deploy-stage.yml

parameters:
  - name: jinja_templates
    type: object
  - name: depends_on
    type: object
  - name: stage_name
  - name: apigee_organization
  - name: environment
    values:
      - internal-dev
      - internal-dev-sandbox
      - internal-qa
      - internal-qa-sandbox
      - ref
      - dev
      - int
      - sandbox
      - prod
  - name: aws_account
  - name: service_name
  - name: short_service_name
  - name: fully_qualified_service_name
  - name: service_base_path
  - name: pr_label
    default: ''
  - name: secret_file_ids
    type: object
  - name: secret_ids
    type: object
  - name: config_ids
    type: object
  - name: proxy_path
  - name: product_display_name
  - name: product_description
  - name: spec_file
  - name: portal_api_requires_callback_url
  - name: make_spec_visible
  - name: friendly_api_name
  - name: ping
    type: boolean
  - name: pre_template
    type: stepList
  - name: post_template
    type: stepList
  - name: pre_deploy
    type: stepList
  - name: post_deploy
    type: stepList
  - name: notify
    type: boolean
    default: false
  - name: enable_monitoring
    type: boolean
  - name: enable_status_monitoring
    type: boolean
  - name: hosted_target_connection_path_suffix
    type: string
  - name: hosted_target_healthcheck_suffix
    type: string
  - name: _expose_blacklist
    type: object
    default:
      - _expose_blacklist
      - pre_template
      - post_template
      - pre_deploy
      - post_deploy
      - secret_file_ids
      - secret_ids
      - config_ids
      - depends_on
      - jinja_templates
  - name: python_version
    type: string
  - name: agent_pool
    type: string

stages:
  - stage: ${{ parameters.stage_name }}
    dependsOn: ${{ parameters.depends_on }}
    jobs:
      - deployment: deploy
        environment: ${{ parameters.environment }}
        pool:
          name: ${{ parameters.agent_pool }}
        workspace:
          clean: all
        strategy:
          runOnce:
            deploy:
              steps:
                - download: none

                - bash: |
                    if [ ! -z "$(ls -A \"$(Pipeline.Workspace)/s/${{ parameters.service_name }}\" 2>/dev/null)" ]; then
                      echo "workspace directory is not empty!"
                      exit 1
                    fi
                  displayName: "check workspace is clean"

                - task: DownloadPipelineArtifact@2
                  inputs:
                    source: "specific"
                    project: $(resources.pipeline.build_pipeline.projectID)
                    pipeline: $(resources.pipeline.build_pipeline.pipelineID)
                    preferTriggeringPipeline: true
                    runVersion: "latestFromBranch"
                    runBranch: $(Build.SourceBranch)
                    path: "$(Pipeline.Workspace)/s/${{ parameters.service_name }}"

                - bash: |
                    instance_id="$(curl -s http://169.254.169.254/latest/meta-data/instance-id)"
                    echo instance-id: "${instance_id}"
                    echo connect to: https://eu-west-2.console.aws.amazon.com/systems-manager/session-manager/${instance_id}
                    echo sudo su - ubuntu
                    or
                    echo ssh ubuntu@${instance_id}
                    echo working directory: $(System.DefaultWorkingDirectory)
                  displayName: print aws info

                - template: ../components/aws-assume-role.yml
                  parameters:
                    role: "auto-ops"
                    profile: "apm_${{ parameters.aws_account }}"
                    aws_account: "${{ parameters.aws_account }}"

                - task: UsePythonVersion@0
                  displayName: "Use Python ${{ parameters.python_version }}"
                  inputs:
                    versionSpec: ${{ parameters.python_version }}

