name: "OSDC: Deploy production"

# Manual rollout for prod. Protected by the `osdc-production` GitHub environment
# for both Meta and LF clusters. LF clusters pass `use_lf_credentials: true` to
# the reusable workflow, which selects LF_AWS_DEPLOY_ROLE_ARN over the Meta role.
#
# Default behavior (target = all): sequential rollout of all clusters.
#   Meta: meta-prod-aws-uw1 → meta-prod-aws-ue2 → meta-prod-aws-ue1
#   LF:   lf-prod-aws-ue1 → lf-prod-aws-ue2 (runs in parallel with Meta)
#
# Use `all-meta` or `all-lf` to deploy only one account's clusters.
#
# Picking a specific cluster from the dropdown bypasses the sequencing and
# deploys only that one — useful for hotfixes or to recover from a partial
# rollout.
#
# Workflow-level concurrency prevents overlapping prod runs regardless of
# which target was chosen; a single-cluster dispatch waits for an in-flight
# `all` rollout to finish.
on:
  workflow_dispatch:
    inputs:
      target:
        description: "Cluster(s) to deploy"
        required: true
        type: choice
        default: all
        options:
          - all
          - all-meta
          - all-lf
          - meta-prod-aws-uw1
          - meta-prod-aws-ue2
          - meta-prod-aws-ue1
          - lf-prod-aws-ue1
          - lf-prod-aws-ue2
      taint_nodes:
        description: "Taint ARC runner nodes before deploy (graceful refresh)"
        required: false
        type: boolean
        default: false
      restart_listeners:
        description: "Delete and recreate ARC listeners (required when controller image changes)"
        required: false
        type: boolean
        default: false
      skip_lint_test:
        description: "Skip `just lint` and `just test` pre-flight checks (firefighting only)"
        required: false
        type: boolean
        default: false

concurrency:
  group: osdc-deploy-prod
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  # --- Meta clusters ---

  deploy_uw1:
    if: ${{ inputs.target == 'all' || inputs.target == 'all-meta' || inputs.target == 'meta-prod-aws-uw1' }}
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: meta-prod-aws-uw1
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  deploy_ue2:
    needs: deploy_uw1
    if: |
      !cancelled() && (
        inputs.target == 'meta-prod-aws-ue2' ||
        ((inputs.target == 'all' || inputs.target == 'all-meta') && needs.deploy_uw1.result == 'success')
      )
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: meta-prod-aws-ue2
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  deploy_ue1:
    needs: deploy_ue2
    if: |
      !cancelled() && (
        inputs.target == 'meta-prod-aws-ue1' ||
        ((inputs.target == 'all' || inputs.target == 'all-meta') && needs.deploy_ue2.result == 'success')
      )
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: meta-prod-aws-ue1
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  # --- LF clusters ---

  deploy_lf_ue1:
    if: ${{ inputs.target == 'all' || inputs.target == 'all-lf' || inputs.target == 'lf-prod-aws-ue1' }}
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: lf-prod-aws-ue1
      environment: osdc-production
      use_lf_credentials: true
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  deploy_lf_ue2:
    needs: deploy_lf_ue1
    if: |
      !cancelled() && (
        inputs.target == 'lf-prod-aws-ue2' ||
        ((inputs.target == 'all' || inputs.target == 'all-lf') && needs.deploy_lf_ue1.result == 'success')
      )
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: lf-prod-aws-ue2
      environment: osdc-production
      use_lf_credentials: true
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit
