deploy-script.yml

name: Run Migration Script 🗒️

on:
  workflow_dispatch:
    inputs:
      script_name:
        description: 'Select migration script to run'
        required: true
        type: choice
        options:
          - 'migrate-inquiry-threads'
      environment:
        description: 'Target environment'
        required: true
        type: choice
        default: 'production'
        options:
          - 'development'
          - 'production'
      dry_run:
        description: 'Perform a dry run (preview changes only)'
        required: false
        type: boolean
        default: true

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  deploy-script:
    name: Deploy Migration Script
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: 'Checkout GitHub Action'
        uses: actions/checkout@main

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: 'pnpm'
          cache-dependency-path: './pnpm-lock.yaml'

      - name: Install dependencies
        run: pnpm install

      - name: Assume AWS Role
        uses: aws-actions/configure-aws-credentials@v5
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Get SSM Parameters
        id: get-ssm-parameters
        env:
          AWS_REGION: us-east-1
        run: |
          MONGODB_URL=$(aws ssm get-parameter --name MONGODB_CONNECTION_STRING --with-decryption --query 'Parameter.Value' | tr -d '"')
          MONGODB_USER=$(aws ssm get-parameter --name MONGODB_USER --with-decryption --query 'Parameter.Value' | tr -d '"')
          MONGODB_PASSWORD=$(aws ssm get-parameter --name MONGODB_PASSWORD --with-decryption --query 'Parameter.Value' | tr -d '"')

          echo "MONGODB_URL=$MONGODB_URL" >> $GITHUB_ENV
          echo "MONGODB_USER=$MONGODB_USER" >> $GITHUB_ENV
          echo "MONGODB_PASSWORD=$MONGODB_PASSWORD" >> $GITHUB_ENV

      - name: Get the public IP of this runner
        id: get_gh_runner_ip
        shell: bash
        run: |
          echo "ip_address=$(curl https://checkip.amazonaws.com)" >> "$GITHUB_OUTPUT"

      - name: Setup MongoDB Atlas cli
        uses: mongodb/atlas-github-action@v0.2.1

      - name: Add runner IP to MongoDB access list
        shell: bash
        env:
          MONGODB_ATLAS_PUBLIC_API_KEY: ${{ secrets.MONGODB_ATLAS_PUBLIC_API_KEY }}
          MONGODB_ATLAS_PRIVATE_API_KEY: ${{ secrets.MONGODB_ATLAS_PRIVATE_API_KEY }}
          MONGODB_ATLAS_PROJECT_ID: ${{ secrets.MONGODB_ATLAS_PROJECT_ID }}
        run: |
          atlas accessLists create ${{ steps.get_gh_runner_ip.outputs.ip_address }} --type ipAddress --projectId $MONGODB_ATLAS_PROJECT_ID --comment "GitHub Actions Script Runner"

      - name: Wait for MongoDB access list to update
        shell: bash
        run: |
          sleep 30

      - name: Run Migration Script (Dry Run)
        if: ${{ inputs.dry_run == true }}
        run: |
          echo "🔍 Running dry run for script: ${{ inputs.script_name }}"
          echo "Executing in dry run mode (no changes will be applied)..."
          pnpm run db:script
        env:
          NODE_ENV: ${{ inputs.environment }}
          SCRIPT: ${{ inputs.script_name }}
          MONGODB_URL: ${{ env.MONGODB_URL }}
          MONGODB_USER: ${{ env.MONGODB_USER }}
          MONGODB_PASSWORD: ${{ env.MONGODB_PASSWORD }}

      - name: Run Migration Script
        if: ${{ inputs.dry_run == false }}
        run: |
          echo "Executing script: ${{ inputs.script_name }}"
          echo "Applying changes to database..."
          pnpm run db:script -- --apply
          echo "Script execution completed successfully"
        env:
          NODE_ENV: ${{ inputs.environment }}
          SCRIPT: ${{ inputs.script_name }}
          MONGODB_URL: ${{ env.MONGODB_URL }}
          MONGODB_USER: ${{ env.MONGODB_USER }}
          MONGODB_PASSWORD: ${{ env.MONGODB_PASSWORD }}

      - name: Remove runner IP from MongoDB access list
        if: always()
        shell: bash
        env:
          MONGODB_ATLAS_PUBLIC_API_KEY: ${{ secrets.MONGODB_ATLAS_PUBLIC_API_KEY }}
          MONGODB_ATLAS_PRIVATE_API_KEY: ${{ secrets.MONGODB_ATLAS_PRIVATE_API_KEY }}
          MONGODB_ATLAS_PROJECT_ID: ${{ secrets.MONGODB_ATLAS_PROJECT_ID }}
        run: |
          atlas accessLists delete ${{ steps.get_gh_runner_ip.outputs.ip_address }} --projectId $MONGODB_ATLAS_PROJECT_ID --force