call-redeployment-webhook.yml

# Redeploy Webhook Call
# Optional input images: JSON object of image overrides (e.g. {"gateway_image": "user/repo:v1", "htmt_api_image": "user/api:v2"}).
# Server applies them before redeploy: gateway_image updates gateway .env and restarts gateway; other keys are written to scripts .env as UPPER_SNAKE_CASE.
#
# hook_id_base (required): POST /hooks/<hook_id_base>-<env>. X-Secret selection (trimmed, all non-empty):
#   hook_id_base == vars.BTMT_REDEPLOYMENT_HOOK_ID_BASE          → BTMT_REDEPLOYMENT_WEBHOOK_SECRET_<env>
#   hook_id_base == vars.TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE     → TMD_ADMIN_API_WEBHOOK_SECRET_<env>
#   hook_id_base == vars.TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE → TMD_ADMIN_WEB_WEBHOOK_SECRET_<env>
#   no match                                                      → error (no fallback)
name: Redeploy Webhook Call

on:
  workflow_dispatch:
    inputs:
      env:
        description: "Environment (prod or staging)"
        required: true
        type: string
      images:
        description: 'Optional JSON image overrides (e.g. {"gateway_image": "user/repo:tag"})'
        required: false
        type: string
        default: "{}"
      hook_id_base:
        description: "Hook id base (trimmed); URL path /hooks/<base>-<env>. Must match hooks.json (secret selected by match against TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE, or BTMT)."
        required: true
        type: string
  workflow_call:
    inputs:
      env:
        required: true
        type: string
      images:
        required: false
        type: string
        default: "{}"
      hook_id_base:
        description: "Hook id base (trimmed); e.g. vars.BTMT_REDEPLOYMENT_HOOK_ID_BASE, vars.TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE, or vars.TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE (secret selected by match)."
        required: true
        type: string
    secrets:
      REDEPLOYMENT_WEBHOOK_PORT:
        description: Webhook daemon port on SERVER_HOST.
        required: false
      BTMT_REDEPLOYMENT_WEBHOOK_SECRET_PROD:
        description: X-Secret for BTMT prod when hook_id_base equals vars.BTMT_REDEPLOYMENT_HOOK_ID_BASE.
        required: false
      BTMT_REDEPLOYMENT_WEBHOOK_SECRET_STAGING:
        description: X-Secret for BTMT staging when hook_id_base equals vars.BTMT_REDEPLOYMENT_HOOK_ID_BASE.
        required: false
      TMD_ADMIN_API_WEBHOOK_SECRET_PROD:
        description: X-Secret for TMD admin prod when hook_id_base equals vars.TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE.
        required: false
      TMD_ADMIN_API_WEBHOOK_SECRET_STAGING:
        description: X-Secret for TMD admin staging when hook_id_base equals vars.TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE.
        required: false
      TMD_ADMIN_WEB_WEBHOOK_SECRET_PROD:
        description: X-Secret for TMD admin web prod when hook_id_base equals vars.TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE.
        required: false
      TMD_ADMIN_WEB_WEBHOOK_SECRET_STAGING:
        description: X-Secret for TMD admin web staging when hook_id_base equals vars.TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE.
        required: false

jobs:
  validate-env:
    name: Validate env
    runs-on: ubuntu-latest
    outputs:
      env_normalized: ${{ steps.normalize.outputs.env_normalized }}
      hook_id_base_effective: ${{ steps.normalize.outputs.hook_id_base_effective }}
    steps:
      - name: Validate env and hook id base
        id: normalize
        run: |
          env="${{ inputs.env }}"
          if [[ -z "$env" ]]; then
            echo "ERROR: env is required (no default)."
            exit 1
          fi
          env_lower=$(echo "$env" | tr '[:upper:]' '[:lower:]')
          if [[ "$env_lower" != "prod" && "$env_lower" != "staging" ]]; then
            echo "ERROR: env must be 'prod' or 'staging' (got: $env)."
            exit 1
          fi
          hb_raw="${{ inputs.hook_id_base }}"
          hb_trim=$(echo -n "$hb_raw" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')
          if [[ -z "$hb_trim" ]]; then
            echo "ERROR: hook_id_base is required and must be non-empty after trim."
            exit 1
          fi
          echo "env_normalized=$env_lower" >> "$GITHUB_OUTPUT"
          echo "hook_id_base_effective=$hb_trim" >> "$GITHUB_OUTPUT"
        shell: bash

  check-required-config:
    name: Check required vars and secrets
    runs-on: ubuntu-latest
    needs: [validate-env]
    environment:
      name: ${{ needs.validate-env.outputs.env_normalized }}
    steps:
      - name: Check required vars and secrets
        env:
          ENV: ${{ needs.validate-env.outputs.env_normalized }}
          HOOK_BASE: ${{ needs.validate-env.outputs.hook_id_base_effective }}
          SERVER_HOST: ${{ vars.SERVER_HOST }}
          REDEPLOYMENT_WEBHOOK_PORT: ${{ secrets.REDEPLOYMENT_WEBHOOK_PORT }}
          BTMT_HOOK_VAR: ${{ vars.BTMT_REDEPLOYMENT_HOOK_ID_BASE }}
          TMD_HOOK_VAR: ${{ vars.TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE }}
          TMD_WEB_HOOK_VAR: ${{ vars.TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE }}
          BTMT_REDEPLOYMENT_WEBHOOK_SECRET_PROD: ${{ secrets.BTMT_REDEPLOYMENT_WEBHOOK_SECRET_PROD }}
          BTMT_REDEPLOYMENT_WEBHOOK_SECRET_STAGING: ${{ secrets.BTMT_REDEPLOYMENT_WEBHOOK_SECRET_STAGING }}
          TMD_ADMIN_API_WEBHOOK_SECRET_PROD: ${{ secrets.TMD_ADMIN_API_WEBHOOK_SECRET_PROD }}
          TMD_ADMIN_API_WEBHOOK_SECRET_STAGING: ${{ secrets.TMD_ADMIN_API_WEBHOOK_SECRET_STAGING }}
          TMD_ADMIN_WEB_WEBHOOK_SECRET_PROD: ${{ secrets.TMD_ADMIN_WEB_WEBHOOK_SECRET_PROD }}
          TMD_ADMIN_WEB_WEBHOOK_SECRET_STAGING: ${{ secrets.TMD_ADMIN_WEB_WEBHOOK_SECRET_STAGING }}
        run: |
          trim() { echo -n "$1" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//'; }
          missing=""
          [[ -z "${SERVER_HOST:-}" ]] && missing="${missing} SERVER_HOST"
          [[ -z "${REDEPLOYMENT_WEBHOOK_PORT:-}" ]] && missing="${missing} REDEPLOYMENT_WEBHOOK_PORT"
          [[ -z "${HOOK_BASE:-}" ]] && missing="${missing} hook_id_base"
          btmt_ref=$(trim "${BTMT_HOOK_VAR:-}")
          tmd_ref=$(trim "${TMD_HOOK_VAR:-}")
          tmd_web_ref=$(trim "${TMD_WEB_HOOK_VAR:-}")
          hook_trim=$(trim "${HOOK_BASE:-}")
          if [[ -n "$btmt_ref" && -n "$tmd_ref" && "$btmt_ref" == "$tmd_ref" ]] || [[ -n "$btmt_ref" && -n "$tmd_web_ref" && "$btmt_ref" == "$tmd_web_ref" ]] || [[ -n "$tmd_ref" && -n "$tmd_web_ref" && "$tmd_ref" == "$tmd_web_ref" ]]; then
            echo "ERROR: Redeployment hook id bases must be distinct (BTMT_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE)."
