ami-release-nix-single.yml

name: Release Single AMI Nix

on:
  workflow_dispatch:
    inputs:
      postgres_version:
        description: 'PostgreSQL major version to build (e.g. 15)'
        required: true
        type: string
      branch:
        description: 'Branch to run the workflow from'
        required: true
        type: string
        default: 'main'

permissions:
  contents: write
  id-token: write

jobs:
  build:
    runs-on: large-linux-arm
    timeout-minutes: 150

    steps:
      - name: Checkout Repo
        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
        with:
          ref: ${{ github.event.inputs.branch }}

      - name: aws-creds
        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5.1.1
        with:
          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
          aws-region: "us-east-1"
          output-credentials: true
          role-duration-seconds: 7200

      - name: Get current branch SHA
        id: get_sha
        run: |
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Install nix
        uses: ./.github/actions/nix-install-ephemeral
        with:
          push-to-cache: 'true'
        env:
          DEV_AWS_ROLE: ${{ secrets.DEV_AWS_ROLE }}
          NIX_SIGN_SECRET_KEY: ${{ secrets.NIX_SIGN_SECRET_KEY }}

      - name: Build AMI
        id: build-ami
        uses: ./.github/actions/build-ami
        with:
          postgres_version: ${{ github.event.inputs.postgres_version }}
          region: us-east-1
          ami_regions: '["us-east-1"]'
          git_sha: ${{ steps.get_sha.outputs.sha }}

      - name: Grab release version
        id: process_release_version
        run: |
          VERSION="${{ steps.build-ami.outputs.postgres_release_version }}"
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"

      - name: Create nix flake revision tarball
        run: |
          GIT_SHA=${{ steps.get_sha.outputs.sha }}
          MAJOR_VERSION=${{ github.event.inputs.postgres_version }}

          mkdir -p "/tmp/pg_upgrade_bin/${MAJOR_VERSION}"
          echo "$GIT_SHA" >> "/tmp/pg_upgrade_bin/${MAJOR_VERSION}/nix_flake_version"
          tar -czf "/tmp/pg_binaries.tar.gz" -C "/tmp/pg_upgrade_bin" .

      - name: configure aws credentials - staging
        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5.1.1
        with:
          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
          aws-region: "us-east-1"

      - name: Upload software manifest to s3 staging
        run: |
          cd ansible
          ansible-playbook -i localhost \
            -e "ami_release_version=${{ steps.process_release_version.outputs.version }}" \
            -e "internal_artifacts_bucket=${{ secrets.ARTIFACTS_BUCKET }}" \
            -e "postgres_major_version=${{ github.event.inputs.postgres_version }}" \
            manifest-playbook.yml

      - name: Upload nix flake revision to s3 staging
        run: |
          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz

      - name: configure aws credentials - prod
        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5.1.1
        with:
          role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
          aws-region: "us-east-1"

      - name: Upload software manifest to s3 prod
        run: |
          cd ansible
          ansible-playbook -i localhost \
            -e "ami_release_version=${{ steps.process_release_version.outputs.version }}" \
            -e "internal_artifacts_bucket=${{ secrets.PROD_ARTIFACTS_BUCKET }}" \
            -e "postgres_major_version=${{ github.event.inputs.postgres_version }}" \
            manifest-playbook.yml
    
      - name: Upload nix flake revision to s3 prod
        run: |
          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/20.04.tar.gz
          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/24.04.tar.gz
          aws s3 cp /tmp/pg_binaries.tar.gz s3://${{ secrets.PROD_ARTIFACTS_BUCKET }}/upgrades/postgres/supabase-postgres-${{ steps.process_release_version.outputs.version }}/upgrade_bundle.tar.gz

      - name: Create release
        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
        with:
          name: ${{ steps.process_release_version.outputs.version }}
          tag_name: ${{ steps.process_release_version.outputs.version }}
          target_commitish: ${{ steps.get_sha.outputs.sha }}

      - name: Slack Notification on Failure
        if: ${{ failure() }}
        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
          SLACK_USERNAME: 'gha-failures-notifier'
          SLACK_COLOR: 'danger'
          SLACK_MESSAGE: 'Building Postgres AMI failed'
          SLACK_FOOTER: ''

      - name: Cleanup resources after build
        if: ${{ always() }}
        run: |
          EXECUTION_ID="${{ steps.build-ami.outputs.execution_id }}"
          aws ec2 describe-instances --filters "Name=tag:packerExecutionId,Values=${EXECUTION_ID}" --query "Reservations[].Instances[].InstanceId" --output text | xargs -r aws ec2 terminate-instances --instance-ids

      - name: Cleanup resources on build cancellation
        if: ${{ cancelled() }}
        run: |
          EXECUTION_ID="${{ steps.build-ami.outputs.execution_id }}"
          aws ec2 describe-instances --filters "Name=tag:packerExecutionId,Values=${EXECUTION_ID}" --query "Reservations[].Instances[].InstanceId" --output text | xargs -r aws ec2 terminate-instances --instance-ids