deploy.yml

name: "Deploy"
env:
  CACHE_NAME: marlowe-temp
  ALLOWED_URIS: "https://github.com https://api.github.com"
  TRUSTED_PUBLIC_KEYS: "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ= marlowe-temp.cachix.org-1:1gPjVFpu4QjaAT3tRurCioX+BC23V7mjvFwpP5bV0Ec= loony-tools:pr9m4BkM/5/eSTZlkQyRt57Jz7OMBxNSUiMC4FkcNfk="
  SUBSTITUTERS: "https://cache.nixos.org/ https://cache.iog.io https://marlowe-temp.cachix.org https://cache.zw3rk.com/"
  VAULT_ADDR: "https://vault.dapps.aws.iohkdev.io"
  NOMAD_ADDR: "https://nomad.dapps.aws.iohkdev.io"
  NOMAD_NAMESPACE: "marlowe"

on:
  push:
    branches:
      - main
    tags:
      - runtime@v*
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Install Nix
        uses: cachix/install-nix-action@v21
        with:
          nix_path: nixpkgs=channel:nixos-unstable
          install_url: https://releases.nixos.org/nix/nix-2.10.3/install
          extra_nix_config: |
            allowed-uris = ${{ env.ALLOWED_URIS }}
            trusted-public-keys = ${{ env.TRUSTED_PUBLIC_KEYS }}
            substituters = ${{ env.SUBSTITUTERS }}
            experimental-features = nix-command flakes

      - name: Build images and copy to local Docker registry
        run: |
          nix build .#oci-images.x86_64-linux.all.copyToDockerDaemon
          ./result/bin/copy-to-docker-daemon

      - name: Authenticate with container registry
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin

      - name: Tag and push images
        run: |
          tagAndPush() {
            IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$1
            # Change all uppercase to lowercase
            IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
            # Strip git ref prefix from version
            TAG=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
            # Strip "runtime@v" prefix from tag name
            [[ "${{ github.ref }}" == "refs/tags/"* ]] && TAG=$(echo $TAG | sed -e 's/^runtime@v//')
            # Use Docker `latest` tag convention
            [ "$TAG" == "main" ] && TAG=latest
            echo IMAGE_ID=$IMAGE_ID
            echo TAG=$TAG
            docker tag $1:latest $IMAGE_ID:$TAG
            docker push $IMAGE_ID:$TAG
          }
          tagAndPush "marlowe-chain-indexer"
          tagAndPush "marlowe-chain-sync"
          tagAndPush "marlowe-indexer"
          tagAndPush "marlowe-sync"
          tagAndPush "marlowe-contract"
          tagAndPush "marlowe-tx"
          tagAndPush "marlowe-proxy"
          tagAndPush "marlowe-web-server"

  deploy:
    if: github.ref_name == 'main'
    strategy:
      matrix:
        network: [ preview, preprod, mainnet ]
    needs: [publish]
    runs-on: ubuntu-latest
    steps:
      - name: Install Nix
        uses: cachix/install-nix-action@v21
        with:
          nix_path: nixpkgs=channel:nixos-unstable
          install_url: https://releases.nixos.org/nix/nix-2.10.3/install
          extra_nix_config: |
            allowed-uris = ${{ env.ALLOWED_URIS }}
            trusted-public-keys = ${{ env.TRUSTED_PUBLIC_KEYS }}
            substituters = ${{ env.SUBSTITUTERS }}
            experimental-features = nix-command flakes

      - name: Setup Cachix
        uses: cachix/cachix-action@v12
        with:
          name: ${{ env.CACHE_NAME }}
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build nomad chart
        run: |
          # TODO[iogx] must be tested again when PR is merged
          nix build \
            github:input-output-hk/dapps-world#marlowe.marlowe-runtime-${{ matrix.network }} \
            --override-input marlowe-cardano github:input-output-hk/marlowe-cardano/$GITHUB_SHA

      - name: Install Nomad
        run: |
          nix-env -iA nomad -f '<nixpkgs>'

      - name: Deploy to Nomad
        run: |
          nomad stop -token ${{ secrets.NOMAD_TOKEN }} marlowe-runtime-${{ matrix.network }}
          nomad run -token ${{ secrets.NOMAD_TOKEN }} -vault-token ${{ secrets.VAULT_TOKEN }} -consul-token ${{ secrets.CONSUL_HTTP_TOKEN }} result/job