deploy-lambda.yml

# Builds Docker images for all Lambda functions and pushes to ECR.
# Terraform (triggered at the end) updates the Lambda functions.
#
# Cloud-only: to-www, from-github (always active)
# Fallback: from-youtube, from-discogs, to-spotify, manage-playlists (for k3s failover)
#
# Requires GitHub secrets:
#   AWS_ACCESS_KEY_ID
#   AWS_SECRET_ACCESS_KEY

name: Deploy Lambda

on:
  push:
    branches: [master, marketplace]
  workflow_dispatch:

concurrency:
  group: deploy-lambda
  cancel-in-progress: true

env:
  AWS_REGION: eu-west-1

jobs:
  build-cloud:
    runs-on: ubuntu-24.04-arm
    strategy:
      fail-fast: false
      matrix:
        function: [to-www]
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Check if function changed
        id: check
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            CHANGED=$(git diff --name-only HEAD~1 HEAD -- functions/${{ matrix.function }}/ || echo "functions/${{ matrix.function }}/")
            if [ -n "$CHANGED" ]; then
              echo "changed=true" >> "$GITHUB_OUTPUT"
            else
              echo "changed=false" >> "$GITHUB_OUTPUT"
            fi
          fi

      - name: Configure AWS credentials
        if: steps.check.outputs.changed == 'true'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Get AWS account ID
        if: steps.check.outputs.changed == 'true'
        id: aws
        run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"

      - name: Login to ECR
        if: steps.check.outputs.changed == 'true'
        run: aws ecr get-login-password | docker login --username AWS --password-stdin ${{ steps.aws.outputs.account_id }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com

      - name: Build and push to ECR
        if: steps.check.outputs.changed == 'true'
        run: |
          IMAGE=${{ steps.aws.outputs.account_id }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ matrix.function }}:latest
          docker build -t ${{ matrix.function }} functions/${{ matrix.function }}
          docker tag ${{ matrix.function }}:latest $IMAGE
          docker push $IMAGE
          echo "Pushed ${{ matrix.function }}"

  build-from-github:
    # from-github is a Go zip Lambda (no Docker / ECR). The compiled bootstrap
    # is uploaded to s3://mirrorfm-lambda-artifacts-<account>/from-github/lambda.zip;
    # Terraform reads the latest object version and updates the Lambda.
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Check if from-github changed
        id: check
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          else
            CHANGED=$(git diff --name-only HEAD~1 HEAD -- functions/from-github/ || echo "functions/from-github/")
            if [ -n "$CHANGED" ]; then
              echo "changed=true" >> "$GITHUB_OUTPUT"
            else
              echo "changed=false" >> "$GITHUB_OUTPUT"
            fi
          fi

      - uses: actions/setup-go@v5
        if: steps.check.outputs.changed == 'true'
        with:
          go-version: '1.25'

      - name: Build zip
        if: steps.check.outputs.changed == 'true'
        working-directory: functions/from-github
        run: |
          GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -tags lambda.norpc -o bootstrap
          zip -j lambda.zip bootstrap

      - name: Configure AWS credentials
        if: steps.check.outputs.changed == 'true'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Get AWS account ID
        if: steps.check.outputs.changed == 'true'
        id: aws
        run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"

      - name: Upload zip to S3
        if: steps.check.outputs.changed == 'true'
        run: |
          aws s3 cp functions/from-github/lambda.zip \
            s3://mirrorfm-lambda-artifacts-${{ steps.aws.outputs.account_id }}/from-github/lambda.zip

  build-fallback:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2

      - name: Check which fallback functions changed
        id: check
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            echo "functions=from-youtube from-discogs to-spotify manage-playlists" >> "$GITHUB_OUTPUT"
          else
            CHANGED=""
            for func in from-youtube from-discogs to-spotify manage-playlists; do
              if git diff --name-only HEAD~1 HEAD -- "functions/${func}/" | grep -q .; then
                CHANGED="${CHANGED} ${func}"
              fi
            done
            echo "functions=${CHANGED}" >> "$GITHUB_OUTPUT"
          fi

      - name: Configure AWS credentials
        if: steps.check.outputs.functions != ''
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Get AWS account ID
        if: steps.check.outputs.functions != ''
        id: aws
        run: echo "account_id=$(aws sts get-caller-identity --query Account --output text)" >> "$GITHUB_OUTPUT"

      - name: Login to ECR
        if: steps.check.outputs.functions != ''
        run: aws ecr get-login-password | docker login --username AWS --password-stdin ${{ steps.aws.outputs.account_id }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com

      - name: Build and push changed fallback images to ECR
        if: steps.check.outputs.functions != ''
        run: |
          ACCOUNT_ID=${{ steps.aws.outputs.account_id }}
          for func in ${{ steps.check.outputs.functions }}; do
            echo "=== Building ${func} ==="
            IMAGE=${ACCOUNT_ID}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${func}:latest
            docker build -t ${func} -f functions/${func}/Dockerfile.aws functions/${func}
            docker tag ${func}:latest ${IMAGE}
            docker push ${IMAGE}
            echo "Pushed ${func}"
          done

  apply-terraform:
    needs: [build-cloud, build-from-github, build-fallback]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Trigger Terraform apply
        run: gh workflow run terraform.yml
        env:
          GH_TOKEN: ${{ github.token }}