            exit 1
          fi
          if [[ -n "$btmt_ref" && "$hook_trim" == "$btmt_ref" ]]; then
            case "$ENV" in
              prod) [[ -z "${BTMT_REDEPLOYMENT_WEBHOOK_SECRET_PROD:-}" ]] && missing="${missing} BTMT_REDEPLOYMENT_WEBHOOK_SECRET_PROD" ;;
              staging) [[ -z "${BTMT_REDEPLOYMENT_WEBHOOK_SECRET_STAGING:-}" ]] && missing="${missing} BTMT_REDEPLOYMENT_WEBHOOK_SECRET_STAGING" ;;
            esac
          elif [[ -n "$tmd_ref" && "$hook_trim" == "$tmd_ref" ]]; then
            case "$ENV" in
              prod) [[ -z "${TMD_ADMIN_API_WEBHOOK_SECRET_PROD:-}" ]] && missing="${missing} TMD_ADMIN_API_WEBHOOK_SECRET_PROD" ;;
              staging) [[ -z "${TMD_ADMIN_API_WEBHOOK_SECRET_STAGING:-}" ]] && missing="${missing} TMD_ADMIN_API_WEBHOOK_SECRET_STAGING" ;;
            esac
          elif [[ -n "$tmd_web_ref" && "$hook_trim" == "$tmd_web_ref" ]]; then
            case "$ENV" in
              prod) [[ -z "${TMD_ADMIN_WEB_WEBHOOK_SECRET_PROD:-}" ]] && missing="${missing} TMD_ADMIN_WEB_WEBHOOK_SECRET_PROD" ;;
              staging) [[ -z "${TMD_ADMIN_WEB_WEBHOOK_SECRET_STAGING:-}" ]] && missing="${missing} TMD_ADMIN_WEB_WEBHOOK_SECRET_STAGING" ;;
            esac
          else
            echo "ERROR: hook_id_base '${hook_trim}' does not match any known app (BTMT_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE)."
            exit 1
          fi
          if [[ -n "$missing" ]]; then
            echo "ERROR: Missing required config:$missing"
            echo "Set variables and secrets in Settings → Environments (or org/repo level). See README."
            exit 1
          fi
          echo "All required vars and secrets are set."
        shell: bash

  call_webhook:
    name: Call Redeploy Webhook
    runs-on: ubuntu-latest
    needs: [check-required-config, validate-env]
    environment:
      name: ${{ needs.validate-env.outputs.env_normalized }}
    steps:
      - name: Call redeploy webhook
        env:
          ENV: ${{ needs.validate-env.outputs.env_normalized }}
          HOOK_BASE: ${{ needs.validate-env.outputs.hook_id_base_effective }}
          SERVER_HOST: ${{ vars.SERVER_HOST }}
          REDEPLOYMENT_WEBHOOK_PORT: ${{ secrets.REDEPLOYMENT_WEBHOOK_PORT }}
          BTMT_HOOK_VAR: ${{ vars.BTMT_REDEPLOYMENT_HOOK_ID_BASE }}
          TMD_HOOK_VAR: ${{ vars.TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE }}
          TMD_WEB_HOOK_VAR: ${{ vars.TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE }}
          BTMT_REDEPLOYMENT_WEBHOOK_SECRET_PROD: ${{ secrets.BTMT_REDEPLOYMENT_WEBHOOK_SECRET_PROD }}
          BTMT_REDEPLOYMENT_WEBHOOK_SECRET_STAGING: ${{ secrets.BTMT_REDEPLOYMENT_WEBHOOK_SECRET_STAGING }}
          TMD_ADMIN_API_WEBHOOK_SECRET_PROD: ${{ secrets.TMD_ADMIN_API_WEBHOOK_SECRET_PROD }}
          TMD_ADMIN_API_WEBHOOK_SECRET_STAGING: ${{ secrets.TMD_ADMIN_API_WEBHOOK_SECRET_STAGING }}
          TMD_ADMIN_WEB_WEBHOOK_SECRET_PROD: ${{ secrets.TMD_ADMIN_WEB_WEBHOOK_SECRET_PROD }}
          TMD_ADMIN_WEB_WEBHOOK_SECRET_STAGING: ${{ secrets.TMD_ADMIN_WEB_WEBHOOK_SECRET_STAGING }}
          IMAGES_PAYLOAD: ${{ inputs.images }}
        run: |
          trim() { echo -n "$1" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//'; }
          btmt_ref=$(trim "${BTMT_HOOK_VAR:-}")
          tmd_ref=$(trim "${TMD_HOOK_VAR:-}")
          tmd_web_ref=$(trim "${TMD_WEB_HOOK_VAR:-}")
          hook_trim=$(trim "${HOOK_BASE:-}")
          if [[ -n "$btmt_ref" && -n "$tmd_ref" && "$btmt_ref" == "$tmd_ref" ]] || [[ -n "$btmt_ref" && -n "$tmd_web_ref" && "$btmt_ref" == "$tmd_web_ref" ]] || [[ -n "$tmd_ref" && -n "$tmd_web_ref" && "$tmd_ref" == "$tmd_web_ref" ]]; then
            echo "ERROR: Redeployment hook id bases must be distinct (BTMT_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE)."
