deploy.yml

name: Deploy

on:
  push:
    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onpull_requestpull_request_targetbranchesbranches-ignore
    branches:
      - prod

# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
permissions:
  contents: read # for "git clone"

defaults:
  # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#defaultsrun
  run:
    # Enable fail-fast behavior using set -eo pipefail
    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
    shell: bash

# @todo #1154 Deploy should depend on successful execution of the other pipelines
jobs:
  deploy:
    name: Deploy
    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idruns-on
    runs-on: ubuntu-20.04
    steps:

      - name: Clone source code
        uses: actions/checkout@v4.2.2 # https://github.com/actions/checkout
        with:
          # Whether to configure the token or SSH key with the local git config. Default: true
          persist-credentials: false

      - name: Install JDK
        uses: actions/setup-java@v4.7.0 # https://github.com/actions/setup-java
        with:
          distribution: 'adopt' # https://github.com/actions/setup-java#supported-distributions
          java-version: '8'     # https://github.com/actions/setup-java#supported-version-syntax

      - name: Restore existing cache
        uses: actions/cache@v4.2.3 # https://github.com/actions/cache
        with:
          # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#input-parameters-for-the-cache-action
          key: maven-repository-${{ hashFiles('pom.xml') }}
          path: ~/.m2/repository
          restore-keys: maven-repository-

      - name: Build WAR file
        # NOTE: we use -Dmaven.test.skip=true instead of -DskipUnitTests=true
        # in order to skip both compilation and execution of the tests
        run: >-
          mvn \
            --batch-mode \
            -Denforcer.skip=true \
            -Dmaven.test.skip=true \
            package

      - name: Install mise to set up Ansible
        uses: jdx/mise-action@v2.1.11 # https://github.com/jdx/mise-action
        with:
          version: 2025.3.6                # [default: latest] mise version to install
          install: true                    # [default: true] run `mise install`
          cache: true                      # [default: true] cache mise using GitHub's cache
          log_level: info                  # [default: info] log level
          working_directory: infra/ansible # [default: .] directory to run mise in
        env:
          # Workaround: don't install some dependencies that we don't use (java, maven) or don't want (python)
          # See: https://github.com/jdx/mise-action/issues/183
          # https://mise.jdx.dev/configuration/settings.html#disable_tools
          MISE_DISABLE_TOOLS: java,maven,python

      # https://docs.ansible.com/ansible/3/collections/community/general/uptimerobot_module.html
      # https://docs.ansible.com/ansible/latest/collections_guide/collections_installing.html#installing-an-older-version-of-a-collection
      - name: Install community.general collection for UptimeRobot
        run: ansible-galaxy collection install community.general:==2.5.2

      # https://docs.ansible.com/ansible/3/collections/ansible/posix/debug_callback.html
      - name: Install ansible.posix.debug for debug callback
        run: ansible-galaxy collection install ansible.posix:==1.2.0

      - name: Run deploy.sh
        env:
          # https://docs.github.com/en/actions/security-guides/encrypted-secrets#using-encrypted-secrets-in-a-workflow
          VAULT_PASSWORD: ${{ secrets.VAULT_PASSWORD }}
        run: ./src/main/scripts/ci/deploy.sh