# Promotion Pipeline Structure
.github/workflows/
├── promote-to-staging.yml         # Dev → Staging promotion (AC 1)
│   ├── Trigger: Merge to develop + successful tests
│   ├── Jobs: validate-dev, promote-config, deploy-staging, smoke-tests
│   └── Auto-approve: Yes (automated)
│
├── promote-to-production.yml      # Staging → Production promotion (AC 2)
│   ├── Trigger: Manual workflow dispatch
│   ├── Jobs: validate-staging, require-approvals, promote-config, deploy-production
│   └── Approval: Required from 2 team leads
│
├── validation-suite.yml           # Validation gates (AC 5-8)
│   ├── Trigger: Before promotion
│   ├── Jobs: regression-tests, performance-tests, security-scan, schema-validation
│   └── Blocking: Yes (must pass for promotion)
│
└── canary-deployment.yml          # Canary release (AC 10)
    ├── Trigger: Manual with canary flag
    ├── Jobs: deploy-10%, monitor, scale-to-50%, scale-to-100%
    └── Rollback: Automatic on metric threshold breach

# AWS Systems Manager Parameter Store Structure
/batbern/{environment}/
├── database/
│   ├── connection-string
│   ├── pool-size
│   └── migration-version
├── cache/
│   ├── caffeine-config
│   └── cache-ttl
├── api-gateway/
│   ├── cors-origins
│   └── rate-limits
├── feature-flags/
│   ├── canary-enabled
│   └── new-feature-enabled
└── monitoring/
    ├── alert-endpoints
    └── dashboard-urls

# Configuration Promotion Script
promote_config() {
  local source_env=$1
  local target_env=$2

  # Get parameters from source environment
  aws ssm get-parameters-by-path \
    --path "/batbern/$source_env/" \
    --recursive \
    --with-decryption \
    --query 'Parameters[].[Name,Value,Type]' \
    --output json > source_config.json

  # Validate compatibility
  validate_config_compatibility source_config.json $target_env

  # Promote parameters to target environment
  jq -r '.[] | @tsv' source_config.json | while read name value type; do
    target_name="${name/$source_env/$target_env}"
    aws ssm put-parameter \
      --name "$target_name" \
      --value "$value" \
      --type "$type" \
      --overwrite
  done
}

// LaunchDarkly SDK Integration
import LaunchDarkly from 'launchdarkly-node-server-sdk';

class FeatureFlagService {
  private ldClient: LaunchDarkly.LDClient;

  async initialize(environment: string) {
    const sdkKey = process.env.LAUNCHDARKLY_SDK_KEY;
    this.ldClient = LaunchDarkly.init(sdkKey, {
      offline: false,
      sendEvents: true,
    });
    await this.ldClient.waitForInitialization();
  }

  async syncFeatureFlags(fromEnv: string, toEnv: string) {
    // Get all flags from source environment
    const flags = await this.ldClient.allFlagsState({
      key: fromEnv,
    });

    // Promote flags to target environment
    for (const [flagKey, flagValue] of Object.entries(flags.allValues())) {
      await this.updateFlagForEnvironment(flagKey, toEnv, flagValue);
    }
  }

  private async updateFlagForEnvironment(
    flagKey: string,
    environment: string,
    value: any
  ) {
    // Use LaunchDarkly API to update flag
    const response = await fetch(
      `https://app.launchdarkly.com/api/v2/flags/batbern/${flagKey}`,
      {
        method: 'PATCH',
        headers: {
          'Authorization': process.env.LAUNCHDARKLY_API_TOKEN,
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({
          environmentKey: environment,
          instructions: [{
            kind: 'updateFlagVariations',
            value: value,
          }],
        }),
      }
    );
    return response.json();
  }
}

name: Promote to Staging

on:
  workflow_run:
    workflows: ["Build Pipeline"]
    types: [completed]
    branches: [develop]

env:
  AWS_REGION: eu-central-1
  SOURCE_ENV: dev
  TARGET_ENV: staging

jobs:
  validate-dev-environment:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Validate dev environment health
        run: |
          chmod +x scripts/ci/validate-environment.sh
          scripts/ci/validate-environment.sh ${{ env.SOURCE_ENV }}

      - name: Run dev smoke tests
        run: |
          chmod +x scripts/ci/smoke-tests.sh
          scripts/ci/smoke-tests.sh https://dev.batbern.ch https://api-dev.batbern.ch

      - name: Check dev deployment age
        run: |
          # Ensure dev has been stable for at least 2 hours
          DEPLOY_TIME=$(aws ecs describe-services \
            --cluster batbern-dev \
            --services event-management-service \
            --query 'services[0].deployments[0].createdAt' \
            --output text)

