Deployment Workflows

on:
  push:
    branches: [staging]

environment: dev

- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-region: us-east-1

- name: Setup Terraform
  uses: hashicorp/setup-terraform@v3
  with:
    terraform_version: "1.6.0"

- name: Setup kubectl
  uses: azure/setup-kubectl@v3
  with:
    version: 'v1.28.0'

aws eks update-kubeconfig --name govtech-dev --region us-east-1

kubectl apply -f kubernetes/namespace.yaml
kubectl apply -f kubernetes/configmap.yaml
kubectl apply -f kubernetes/backend/deployment.yaml
kubectl apply -f kubernetes/backend/service.yaml
kubectl apply -f kubernetes/frontend/deployment.yaml
kubectl apply -f kubernetes/frontend/service.yaml

kubectl rollout status deployment/backend -n govtech --timeout=300s
kubectl rollout status deployment/frontend -n govtech --timeout=300s

echo "Verificando pods..."
kubectl get pods -n govtech

echo "Verificando services..."
kubectl get services -n govtech

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Tag o SHA de la imagen a desplegar'
        required: true
        default: 'latest'
      confirm:
        description: 'Escribe DEPLOY para confirmar'
        required: true

validate:
  name: Validar confirmacion
  runs-on: ubuntu-latest
  steps:
    - name: Verificar confirmacion
      run: |
        if [ "${{ github.event.inputs.confirm }}" != "DEPLOY" ]; then
          echo "ERROR: Debes escribir DEPLOY para confirmar"
          exit 1
        fi
        echo "Confirmacion valida - iniciando deploy a produccion"

deploy:
  name: Deploy Blue-Green a Produccion
  needs: validate
  runs-on: ubuntu-latest
  environment: production

kubectl set image deployment/backend \
  backend=$ECR_REGISTRY/govtech-backend:$IMAGE_TAG \
  -n govtech \
  --record

kubectl set image deployment/frontend \
  frontend=$ECR_REGISTRY/govtech-frontend:$IMAGE_TAG \
  -n govtech \
  --record

kubectl rollout status deployment/backend -n govtech --timeout=600s
kubectl rollout status deployment/frontend -n govtech --timeout=600s

# Get pod status
kubectl get pods -n govtech

# Check ready replicas
BACKEND_READY=$(kubectl get deployment backend -n govtech -o jsonpath='{.status.readyReplicas}')
FRONTEND_READY=$(kubectl get deployment frontend -n govtech -o jsonpath='{.status.readyReplicas}')

echo "Backend pods listos: $BACKEND_READY"
echo "Frontend pods listos: $FRONTEND_READY"

if [ "$BACKEND_READY" -lt "2" ]; then
  echo "ERROR: Backend no tiene suficientes replicas listas"
  exit 1
fi

echo "Version ${{ github.event.inputs.version }} desplegada en produccion"
echo "Por: ${{ github.actor }}"
echo "Fecha: $(date -u)"

Version abc123456 desplegada en produccion
Por: admin-user
Fecha: 2026-03-03 14:23:45 UTC

rollback:
  name: Rollback (si deploy falla)
  needs: deploy
  if: failure()
  runs-on: ubuntu-latest
  environment: production

echo "Deploy fallido - ejecutando rollback automatico..."
kubectl rollout undo deployment/backend -n govtech
kubectl rollout undo deployment/frontend -n govtech
kubectl rollout status deployment/backend -n govtech --timeout=300s
kubectl rollout status deployment/frontend -n govtech --timeout=300s
echo "Rollback completado - version anterior restaurada"

Name: dev
Protection Rules:
  - Required reviewers: None
  - Wait timer: 0 minutes
  - Deployment branches: staging
Secrets:
  - AWS_ACCESS_KEY_ID
  - AWS_SECRET_ACCESS_KEY
  - DB_PASSWORD

Name: production
Protection Rules:
  - Required reviewers: [platform-admin, tech-lead]
  - Wait timer: 5 minutes
  - Deployment branches: main only
Secrets:
  - AWS_ACCESS_KEY_ID
  - AWS_SECRET_ACCESS_KEY
  - DB_PASSWORD_PROD

apiVersion: v1
kind: Namespace
metadata:
  name: govtech

spec:
  replicas: 2  # Production
  replicas: 1  # Dev
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1

1. Push to staging branch
2. GitHub Actions triggered (instant)
3. Terraform apply (60-90 seconds)
4. Kubernetes apply (10 seconds)
5. Rollout wait (120-180 seconds)
6. Smoke tests (5 seconds)

Total: ~4 minutes

1. Trigger workflow_dispatch
2. Enter version and type DEPLOY
3. Manual approval wait (human time)
4. Deploy GREEN version (10 seconds)
5. Rollout wait (300-600 seconds)
6. Health checks (5 seconds)
7. Traffic switch (automatic)

Total: ~10 minutes (excluding approval wait)

# Handled by rollback job automatically

# Check revision history
kubectl rollout history deployment/backend -n govtech

# Rollback to previous version
kubectl rollout undo deployment/backend -n govtech
kubectl rollout undo deployment/frontend -n govtech

# Rollback to specific revision
kubectl rollout undo deployment/backend -n govtech --to-revision=3

# Watch pod status
kubectl get pods -n govtech -w

# View deployment status
kubectl rollout status deployment/backend -n govtech

# Check deployment events
kubectl describe deployment backend -n govtech

# View pod logs
kubectl logs -f deployment/backend -n govtech

# Check service endpoints
kubectl get svc -n govtech

# Check pod status
kubectl get pods -n govtech

# View pod events
kubectl describe pod <pod-name> -n govtech

# Check logs
kubectl logs <pod-name> -n govtech

# Run plan locally
cd terraform/environments/dev
terraform plan

# Check state
terraform state list

# Force unlock (use with caution)
terraform force-unlock <lock-id>

# Refresh state
terraform refresh

# Check rollout history
kubectl rollout history deployment/backend -n govtech

# Rollback to specific known-good revision
kubectl rollout undo deployment/backend -n govtech --to-revision=5

# Or manually set image to previous version
kubectl set image deployment/backend \
  backend=<ECR_REGISTRY>/govtech-backend:<PREVIOUS_SHA>