm -rf node_modules
          pnpm install --no-frozen-lockfile

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-2
          role-to-assume: ${{ vars.AWS_INFRA_DEPLOY_ROLE_ARN }}
          role-session-name: hashpass-infra

      - name: Deploy production
        if: github.ref_name == 'main'
        continue-on-error: true
        run: pnpm --filter @hashpass/infra run deploy:prod

      - name: Deploy development
        if: github.ref_name == 'develop'
        continue-on-error: true
        run: pnpm --filter @hashpass/infra run deploy:dev

      - name: Validate target API deploy role
        if: github.ref_name == 'main' || github.ref_name == 'develop'
        run: |
          set -euo pipefail

          if [ -z "${AWS_WEB_PIPELINE_ROLE_ARN:-}" ]; then
            echo "Missing AWS_WEB_PIPELINE_ROLE_ARN. Set the GitHub repo variable to the target-account web pipeline role."
            exit 1
          fi

      - name: Configure target AWS credentials for API Lambda
        if: github.ref_name == 'main' || github.ref_name == 'develop'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-east-1
          role-to-assume: ${{ env.AWS_WEB_PIPELINE_ROLE_ARN }}
          role-session-name: hashpass-api-lambda-deploy

      - name: Deploy production API Lambda
        if: github.ref_name == 'main'
        env:
          SITE_LAMBDA_FUNCTION_NAME: hashpass-prod-expo-router-api
          SITE_LAMBDA_REGION: us-east-1
          SITE_LAMBDA_DEPLOYMENT_ENVIRONMENT: production
          SITE_LAMBDA_DEPLOYMENT_BUCKET_REGION: us-east-1
          SITE_API_VERSION_URL: https://api.hashpass.tech/api/config/versions
          EXPO_PUBLIC_SUPABASE_URL: ${{ vars.EXPO_PUBLIC_SUPABASE_URL_PROD }}
          EXPO_PUBLIC_SUPABASE_URL_DEV: ${{ vars.EXPO_PUBLIC_SUPABASE_URL_DEV }}
          EXPO_PUBLIC_SUPABASE_URL_PROD: ${{ vars.EXPO_PUBLIC_SUPABASE_URL_PROD }}
          EXPO_PUBLIC_SUPABASE_KEY: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_PROD }}
          EXPO_PUBLIC_SUPABASE_KEY_DEV: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_DEV }}
          EXPO_PUBLIC_SUPABASE_KEY_PROD: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_PROD }}
          EXPO_PUBLIC_SUPABASE_ANON_KEY: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_PROD }}
          EXPO_PUBLIC_SUPABASE_ANON_KEY_DEV: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_DEV }}
          EXPO_PUBLIC_SUPABASE_ANON_KEY_PROD: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_PROD }}
          SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY_PROD }}
          EXPO_PUBLIC_SITE_URL: https://hashpass.tech
          SITE_URL: https://hashpass.tech
          FRONTEND_URL: https://hashpass.tech
          EXPO_PUBLIC_API_BASE_URL: https://api.hashpass.tech/api
          EXPO_PUBLIC_BETTER_AUTH_URL: https://api.hashpass.tech/api/auth
          BETTER_AUTH_URL: https://api.hashpass.tech/api/auth
          SENTRY_DSN: ${{ vars.EXPO_PUBLIC_SENTRY_DSN }}
          # Core is the single production database (BSL consolidated into it on
          # 2026-10-20). deploy-api-lambda.sh fans this one secret out to
          # DATABASE_URL, SUPABASE_DB_URL and BETTER_AUTH_DATABASE_URL, masks it,
          # and drops the retired BSL Supabase variables.
          API_LAMBDA_DATABASE_URL: ${{ secrets.API_LAMBDA_DATABASE_URL_PROD }}
          API_LAMBDA_REMOVE_RETIRED_ENV: 'true'
        run: bash packages/tools/scripts/deploy-api-lambda.sh

      - name: Deploy development API Lambda
        if: github.ref_name == 'develop'
        env:
          SITE_LAMBDA_FUNCTION_NAME: hashpass-dev-expo-router-api
          SITE_LAMBDA_REGION: us-east-1
          SITE_LAMBDA_DEPLOYMENT_ENVIRONMENT: dev
          SITE_LAMBDA_DEPLOYMENT_BUCKET_REGION: us-east-1
          SITE_API_VERSION_URL: https://api-dev.hashpass.tech/api/config/versions
          EXPO_PUBLIC_SUPABASE_URL: ${{ vars.EXPO_PUBLIC_SUPABASE_URL_DEV }}
          EXPO_PUBLIC_SUPABASE_URL_DEV: ${{ vars.EXPO_PUBLIC_SUPABASE_URL_DEV }}
          EXPO_PUBLIC_SUPABASE_URL_PROD: ${{ vars.EXPO_PUBLIC_SUPABASE_URL_PROD }}
          EXPO_PUBLIC_SUPABASE_KEY: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_DEV }}
          EXPO_PUBLIC_SUPABASE_KEY_DEV: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_DEV }}
          EXPO_PUBLIC_SUPABASE_KEY_PROD: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_PROD }}
          EXPO_PUBLIC_SUPABASE_ANON_KEY: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_DEV }}
          EXPO_PUBLIC_SUPABASE_ANON_KEY_DEV: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_DEV }}
          EXPO_PUBLIC_SUPABASE_ANON_KEY_PROD: ${{ vars.EXPO_PUBLIC_SUPABASE_ANON_KEY_PROD }}
          EXPO_PUBLIC_BSL_SUPABASE_URL_DEV: ${{ vars.EXPO_PUBLIC_BSL_SUPABASE_URL_DEV }}
          EXPO_PUBLIC_BSL_SUPABASE_KEY_DEV: ${{ vars.EXPO_PUBLIC_BSL_SUPABASE_KEY_DEV }}
          SUPABASE_SERVICE_ROLE_KEY: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY_DEV }}
          EXPO_PUBLIC_SITE_URL: https://dev.hashpass.tech
          SITE_URL: https://dev.hashpass.tech
          FRONTEND_URL: https://dev.hashpass.tech
          EXPO_PUBLIC_API_BASE_URL: https://api-dev.hashpass.tech/api
          EXPO_PUBLIC_BETTER_AUTH_URL: https://api-dev.hashpass.tech/api/auth
          BETTER_AUTH_URL: https://api-dev.hashpass.tech/api/auth
          SENTRY_DSN: ${{ vars.EXPO_PUBLIC_SENTRY_DSN }}
        run: bash packages/tools/scripts/deploy-api-lambda.sh