          DEPLOY_EPOCH=$(date -d "$DEPLOY_TIME" +%s)
          NOW_EPOCH=$(date +%s)
          AGE_HOURS=$(( ($NOW_EPOCH - $DEPLOY_EPOCH) / 3600 ))

          if [ $AGE_HOURS -lt 2 ]; then
            echo "Dev deployment is only $AGE_HOURS hours old. Minimum 2 hours required."
            exit 1
          fi
          echo "Dev deployment is $AGE_HOURS hours old - stable for promotion"

  run-validation-suite:
    needs: validate-dev-environment
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run regression tests
        run: |
          chmod +x scripts/ci/regression-suite.sh
          scripts/ci/regression-suite.sh ${{ env.SOURCE_ENV }}

      - name: Run performance tests
        run: |
          chmod +x scripts/ci/performance-tests.sh
          scripts/ci/performance-tests.sh ${{ env.SOURCE_ENV }}

      - name: Run security scan
        run: |
          chmod +x scripts/ci/security-scan.sh
          scripts/ci/security-scan.sh ${{ env.SOURCE_ENV }}

      - name: Validate database schema
        run: |
          chmod +x scripts/ci/validate-schema.sh
          scripts/ci/validate-schema.sh ${{ env.SOURCE_ENV }} ${{ env.TARGET_ENV }}

  promote-configuration:
    needs: run-validation-suite
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Promote SSM parameters
        run: |
          chmod +x scripts/ci/promote-config.sh
          scripts/ci/promote-config.sh ${{ env.SOURCE_ENV }} ${{ env.TARGET_ENV }}

      - name: Sync feature flags
        env:
          LAUNCHDARKLY_API_TOKEN: ${{ secrets.LAUNCHDARKLY_API_TOKEN }}
        run: |
          chmod +x scripts/ci/sync-feature-flags.sh
          scripts/ci/sync-feature-flags.sh ${{ env.SOURCE_ENV }} ${{ env.TARGET_ENV }}

  deploy-to-staging:
    needs: promote-configuration
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Set up Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: infrastructure/package-lock.json

      - name: Install CDK dependencies
        working-directory: ./infrastructure
        run: npm ci

      - name: Deploy to staging (Blue/Green)
        working-directory: ./infrastructure
        run: |
          npm run deploy:staging -- \
            --context version=${{ github.sha }} \
            --require-approval never
        env:
          IMAGE_TAG: ${{ github.sha }}

      - name: Wait for staging services to stabilize
        run: |
          for service in event-management speaker-coordination partner-coordination attendee-experience company-management; do
            echo "Waiting for $service to stabilize..."
            aws ecs wait services-stable \
              --cluster batbern-staging \
              --services ${service}-service
          done

  smoke-test-staging:
    needs: deploy-to-staging
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run staging smoke tests
        run: |
          chmod +x scripts/ci/smoke-tests.sh
          scripts/ci/smoke-tests.sh https://staging.batbern.ch https://api.staging.batbern.ch

      - name: Notify team on success
        if: success()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "✅ Staging promotion successful",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Staging Promotion Complete*\n\nCommit: ${{ github.sha }}\nEnvironment: Staging\nStatus: Success\nWorkflow: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

      - name: Notify team on failure
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "🚨 Staging promotion failed",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Staging Promotion Failed*\n\nCommit: ${{ github.sha }}\nEnvironment: Staging\nStatus: Failed\nWorkflow: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

name: Promote to Production

on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to promote (Git SHA)'
        required: true
      jira_ticket:
        description: 'JIRA change ticket (e.g., CHANGE-123)'
        required: true
      deployment_time:
        description: 'Scheduled deployment time (YYYY-MM-DD HH:MM UTC)'
        required: false
      enable_canary:
        description: 'Enable canary deployment'
        type: boolean
        default: false

env:
  AWS_REGION: eu-central-1
  SOURCE_ENV: staging
  TARGET_ENV: production

jobs:
  pre-deployment-validations:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://www.batbern.ch
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.version }}

      - name: Verify version exists in staging
        run: |
          # Verify the version is deployed and validated in staging
          echo "Checking staging deployment status..."

          STAGING_VERSION=$(aws ecs describe-services \
            --cluster batbern-staging \
            --services event-management-service \
            --query 'services[0].taskDefinition' \
            --output text | grep -oP '(?<=:)[^:]+$')

          if [[ "$STAGING_VERSION" != "${{ github.event.inputs.version }}" ]]; then
            echo "Version mismatch: Staging has $STAGING_VERSION, requested ${{ github.event.inputs.version }}"
            exit 1
          fi

      - name: Check deployment window
        if: github.event.inputs.deployment_time != ''
        run: |
          SCHEDULED_TIME="${{ github.event.inputs.deployment_time }}"
          SCHEDULED_EPOCH=$(date -d "$SCHEDULED_TIME" +%s)
          NOW_EPOCH=$(date +%s)

