simulation-deploy.yml

name: Deploy Simulation API

# A merge to main is released, then deployed (rule
# sim.deploy.release-commit-deploys-once):
#
# 1. The merge's push runs only the versioning job. It raises VERSION and
#    builds CHANGELOG.md from the pending changelog fragments, and pushes one
#    release commit, "Update PolicyEngine simulation API", with the GitHub App
#    token. A push made with that token starts this workflow again; one made
#    with the job's own token would not.
# 2. The release commit's push runs only the deploy jobs. The versioning job
#    is skipped for it, so nothing is released twice and nothing loops.
#
# A manual dispatch deploys the chosen branch without a release. Each `if`
# below repeats the release commit's message, which the commit step sets;
# projects/policyengine-simulation-entry/tests/test_release_workflow.py checks
# that they agree. See docs/engineering/skills/github-prs.md#changelog-fragments.

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      force_latest:
        description: "Force latest routing pointers for an intentional rollback"
        required: false
        default: false
        type: boolean
      force_recompute:
        description: "Recompute artifacts even when the store already has them"
        required: false
        default: false
        type: boolean

permissions:
  contents: read

concurrency:
  # Serialize routing writes across deployments, Stage 12, and rollbacks.
  group: simulation-deploy-main
  cancel-in-progress: false

jobs:
  versioning:
    name: Release the merge
    if: ${{ github.event_name == 'push' && github.event.head_commit.message != 'Update PolicyEngine simulation API' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # The release commit is pushed with the GitHub App's token, not this one.
    permissions:
      contents: read
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write

      # git push in commit-release.sh uses the token the checkout stores.
      - name: Check out the merge
        uses: actions/checkout@v6
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"

      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0
        with:
          version: "0.13.6"

      - name: Raise VERSION and build CHANGELOG.md from the fragments
        run: .github/scripts/build-changelog.sh

      - name: Push the release commit to main
        env:
          RELEASE_COMMIT_MESSAGE: Update PolicyEngine simulation API
        run: .github/scripts/commit-release.sh

  beta:
    name: Complete beta deployment
    # Only the release commit, or a manual dispatch, deploys.
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.head_commit.message == 'Update PolicyEngine simulation API' }}
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/simulation-deploy.reusable.yml
    with:
      release_environment: beta
      deployment_environment: staging
      modal_environment: staging
      entrypoint_service: policyengine-simulation-entry-staging
      entrypoint_revision_prefix: s-
      entrypoint_min_instances: 0
      entrypoint_max_instances: 2
      # Staging's stable URL must serve the revision this deployment tested,
      # because staging callers such as the Public API's staging service use
      # that URL. Only a run from main promotes: a manual run from another
      # branch tests its candidate but leaves stable traffic and older
      # revisions alone. Rule: sim.deploy.staging-promotes-tested-revision.
      promote_entrypoint: ${{ github.ref == 'refs/heads/main' }}
      run_full_integration: true
      deploy_existing_stack: true
      deploy_stage12_v2: true
      force_latest: ${{ inputs.force_latest || false }}
      force_recompute: ${{ inputs.force_recompute || false }}
    secrets: inherit

  prod:
    name: Complete prod deployment
    needs: beta
    permissions:
      contents: read
      id-token: write
    uses: ./.github/workflows/simulation-deploy.reusable.yml
    with:
      release_environment: prod
      deployment_environment: production
      modal_environment: main
      entrypoint_service: policyengine-simulation-entry
      entrypoint_revision_prefix: p-
      entrypoint_min_instances: 1
      entrypoint_max_instances: 20
      promote_entrypoint: true
      run_full_integration: false
      deploy_existing_stack: true
      # Deploy Stage 12 in production. The prod environment's STAGE12_ENABLED
      # variable independently controls automatic invocation from report requests.
      deploy_stage12_v2: true
      force_latest: ${{ inputs.force_latest || false }}
      force_recompute: ${{ inputs.force_recompute || false }}
    secrets: inherit

  summary:
    name: Deployment summary
    needs: [beta, prod]
    # After every deployment, even a failed one; never for a merge's release.
    if: ${{ always() && (github.event_name == 'workflow_dispatch' || github.event.head_commit.message == 'Update PolicyEngine simulation API') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Report promotion status
        run: .github/scripts/simulation-deployment-summary.sh "${{ needs.beta.result }}" "${{ needs.beta.outputs.simulation_api_url }}" "${{ needs.prod.result }}" "${{ needs.prod.outputs.stable_url }}"