name: Deploy to S3

# main only. Everything else is covered by ci.yml, which runs the same checks
# without deploying.
on:
  push:
    branches:
       - main

jobs:
  # Nothing was verified before this existed: a frontend that failed to compile
  # would zip and ship exactly like a working one. `deploy` now needs this job,
  # so a red main does not reach the bucket.
  checks:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      # 22 to match frontend/Dockerfile, so CI resolves the same tree the
      # production image builds from.
      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: '22'

      # 3.11 is the floor in pyproject.toml and the version the project's conda
      # env runs.
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
          pip install -r backend/requirements.txt

      - name: Run checks
        run: bash scripts/ci-checks.sh

  deploy:
    needs: checks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      # frontend/node_modules is excluded, and that is safe because of what
      # happens to this object downstream. CodeDeploy pulls it, extracts to
      # /opt/codedeploy-extracted-5, copies the tree to
      # /home/ec2-user/utopia-ai-hr-ats-portal-deployment-group and runs
      # `docker compose --env-file ./backend/.env up -d --build`. The only Node
      # service is the frontend, whose image does `npm ci` from the lockfile,
      # and frontend/.dockerignore excludes node_modules/ from the build context
      # outright. So the committed tree was carried into every artifact and then
      # thrown away unread. It was 90 MB of a 33 MB compressed upload.
      #
      # node_modules is still tracked in git, which is the reason it was here at
      # all. Untracking it is a separate change and affects other branches.
      - name: Archive project
        run: |
          apt-get update -y
          apt-get install -y zip
          zip -r utopia-ai-hr-ats-portal.zip . \
            -x ".git/*" \
            -x ".gitea/*" \
            -x ".gitignore" \
            -x "frontend/node_modules/*" \
            -x "*.DS_Store"

      - name: Install AWS CLI
        run: |
          apt-get update -y
          apt-get install -y curl unzip
          curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
          unzip -q awscliv2.zip
          ./aws/install
          aws --version

      # The credentials live only on this step. There used to be a separate
      # "Configure AWS credentials" step above that set the same three variables
      # and then only echoed a message — env: is scoped to its own step, so
      # those values were discarded before anything could use them. It was doing
      # nothing, and it read as though credentials were set up globally.
      - name: Upload files to S3
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.DEVOPS_USER_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.DEVOPS_USER_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          echo "Uploading repo contents to S3..."
          aws s3 cp utopia-ai-hr-ats-portal.zip s3://utopia-ai-s3-repo-bucket/utopia-ai-hr-ats-portal.zip