deploy.yml

name: Deploy

on:
  workflow_call:
    inputs:
      tag:
        description: 'Tag to deploy'
        required: true
        type: string
      environment:
        description: 'Environment to deploy to'
        required: true
        type: string
    secrets:
      DEPLOYMENT_GITHUB_TOKEN:
        description: |
          A GitHub token with the following permissions:
          contents: write (required; to be able to push to the environment branch)
          workflows: write (required; to be able to modify .github/workflows)
        required: true

permissions: {}

jobs:
  deploy:
    name: Deploy ${{ inputs.tag }} to ${{ inputs.environment }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.DEPLOYMENT_GITHUB_TOKEN }}
      - name: Set up git config
        run: |
          git config --global user.name "github-actions[bot]"
          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
      - name: Verify tag
        env:
          TAG: ${{ inputs.tag }}
        run: |
          git merge-base --is-ancestor $TAG origin/main
          if [ $? -ne 0 ]; then
            echo "Tag $TAG is not present in the history of main"
            exit 1
          fi
      - name: Checkout environment branch
        env:
          ENVIRONMENT: ${{ inputs.environment }}
        run: git checkout $ENVIRONMENT
      - name: Reset environment branch to tag
        env:
          TAG: ${{ inputs.tag }}
        run: git reset --hard $TAG
      - name: Force push environment branch
        env:
          ENVIRONMENT: ${{ inputs.environment }}
        run: git push -f origin $ENVIRONMENT