                - template: "../components/set-facts.yml"
                  parameters:
                    service_name: ${{ parameters.service_name }}
                    secret_file_ids:
                      - ${{ each secret_file_id in parameters.secret_file_ids }}:
                          - ${{ secret_file_id }}
                    secret_ids:
                      - ${{ parameters.aws_account }}/azure-devops/apigee-${{ parameters.apigee_organization }}/APIGEE_OTP_KEY
                      - ${{ parameters.aws_account }}/azure-devops/apigee-${{ parameters.apigee_organization }}/APIGEE_PASSWORD
                      - ${{ parameters.aws_account }}/azure-devops/MONITORING_API_KEY
                      - ${{ parameters.aws_account }}/access-tokens/github/repo-status-update/GITHUB_ACCESS_TOKEN
                      - ${{ parameters.aws_account }}/monitoring/status-endpoint-api-key
                      - ${{ each secret_id in parameters.secret_ids }}:
                          - ${{ secret_id }}
                    config_ids:
                      - /${{ parameters.aws_account }}/azure-devops/apigee-${{ parameters.apigee_organization }}/APIGEE_USERNAME
                      - /${{ parameters.aws_account }}/azure-devops/env-${{ parameters.environment }}/ENV_URL
                      - /${{ parameters.aws_account }}/azure-devops/env-${{ parameters.environment }}/IDENTITY_URL
                      - /${{ parameters.aws_account }}/azure-devops/GITHUB_USER
                      - ${{ each config_id in parameters.config_ids }}:
                          - ${{ config_id }}
                    aws_account: ${{ parameters.aws_account }}
                    apigee_organization: ${{ parameters.apigee_organization }}

                - ${{ if parameters.notify }}:
                  - bash: |
                      if [[ -z $(NOTIFY_COMMIT_SHA) ]]; then
                          export NOTIFY_COMMIT_SHA=`echo "$(Build.SourceVersionMessage)" | cut -d' ' -f2`
                          echo "##vso[task.setvariable variable=NOTIFY_COMMIT_SHA]$NOTIFY_COMMIT_SHA"
                      else
                          echo "##[debug]Using already provided NOTIFY_COMMIT_SHA=$(NOTIFY_COMMIT_SHA)"
                      fi
                    displayName: Set NOTIFY_COMMIT_SHA

                  - template: '../components/update-github-status.yml'
                    parameters:
                      state: pending
                      description: "Deploy to ${{ parameters.environment }} started"
                      environment: ${{ parameters.environment }}

                - ${{ each param in parameters }}:
                  - ${{ if not(containsValue(parameters._expose_blacklist, param.key)) }}:
                    - bash: |
                        set -euo pipefail
                        echo "##vso[task.setvariable variable=${{ upper(param.key) }}]${{ param.value }}"
                      displayName: Setting ${{ upper(param.key) }}=${{ param.value }}

                - bash: |
                    set -euo pipefail
                    echo "For backward compatibility..."
                    echo "##vso[task.setvariable variable=APIGEE_ENVIRONMENT]${{ parameters.environment }}"
                  displayName: Setting APIGEE_ENVIRONMENT=${{ parameters.environment }}

                - bash: |
                    set -euo pipefail
                    if [[ ! -z $(UTILS_PR_NUMBER) ]]; then
                      export PR_LABEL="utils-pr-$(UTILS_PR_NUMBER)"
                      echo "##[debug]Triggered from utils repository, PR_LABEL=${PR_LABEL}"
                      echo "##vso[task.setvariable variable=PR_LABEL]${PR_LABEL}"
                    else
                      echo "##[debug]PR_NUMBER=${{ parameters.pr_label }}"
                      echo "##vso[task.setvariable variable=PR_LABEL]${{ parameters.pr_label }}"
                    fi
                  displayName: Override PR_LABEL

                - bash: |
                    set -euo pipefail
                    if [[ ! -z $(UTILS_PR_NUMBER) ]]; then
                      if [[ "${{ parameters.proxy_path }}" == "live" ]]; then
                        export FULLY_QUALIFIED_SERVICE_NAME="${{ parameters.service_name }}-$(PR_LABEL)"
                        echo "##vso[task.setvariable variable=FULLY_QUALIFIED_SERVICE_NAME]${FULLY_QUALIFIED_SERVICE_NAME}"
                      else
                        export FULLY_QUALIFIED_SERVICE_NAME="${{ parameters.service_name }}-$(PR_LABEL)-${{ parameters.proxy_path }}"
                        echo "##vso[task.setvariable variable=FULLY_QUALIFIED_SERVICE_NAME]${FULLY_QUALIFIED_SERVICE_NAME}"
                      fi
                      echo "##[debug]Triggered from utils repository, FULLY_QUALIFIED_SERVICE_NAME=${FULLY_QUALIFIED_SERVICE_NAME}"
                    else
                      echo "##[debug]FULLY_QUALIFIED_SERVICE_NAME=${{ parameters.fully_qualified_service_name }}"
                      echo "##vso[task.setvariable variable=FULLY_QUALIFIED_SERVICE_NAME]${{ parameters.fully_qualified_service_name }}"
                    fi
                  displayName: Override FULLY_QUALIFIED_SERVICE_NAME