            exit 1
          fi
          if [[ -n "$btmt_ref" && "$hook_trim" == "$btmt_ref" ]]; then
            case "$ENV" in
              prod) secret="${BTMT_REDEPLOYMENT_WEBHOOK_SECRET_PROD}" ;;
              staging) secret="${BTMT_REDEPLOYMENT_WEBHOOK_SECRET_STAGING}" ;;
              *) echo "ERROR: invalid ENV"; exit 1 ;;
            esac
          elif [[ -n "$tmd_ref" && "$hook_trim" == "$tmd_ref" ]]; then
            case "$ENV" in
              prod) secret="${TMD_ADMIN_API_WEBHOOK_SECRET_PROD}" ;;
              staging) secret="${TMD_ADMIN_API_WEBHOOK_SECRET_STAGING}" ;;
              *) echo "ERROR: invalid ENV"; exit 1 ;;
            esac
          elif [[ -n "$tmd_web_ref" && "$hook_trim" == "$tmd_web_ref" ]]; then
            case "$ENV" in
              prod) secret="${TMD_ADMIN_WEB_WEBHOOK_SECRET_PROD}" ;;
              staging) secret="${TMD_ADMIN_WEB_WEBHOOK_SECRET_STAGING}" ;;
              *) echo "ERROR: invalid ENV"; exit 1 ;;
            esac
          else
            echo "ERROR: hook_id_base '${hook_trim}' does not match any known app (BTMT_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_API_REDEPLOYMENT_HOOK_ID_BASE, TMD_ADMIN_WEB_REDEPLOYMENT_HOOK_ID_BASE)."
            exit 1
          fi
          SERVER_REDEPLOYMENT_WEBHOOK_URL="http://${SERVER_HOST}:${REDEPLOYMENT_WEBHOOK_PORT}/hooks/${hook_trim}-${ENV}"
          export SERVER_REDEPLOYMENT_WEBHOOK_URL
          export REDEPLOYMENT_WEBHOOK_SECRET="$secret"
          set +e
          response=$(curl -s -w '\n%{http_code}' -v \
            -X POST \
            -H "Content-Type: application/json" \
            -H "X-Secret: $REDEPLOYMENT_WEBHOOK_SECRET" \
            -d "$IMAGES_PAYLOAD" \
            --max-time 15 \
            "$SERVER_REDEPLOYMENT_WEBHOOK_URL")
          curl_exit=$?
          set -e
          if [[ $curl_exit -ne 0 ]]; then
            echo "Webhook call failed (curl exit $curl_exit)."
            echo "Exit 7 = connection refused: nothing listening on host:port, or firewall blocking. Check webhook service on server (systemctl status webhook), port in REDEPLOYMENT_WEBHOOK_PORT, and firewall."
            exit 1
          fi
          http_code=$(echo "$response" | tail -n1)
          response=$(echo "$response" | sed '$d')
          # Must match hooks.json response-message prefix from infrastructure generate-hooks-json.sh (all stacks).
          expected_prefix="Redeployment accepted"
          if [[ "$response" != "$expected_prefix"* ]]; then
            echo "ERROR: Webhook call failed with response: $response"
            echo "Expected response body to start with: $expected_prefix"
            if [[ "$response" == "Hook not found." ]] || [[ "$http_code" == "404" ]]; then
              echo "hook_id_base + '-' + env must match a hook id in hooks.json (path is /hooks/<id>-<env>)."
            fi
            exit 1
          fi
        shell: bash