          # Allow deployment within 15 minutes of scheduled time
          DIFF=$(( $SCHEDULED_EPOCH - $NOW_EPOCH ))
          if [ $DIFF -gt 900 ] || [ $DIFF -lt -900 ]; then
            echo "Current time is outside deployment window"
            exit 1
          fi

      - name: Verify JIRA change ticket
        env:
          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
        run: |
          TICKET="${{ github.event.inputs.jira_ticket }}"

          # Verify ticket exists and is approved
          RESPONSE=$(curl -s -u ${{ secrets.JIRA_USER }}:$JIRA_API_TOKEN \
            "https://batbern.atlassian.net/rest/api/3/issue/$TICKET")

          STATUS=$(echo "$RESPONSE" | jq -r '.fields.status.name')
          if [[ "$STATUS" != "Approved" ]]; then
            echo "JIRA ticket $TICKET is not approved. Current status: $STATUS"
            exit 1
          fi

      - name: Run final staging validation
        run: |
          chmod +x scripts/ci/validate-environment.sh
          scripts/ci/validate-environment.sh ${{ env.SOURCE_ENV }}

  backup-production-database:
    needs: pre-deployment-validations
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Create RDS snapshot
        run: |
          SNAPSHOT_ID="batbern-prod-pre-promote-$(date +%Y%m%d-%H%M%S)"
          aws rds create-db-snapshot \
            --db-instance-identifier batbern-prod-postgres \
            --db-snapshot-identifier $SNAPSHOT_ID

          echo "Waiting for snapshot to complete..."
          aws rds wait db-snapshot-completed \
            --db-snapshot-identifier $SNAPSHOT_ID

          echo "SNAPSHOT_ID=$SNAPSHOT_ID" >> $GITHUB_ENV
          echo "Database snapshot created: $SNAPSHOT_ID"

  promote-configuration:
    needs: backup-production-database
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.version }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Promote SSM parameters
        run: |
          chmod +x scripts/ci/promote-config.sh
          scripts/ci/promote-config.sh ${{ env.SOURCE_ENV }} ${{ env.TARGET_ENV }}

      - name: Sync feature flags
        env:
          LAUNCHDARKLY_API_TOKEN: ${{ secrets.LAUNCHDARKLY_API_TOKEN }}
        run: |
          chmod +x scripts/ci/sync-feature-flags.sh
          scripts/ci/sync-feature-flags.sh ${{ env.SOURCE_ENV }} ${{ env.TARGET_ENV }}

  deploy-to-production:
    needs: promote-configuration
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.version }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Set up Node.js 20
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
          cache-dependency-path: infrastructure/package-lock.json

      - name: Install CDK dependencies
        working-directory: ./infrastructure
        run: npm ci

      - name: Deploy to production (Blue/Green)
        if: github.event.inputs.enable_canary == 'false'
        working-directory: ./infrastructure
        run: |
          npm run deploy:prod -- \
            --context version=${{ github.event.inputs.version }} \
            --require-approval never
        env:
          IMAGE_TAG: ${{ github.event.inputs.version }}

      - name: Deploy to production (Canary)
        if: github.event.inputs.enable_canary == 'true'
        working-directory: ./infrastructure
        run: |
          # Deploy with 10% traffic to new version
          npm run deploy:prod:canary -- \
            --context version=${{ github.event.inputs.version }} \
            --context canaryPercentage=10 \
            --require-approval never
        env:
          IMAGE_TAG: ${{ github.event.inputs.version }}

      - name: Wait for production services to stabilize
        run: |
          for service in event-management speaker-coordination partner-coordination attendee-experience company-management; do
            echo "Waiting for $service to stabilize..."
            aws ecs wait services-stable \
              --cluster batbern-prod \
              --services ${service}-service
          done

  smoke-test-production:
    needs: deploy-to-production
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run production smoke tests
        run: |
          chmod +x scripts/ci/smoke-tests.sh
          scripts/ci/smoke-tests.sh https://www.batbern.ch https://api.batbern.ch

      - name: Monitor canary metrics (if canary enabled)
        if: github.event.inputs.enable_canary == 'true'
        run: |
          chmod +x scripts/ci/monitor-canary.sh
          scripts/ci/monitor-canary.sh 10

  scale-canary-deployment:
    needs: smoke-test-production
    if: github.event.inputs.enable_canary == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Scale to 50% traffic
        run: |
          # Update canary to 50% traffic
          npm run deploy:prod:canary -- \
            --context canaryPercentage=50
          sleep 300  # Monitor for 5 minutes

      - name: Monitor 50% canary
        run: |
          chmod +x scripts/ci/monitor-canary.sh
          scripts/ci/monitor-canary.sh 50

