deploy-python.yml

name: Deploy

on:
  workflow_call:
    inputs:
      runner-size:
        required: false
        type: string
        description: "Runner to use for the job (normal, or large)"
        default: "normal"
      use-arc-runners:
        required: false
        type: boolean
        default: true
        description: "Run on the self-hosted ARC arm64 runners (default in private repositories, never used in public ones). Set to false to run on the GitHub-hosted linux-arm64 runners."
      # DEPRECATED (no-op): all builds and CI run on arm64. Retained for backwards
      # compatibility with callers still passing it; the value is ignored and this
      # input will be removed in a future release.
      architecture:
        required: false
        type: string
        description: "[DEPRECATED] Ignored - all builds and CI run on arm64. No-op kept for backwards compatibility; will be removed in a future release."
        default: "arm64"
      stage:
        required: true
        type: string
        description: 'stage being released (dev,staging,production)'
      service-name:
        required: true
        type: string
        description: 'Proper name for your service i.e OCPP Service, Vehicle Service'
      service-emoji:
        required: true
        type: string
        description: 'An emoji to identify your service by :)'
      service-identifier:
        required: true
        type: string
        description: 'Identifier of the service being released i.e ocpp, vehicle, server, wallet.'
      region:
        required: false
        type: string
        default: "eu-west-1"
        description: 'AWS region to deploy to'
      docker-file-name:
        required: false
        type: string
        description: Name of the docker file to be built
        default: "Dockerfile"
      additional-build-args:
        required: false
        type: string
        description: 'Additional build arguments for Docker'
      ecr-repository-name:
        required: false
        type: string
        description: 'ECR repository name override'
      docker-compose-path:
        required: false
        type: string
        description: 'File path of the docker compose file'
      git-sha:
        required: false
        type: string
        description: 'Git SHA to checkout and build from. Defaults to the triggering commit SHA.'
    secrets:
      AWS_ACCOUNT_ID:
        required: true
        description: 'AWS Account ID for ECR and deployment access'
      GH_ACTION_ACCESS_KEY_ID:
        required: false
        description: "AWS access key for the S3 cache bucket, used on ARC. Without it ARC builds use the GitHub cache."
      GH_ACTION_SECRET_ACCESS_KEY:
        required: false
        description: "AWS secret key for the S3 cache bucket, used on ARC. Without it ARC builds use the GitHub cache."
      MANIFEST_REPO_PAT:
        required: true
        description: 'GitHub PAT to commit/push to kube-manifests repo'
      SLACK_APP_TOKEN:
        required: false
        description: 'DEPRECATED: no longer used. Kept only so existing callers do not fail validation; remove it from your secrets block.'
      SENTRY_AUTH_TOKEN:
        required: false
        description: 'Sentry auth token, passed as Docker build secret'
      AWS_CDN_ACCESS_KEY_ID:
        required: false
        description: 'CDN access key ID for S3 access, injected into Docker image'
      AWS_CDN_SECRET_ACCESS_KEY:
        required: false
        description: 'CDN secret access key for S3 access, injected into Docker image'
      TEST_ENV_FILE:
        required: false
        description: 'Environment variables for tests in .env format'

permissions:
  id-token: write
  contents: read
  actions: read

jobs:
  slack-token-deprecation:
    name: Deprecation check
    runs-on: ${{ github.event.repository.private && 'arc-arm64-1cpu-2gb-nodocker' || 'ubuntu-24.04-arm' }}
    steps:
      - name: Warn if deprecated SLACK_APP_TOKEN is provided
        env:
          SLACK_APP_TOKEN: ${{ secrets.SLACK_APP_TOKEN }}
        run: |
          if [ -n "$SLACK_APP_TOKEN" ]; then
            echo "::warning title=Deprecated secret::SLACK_APP_TOKEN is deprecated and no longer used by this workflow. Remove it from the secrets block of your caller workflow."
          fi

  test:
    name: Test
    uses: ./.github/workflows/component-test-python.yml
    with:
      runner-size: ${{ inputs.runner-size }}
      use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
      service-name: ${{ inputs.service-name }}
      service-emoji: ${{ inputs.service-emoji }}
      docker-compose-path: ${{ inputs.docker-compose-path }}
    secrets:
      TEST_ENV_FILE: ${{ secrets.TEST_ENV_FILE }}
  build:
    name: Build
    uses: ./.github/workflows/component-build.yml
    with:
      runner-size: ${{ inputs.runner-size }}
      use-arc-runners: ${{ (inputs.use-arc-runners && github.event.repository.private) }}
      stage: ${{ inputs.stage }}
      service-name: ${{ inputs.service-name }}
      service-emoji: ${{ inputs.service-emoji }}
      service-identifier: ${{ inputs.service-identifier }}
      region: ${{ inputs.region }}
      docker-file-name: ${{ inputs.docker-file-name }}
      additional-build-args: ${{ inputs.additional-build-args }}
      ecr-repository-name: ${{ inputs.ecr-repository-name }}
      git-sha: ${{ inputs.git-sha }}
    secrets:
      AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
      AWS_CDN_ACCESS_KEY_ID: ${{ secrets.AWS_CDN_ACCESS_KEY_ID }}
      AWS_CDN_SECRET_ACCESS_KEY: ${{ secrets.AWS_CDN_SECRET_ACCESS_KEY }}
      GH_ACTION_ACCESS_KEY_ID: ${{ secrets.GH_ACTION_ACCESS_KEY_ID }}
      GH_ACTION_SECRET_ACCESS_KEY: ${{ secrets.GH_ACTION_SECRET_ACCESS_KEY }}

  deploy:
    name: Deploy
    needs:
      - test
      - build
    uses: ./.github/workflows/component-deploy.yml
    with:
      service-name: ${{ inputs.service-name }}
      service-emoji: ${{ inputs.service-emoji }}
      service-identifier: ${{ inputs.service-identifier }}
      stage: ${{ inputs.stage }}
      image-tag: ${{ needs.build.outputs.image-tag }}
    secrets:
      MANIFEST_REPO_PAT: ${{ secrets.MANIFEST_REPO_PAT }}