deploy.yml

name: Deploy

on:
  push:
    branches:
      - main
    tags:
      - "*"
    paths:
      - ".github/workflows/deploy.yml"
      - "cmd/**"
      - "deploy/**"
      - "pkg/**"
  pull_request:
    branches: [main]
  workflow_run:
    workflows: [Releaser]
    types: [completed]
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout

jobs:
  # always deploy to staging
  staging:
    uses: ./.github/workflows/terraform.yml
    with:
      env: staging
      workspace: staging
      did: did:web:staging.indexer.storacha.network
      apply: ${{ github.event_name != 'pull_request' }}
    secrets:
      aws-account-id: ${{ secrets.STAGING_AWS_ACCOUNT_ID }}
      aws-region: ${{ secrets.STAGING_AWS_REGION }}
      private-key: ${{ secrets.STAGING_PRIVATE_KEY }}
      honeycomb-api-key: ${{ secrets.STAGING_HONEYCOMB_API_KEY }}

  # deploy to prod on new releases
  production:
    if: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' }}
    uses: ./.github/workflows/terraform.yml
    with:
      env: production
      workspace: prod
      did: did:web:indexer.storacha.network
      apply: true
    secrets:
      aws-account-id: ${{ secrets.PROD_AWS_ACCOUNT_ID }}
      aws-region: ${{ secrets.PROD_AWS_REGION }}
      private-key: ${{ secrets.PROD_PRIVATE_KEY }}
      honeycomb-api-key: ${{ secrets.PROD_HONEYCOMB_API_KEY }}