diff-last-run.yml

name: Diff with last workflow run
on:
  workflow_call:
    inputs:
      ENVIRONMENT:
        type: string
        required: true
      CHECK_DIFF_LOCATIONS:
        type: string
        required: true
      ENV_FINGERPRINT_SCOPE:
        type: string
        required: false
        default: ""
      DEPLOY_WORKFLOW_FILE:
        type: string
        required: true
    outputs:
      CHANGES:
        description: "Whether the given directories have changed since the last successful deploy workflow run."
        value: ${{ jobs.diff.outputs.CHANGES }}
      env_fingerprint_cache_key:
        description: "Computed cache key for the environment fingerprint."
        value: ${{ jobs.diff.outputs.env_fingerprint_cache_key }}

permissions:
  contents: read
  actions: read

jobs:
  diff:
    runs-on: ubuntu-latest
    environment:
      name: ${{ inputs.ENVIRONMENT }}
    outputs:
      CHANGES: ${{ steps.final_changes.outputs.CHANGES }}
      env_fingerprint_cache_key: ${{ steps.env_hash.outputs.cache_key }}
    steps:
      - name: Checkout current version
        uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v2

      - name: Get last run commit SHA
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          bun .github/scripts/get-last-success-sha.ts \
            --repository "${{ github.repository }}" \
            --branch "${{ github.head_ref || github.ref_name }}" \
            --workflow-file "${{ inputs.DEPLOY_WORKFLOW_FILE }}"

      - name: Fetch last run commit
        if: ${{ env.LAST_RUN_SHA != '' }}
        run: |
          if ! git fetch --depth=1 origin "$LAST_RUN_SHA"; then
            echo "Last run SHA $LAST_RUN_SHA is not fetchable; treating as changed."
            echo "LAST_RUN_SHA=" >> "$GITHUB_ENV"
          fi

      - name: Check for changes
        id: git_changes
        run: |
          bun .github/scripts/check-git-changes.ts \
            --last-run-sha "${{ env.LAST_RUN_SHA }}" \
            --current-sha "${{ github.sha }}" \
            --locations "${{ inputs.CHECK_DIFF_LOCATIONS }}"

      - name: Hash environment fingerprint
        id: env_hash
        if: ${{ inputs.ENV_FINGERPRINT_SCOPE != '' }}
        env:
          VITE_APP_ENV: ${{ inputs.ENVIRONMENT }}
          VITE_APP_ORIGIN: ${{ vars.APP_ORIGIN }}
          APP_DOMAIN: ${{ vars.APP_DOMAIN }}
          BREVO_API_KEY: ${{ secrets.BREVO_API_KEY }}
          DATABASE_USER: ${{ secrets.DATABASE_USER }}
          DATABASE_PASSWORD: ${{ secrets.DATABASE_PASSWORD }}
          SESSION_SECRET_KEY: ${{ secrets.SESSION_SECRET_KEY }}
          ADMIN_EMAIL: ${{ vars.ADMIN_EMAIL }}
          S3_UPLOAD_KEY: ${{ secrets.S3_UPLOAD_KEY }}
          S3_UPLOAD_SECRET: ${{ secrets.S3_UPLOAD_SECRET }}
          S3_UPLOAD_ROOTFOLDER: upload-${{ inputs.ENVIRONMENT }}
          TS_API_KEY: ${{ secrets.TS_API_KEY }}
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          LANGFUSE_SECRET_KEY: ${{ secrets.LANGFUSE_SECRET_KEY }}
          LANGFUSE_PUBLIC_KEY: ${{ secrets.LANGFUSE_PUBLIC_KEY }}
          LANGFUSE_BASEURL: ${{ vars.LANGFUSE_BASEURL }}
          LUCKY_CLOUD_TOKEN: ${{ secrets.LUCKY_CLOUD_TOKEN }}
          IMAP_HOST: ${{ vars.IMAP_HOST }}
          IMAP_PORT: ${{ vars.IMAP_PORT }}
          IMAP_USER: ${{ vars.IMAP_USER }}
          IMAP_PASSWORD: ${{ secrets.IMAP_PASSWORD }}
        run: |
          bun .github/scripts/hash-env-fingerprint.ts \
            --scope "${{ inputs.ENV_FINGERPRINT_SCOPE }}" \
            --environment "${{ inputs.ENVIRONMENT }}" \
            --ref-name "${{ github.ref_name }}"

      - name: Check environment fingerprint cache
        id: env_fingerprint_cache
        if: ${{ steps.env_hash.outputs.hash != '' }}
        uses: actions/cache/restore@v4
        with:
          path: .ci/env-fingerprints
          key: ${{ steps.env_hash.outputs.cache_key }}
          restore-keys: |
            env-fingerprint-${{ github.ref_name }}-${{ inputs.ENVIRONMENT }}-${{ inputs.ENV_FINGERPRINT_SCOPE }}-
          lookup-only: true

      - name: Check for environment changes
        id: env_changes
        run: |
          bun .github/scripts/resolve-env-changes.ts \
            --hash "${{ steps.env_hash.outputs.hash }}" \
            --cache-hit "${{ steps.env_fingerprint_cache.outputs.cache-hit }}"

      - name: Merge change signals
        id: final_changes
        run: |
          bun .github/scripts/merge-change-signals.ts \
            --git-changes "${{ steps.git_changes.outputs.CHANGES }}" \
            --env-changes "${{ steps.env_changes.outputs.CHANGES }}"