manual.yml

---
name: Manual Release
on:
  workflow_dispatch:
    inputs:
      environment:
        description: Environment
        required: true
        type: environment
      tag:
        description: Release Tag
        required: true
      pr:
        description: Pull Request Reference
        required: false

permissions:
  id-token: write

jobs:
  manual:
    name: Deploy to ${{github.event.inputs.environment}}
    environment:
       name: ${{github.event.inputs.environment}}

    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: set-up-environment
        uses: DFE-Digital/github-actions/set-up-environment@master

      - uses: Azure/login@v2
        with:
            creds: ${{ secrets.AZURE_CREDENTIALS }}

      - name: Fetch SECURE USERNAME
        uses: azure/CLI@v2
        id: fetch-username
        with:
          inlineScript: |
            SECRET_VALUE=$(az keyvault secret show --name "SECURE-USERNAME" --vault-name "${{ secrets.APP_KEY_VAULT}}" --query "value" -o tsv)
            echo "::add-mask::$SECRET_VALUE"
            echo "SECURE_USERNAME=$SECRET_VALUE" >> $GITHUB_OUTPUT

      - name: Fetch SECURE PASSWORD
        uses: azure/CLI@v2
        id: fetch-password
        with:
          inlineScript: |
            SECRET_VALUE=$(az keyvault secret show --name "SECURE-PASSWORD" --vault-name "${{ secrets.APP_KEY_VAULT}}" --query "value" -o tsv)
            echo "::add-mask::$SECRET_VALUE"
            echo "SECURE_PASSWORD=$SECRET_VALUE" >> $GITHUB_OUTPUT

      - name: Fetch slack token
        uses: azure/CLI@v2
        id: fetch-slack-secret
        with:
          inlineScript: |
            SECRET_VALUE=$(az keyvault secret show --name "SLACK-WEBHOOK" --vault-name "${{ secrets.INF_KEY_VAULT}}" --query "value" -o tsv)
            echo "::add-mask::$SECRET_VALUE"
            echo "SLACK-WEBHOOK=$SECRET_VALUE" >> $GITHUB_OUTPUT

      - name: Get Release Id from Tag
        id: tag_id
        uses: DFE-Digital/github-actions/DraftReleaseByTag@master
        with:
          TAG: ${{ github.event.inputs.tag }}
          TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check if found
        if: steps.tag_id.outputs.release_id == ''
        run: |
             echo "::error ::Tag ${{ github.event.inputs.tag }} cannot be found in releases"
             exit 1

      - name: Deploy to ${{github.event.inputs.environment}}
        uses: ./.github/workflows/actions/deploy
        id: deploy
        with:
          environment: ${{ github.event.inputs.environment }}
          sha:  ${{ steps.tag_id.outputs.release_sha }}
          azure-credentials: ${{ secrets.AZURE_CREDENTIALS }}
          pr: ${{github.event.inputs.pr}}
          secure-username: ${{ steps.fetch-username.outputs.SECURE_USERNAME}}
          secure-password: ${{ steps.fetch-password.outputs.SECURE_PASSWORD}}

      - name: Slack Release Notification
        if: steps.tag_id.outputs.release_id && github.event.inputs.environment == 'Production'
        uses: rtCamp/action-slack-notify@master
        env:
          SLACK_COLOR: ${{env.SLACK_SUCCESS}}
          SLACK_MESSAGE:  ${{ fromJson( steps.tag_id.outputs.release_body) }}
          SLACK_TITLE: "Release Published to ${{github.event.inputs.environment}}: ${{steps.tag_id.outputs.release_name}}"
          SLACK_WEBHOOK: "${{steps.fetch-slack-secret.outputs.SLACK-WEBHOOK}}"
          MSG_MINIMAL: true

      - name: Slack Notification
        if: failure() && github.event.inputs.environment == 'Production'
        uses: rtCamp/action-slack-notify@master
        env:
          SLACK_COLOR: ${{env.SLACK_ERROR}}
          SLACK_TITLE: "Manual Release Failed: ${{steps.tag_id.outputs.release_name}}"
          SLACK_MESSAGE: Failure deploying ${{github.event.inputs.environment}} release
          SLACK_WEBHOOK: "${{steps.fetch-slack-secret.outputs.SLACK-WEBHOOK}}"