      - name: Scale to 100% traffic
        run: |
          # Complete canary rollout
          npm run deploy:prod:canary -- \
            --context canaryPercentage=100

  update-jira-ticket:
    needs: [smoke-test-production, scale-canary-deployment]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Update JIRA ticket
        env:
          JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
        run: |
          TICKET="${{ github.event.inputs.jira_ticket }}"
          STATUS="Deployed"

          if [[ "${{ job.status }}" != "success" ]]; then
            STATUS="Failed"
          fi

          curl -X POST -u ${{ secrets.JIRA_USER }}:$JIRA_API_TOKEN \
            -H "Content-Type: application/json" \
            "https://batbern.atlassian.net/rest/api/3/issue/$TICKET/comment" \
            -d "{
              \"body\": {
                \"type\": \"doc\",
                \"version\": 1,
                \"content\": [{
                  \"type\": \"paragraph\",
                  \"content\": [{
                    \"type\": \"text\",
                    \"text\": \"Production deployment $STATUS. Version: ${{ github.event.inputs.version }}. Workflow: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\"
                  }]
                }]
              }
            }"

  notify-deployment-result:
    needs: [smoke-test-production, scale-canary-deployment]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Notify success
        if: success()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "✅ Production promotion successful",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Production Promotion Complete*\n\nVersion: ${{ github.event.inputs.version }}\nJIRA: ${{ github.event.inputs.jira_ticket }}\nCanary: ${{ github.event.inputs.enable_canary }}\nStatus: Success\nWorkflow: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

      - name: Notify failure
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "🚨 Production promotion failed - initiating rollback",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Production Promotion Failed*\n\nVersion: ${{ github.event.inputs.version }}\nJIRA: ${{ github.event.inputs.jira_ticket }}\nStatus: Failed - Rollback Required\nWorkflow: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

#!/bin/bash
set -e

ENVIRONMENT=$1
API_URL="https://api-${ENVIRONMENT}.batbern.ch"

echo "Running regression test suite against $ENVIRONMENT..."

# Test 1: Event management workflows
echo "Testing event management workflows..."
curl -s "$API_URL/api/events/health" | jq -e '.status == "UP"'

# Test 2: Speaker coordination workflows
echo "Testing speaker coordination workflows..."
curl -s "$API_URL/api/speakers/health" | jq -e '.status == "UP"'

# Test 3: Partner analytics workflows
echo "Testing partner analytics workflows..."
curl -s "$API_URL/api/partners/health" | jq -e '.status == "UP"'

# Test 4: Attendee experience workflows
echo "Testing attendee experience workflows..."
curl -s "$API_URL/api/content/health" | jq -e '.status == "UP"'

# Test 5: Authentication flows
echo "Testing authentication flows..."
# Add authentication test logic

# Test 6: Database connectivity
echo "Testing database connectivity..."
curl -s "$API_URL/actuator/health/db" | jq -e '.status == "UP"'

# Test 7: Cache connectivity
echo "Testing cache connectivity..."
curl -s "$API_URL/actuator/health/caffeine" | jq -e '.status == "UP"'

echo "✅ All regression tests passed!"

#!/bin/bash
set -e

ENVIRONMENT=$1
CLUSTER="batbern-${ENVIRONMENT}"

echo "Initiating rollback for $ENVIRONMENT environment..."

# Get list of services
SERVICES=(
  "event-management-service"
  "speaker-coordination-service"
  "partner-coordination-service"
  "attendee-experience-service"
  "company-user-management-service"
)

# Rollback each service
for service in "${SERVICES[@]}"; do
  echo "Rolling back $service..."

  # Get previous task definition
  PREVIOUS_TASK=$(aws ecs describe-services \
    --cluster $CLUSTER \
    --services $service \
    --query 'services[0].deployments[1].taskDefinition' \
    --output text)

  if [ "$PREVIOUS_TASK" == "None" ]; then
    echo "⚠️  No previous task definition found for $service"
    continue
  fi

  # Update service to previous task definition
  aws ecs update-service \
    --cluster $CLUSTER \
    --service $service \
    --task-definition $PREVIOUS_TASK \
    --force-new-deployment

  echo "✓ $service rollback initiated"
done

echo "Waiting for services to stabilize..."
for service in "${SERVICES[@]}"; do
  aws ecs wait services-stable \
    --cluster $CLUSTER \
    --services $service
done

echo "✅ Rollback complete!"

# Notify team
curl -X POST $SLACK_WEBHOOK_URL \
  -H 'Content-Type: application/json' \
  -d "{
    \"text\": \"🔄 Rollback completed for $ENVIRONMENT environment\",
    \"blocks\": [{
      \"type\": \"section\",
      \"text\": {
        \"type\": \"mrkdwn\",
        \"text\": \"*Rollback Complete*\n\nEnvironment: $ENVIRONMENT\nServices: ${SERVICES[*]}\nStatus: Success\"
      }
    }]
  }"