                - bash: |
                    set -euo pipefail
                    if [[ ! -z $(UTILS_PR_NUMBER) ]]; then
                      export SERVICE_BASE_PATH="${{ parameters.service_base_path }}"
                      export SERVICE_BASE_PATH=${SERVICE_BASE_PATH/-pr-*/}-$(PR_LABEL)
                      echo "##vso[task.setvariable variable=SERVICE_BASE_PATH]${SERVICE_BASE_PATH}"
                      echo "##[debug]Triggered from utils repository, SERVICE_BASE_PATH=${SERVICE_BASE_PATH}"
                    else
                      echo "##[debug]SERVICE_BASE_PATH=${{ parameters.service_base_path }}"
                      echo "##vso[task.setvariable variable=SERVICE_BASE_PATH]${{ parameters.service_base_path }}"
                    fi
                  displayName: Override SERVICE_BASE_PATH

                - bash: |
                    set -euo pipefail

                    INFO=$(curl https://api-registry.prod.api.platform.nhs.uk:9000/api/${{ parameters.service_name }})
                    SHORT_NAME=$(echo $INFO | jq -r .short_name)
                    GUID=$(echo $INFO | jq -r .guid)

                    echo "##[debug]Fetched info from API Registry"
                    echo "##[debug]short_name: $SHORT_NAME"
                    echo "##[debug]guid: $GUID"

                    if [[ $SHORT_NAME != "${{ parameters.short_service_name }}" ]]; then
                      echo "##[warning]Short name provided to pipeline (${{ parameters.short_service_name }}) does not match name in registry ($SHORT_NAME)"
                      echo "##vso[task.logissue type=warning]Short name provided to pipeline (${{ parameters.short_service_name }}) does not match name in registry ($SHORT_NAME)"
                    fi
                  displayName: Check supplied names against API registry
                  continueOnError: true
                
                - template: '../templates/deploy-service.yml'
                  parameters:
                    service_name: ${{ parameters.service_name }}
                    short_service_name: ${{ parameters.short_service_name }}
                    fully_qualified_service_name: $(FULLY_QUALIFIED_SERVICE_NAME)
                    service_base_path: $(SERVICE_BASE_PATH)
                    stage_name: ${{ parameters.stage_name }}
                    jinja_templates: ${{ parameters.jinja_templates }}
                    apigee_environment: ${{ parameters.environment }}
                    apigee_organization: ${{ parameters.apigee_organization }}
                    product_display_name: ${{ parameters.product_display_name }}
                    product_description: ${{ parameters.product_description }}
                    hosted_target_connection_path_suffix: ${{ parameters.hosted_target_connection_path_suffix }}
                    hosted_target_healthcheck_suffix: ${{ parameters.hosted_target_healthcheck_suffix }}
                    proxy_path: ${{ parameters.proxy_path }}
                    pre_template: ${{ parameters.pre_template }}
                    post_template: ${{ parameters.post_template }}
                    pre_deploy: ${{ parameters.pre_deploy }}
                    post_deploy: ${{ parameters.post_deploy }}
                    ping: ${{ parameters.ping }}
                    enable_monitoring: ${{ parameters.enable_monitoring }}
                    enable_status_monitoring : ${{ parameters.enable_status_monitoring  }}
                    portal_api_requires_callback_url: ${{ parameters.portal_api_requires_callback_url }}
                    make_spec_visible: ${{ parameters.make_spec_visible }}
                    friendly_api_name: ${{ parameters.friendly_api_name }}
                    spec_file: ${{ parameters.spec_file }}
                    pr_label: $(PR_LABEL)
                    aws_account: ${{ parameters.aws_account }}

                - ${{ if parameters.notify }}:
                  - template: '../components/update-github-status.yml'
                    parameters:
                      state: success
                      on_success: true
                      description: "Deploy to ${{ parameters.environment }} succeeded"
                      environment: ${{ parameters.environment }}

                  - template: '../components/update-github-status.yml'
                    parameters:
                      state: failure
                      on_failure: true
                      description: "Deploy to ${{ parameters.environment }} failed"
                      environment: ${{ parameters.environment }}