app/.github/workflows/promote-prod.yml

name: Promote to Production

on:
  workflow_dispatch:
    inputs:
      tag:
        description: "Image tag to promote (e.g. 2026.03.28-f1b85bf)"
        required: true
        type: string

jobs:
  promote:
    name: Promote to Production
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Generate infra repo token
        id: infra-token
        uses: tibdex/github-app-token@v2
        with:
          app_id: ${{ vars.GH_APP_ID }}
          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Clone groombook/infra
        run: |
          git clone https://x-access-token:${{ steps.infra-token.outputs.token }}@github.com/groombook/infra.git /tmp/infra

      - name: Install yq
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      - name: Update prod overlay image tags and base Job names
        env:
          TAG: ${{ inputs.tag }}
        run: |
          cd /tmp/infra
          PROD_KUST="apps/groombook/overlays/prod/kustomization.yaml"

          SHORT_SHA="${TAG##*-}"
          export SHORT_SHA
          export TAG

          yq -i '(.images[] | select(.name == "ghcr.io/groombook/api")).newTag = env(TAG)' "$PROD_KUST"
          yq -i '(.images[] | select(.name == "ghcr.io/groombook/web")).newTag = env(TAG)' "$PROD_KUST"
          yq -i '(.images[] | select(.name == "ghcr.io/groombook/migrate")).newTag = env(TAG)' "$PROD_KUST"
          yq -i '(.images[] | select(.name == "ghcr.io/groombook/seed")).newTag = env(TAG)' "$PROD_KUST"

          # Update migrate Job name to include short SHA (immutable template fix)
          MIGRATE_JOB="apps/groombook/base/migrate-job.yaml"
          if [ -f "$MIGRATE_JOB" ]; then
            yq -i '.metadata.name = "migrate-schema-" + env(SHORT_SHA)' "$MIGRATE_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$MIGRATE_JOB"
            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$MIGRATE_JOB"
          fi

          # Update seed Job name to include short SHA (immutable template fix)
          SEED_JOB="apps/groombook/base/seed-job.yaml"
          if [ -f "$SEED_JOB" ]; then
            yq -i '.metadata.name = "seed-test-data-" + env(SHORT_SHA)' "$SEED_JOB"
            yq -i '.metadata.annotations."groombook.app/deploy-version" = env(TAG)' "$SEED_JOB"
            yq -i '.spec.ttlSecondsAfterFinished = (.spec.ttlSecondsAfterFinished // 86400)' "$SEED_JOB"
          fi

          git -C /tmp/infra diff --stat

      - name: Create PR on groombook/infra
        env:
          TAG: ${{ inputs.tag }}
          GH_TOKEN: ${{ steps.infra-token.outputs.token }}
        run: |
          cd /tmp/infra
          git config user.name "groombook-engineer[bot]"
          git config user.email "3141748+groombook-engineer[bot]@users.noreply.github.com"
          git checkout -b "release/promote-prod-${TAG}"
          git add apps/groombook/overlays/prod/ apps/groombook/base/migrate-job.yaml apps/groombook/base/seed-job.yaml
          git commit -m "release: promote ${TAG} to production"
          git push -u origin "release/promote-prod-${TAG}"
          gh pr create \
            --repo groombook/infra \
            --base main \
            --head "release/promote-prod-${TAG}" \
            --title "release: promote ${TAG} to production" \
            --body "Promote image tag ${TAG} to production after UAT sign-off. cc @cpfarhood"

      - name: Delete existing completed Jobs before Flux reconciles
        env:
          TAG: ${{ inputs.tag }}
        run: |
          SHORT_SHA="${TAG##*-}"
          echo "Deleting completed Jobs with name suffix: $SHORT_SHA"
          kubectl delete job "migrate-schema-${SHORT_SHA}" -n groombook --ignore-not-found
          kubectl delete job "seed-test-data-${SHORT_SHA}" -n groombook --ignore-not-found
          echo "Jobs deleted, Flux will reconcile with fresh objects"

      - name: Notify on failure
        if: failure()
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: '## Production Promotion Failed\n\nThe `promote-prod` workflow failed. Check the workflow run logs for details.'
            });