ci: Fix functions deploy variables for prod (#2643)

* Fix functions deploy variables for prod

* Derive the tag if testing for a PR with changes in the prod job

* do not notify on PR

* Add debug messages for testing the workflow code

.github/workflows/prod-deploy.yml

@@ -33,11 +33,25 @@ jobs:
           - name: onboarding-api
             path: onboarding-api/dist/
     steps:
+      - name: Determine release version
+        id: version
+        run: |
+          if [[ "${{ github.event_name }}" == "release" ]]; then
+            echo "version=${{ github.event.release.id }}" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "version=tags/centrifuge-app/${{ inputs.tag }}" >> $GITHUB_OUTPUT
+          else
+            # For PR events, get the latest release tag
+            LATEST_TAG=$(curl -s -H "Accept: application/vnd.github.v3+json" \
+              "https://api.github.com/repos/centrifuge/apps/releases/latest" | \
+              jq -r '.tag_name')
+            echo "version=tags/${LATEST_TAG}" >> $GITHUB_OUTPUT
+          fi
+      
       - uses: dsaltares/fetch-gh-release-asset@aa2ab1243d6e0d5b405b973c89fa4d06a2d0fff7 # v1.1.2
         with:
           repo: 'centrifuge/apps'
-          version: ${{ github.event_name == 'release' && github.event.release.id || format('tags/centrifuge-app/{0}', inputs.tag) }}
-          # version: 'tags/centrifuge-app/v2.83.4' # <- uncomment thisfor testing
+          version: ${{ steps.version.outputs.version }}
           file: "${{ matrix.artifact.name }}.zip"
           target: "${{ matrix.artifact.name }}.zip"
 
@@ -57,6 +71,7 @@ jobs:
 
   deploy-app:
     name: app-prod-deploy
+    needs: get-release-artifacts
     permissions:
       contents: 'read'
       id-token: 'write'
@@ -83,9 +98,9 @@ jobs:
 
   deploy-functions:
     name: ${{ matrix.function.name }}-prod-deploy
+    needs: get-release-artifacts
     runs-on: ubuntu-latest
     environment: production
-    if: ${{ github.event_name != 'pull_request' }}
     permissions:
       contents: 'read'
       id-token: 'write'
@@ -95,30 +110,50 @@ jobs:
         function:
           - name: pinning-api
             handler: pinningApi
-            service_account: ${{ vars.PINNING_API_FUNCT_SA }}
           - name: onboarding-api
             handler: onboarding
-            service_account: ${{ vars.ONBOARDING_FUNCT_SA }}
     steps:
 
+      - name: Set service account
+        id: set-sa
+        run: |
+          if [ "${{ matrix.function.name }}" = "pinning-api" ]; then
+            echo "SERVICE_ACCOUNT=${{ vars.PINNING_API_FUNCT_SA }}" >> $GITHUB_ENV
+          elif [ "${{ matrix.function.name }}" = "onboarding-api" ]; then
+            echo "SERVICE_ACCOUNT=${{ vars.ONBOARDING_FUNCT_SA }}" >> $GITHUB_ENV
+          fi
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
           path: apps
           sparse-checkout: |
             .github/actions/deploy-gfunction
 
+      - name: Debug deployment variables
+        if: ${{ github.event_name == 'pull_request' }}
+        run: |
+          echo "App Name: ${{ matrix.function.name }}-production"
+          echo "Artifact Name: ${{ matrix.function.name }}"
+          echo "GWIP: ${{ secrets.GWIP }}"
+          echo "GSA: ${{ secrets.GSA }}"
+          echo "Target: ${{ matrix.function.handler }}"
+          echo "Gcloud Region: ${{ vars.GCLOUD_REGION }}"
+          echo "Service Account: ${{ env.SERVICE_ACCOUNT }}"
+          echo "Deploy Environment: production"
+
       - name: Deploy Gfunction
         id: functionsdeploy
         uses: ./apps/.github/actions/deploy-gfunction
+        if: ${{ github.event_name != 'pull_request' }}
         with:
           app_name: "${{ matrix.function.name }}-production"
           artifact_name: ${{ matrix.function.name }}
           GWIP: ${{ secrets.GWIP }}
           GSA: ${{ secrets.GSA }}
           target: ${{ matrix.function.handler }}
           gcloud_region: ${{ vars.GCLOUD_REGION }}
-          service_account: '${{ matrix.function.service_account }}'
+          service_account: ${{ env.SERVICE_ACCOUNT }}
           deploy_env: production
 
   slack-notify-success:
@@ -143,7 +178,7 @@ jobs:
 
   slack-notify-failure:
     needs: [deploy-app, deploy-functions]
-    if: failure()
+    if: failure() && ${{ github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
     steps:
       - name: Notify prod deploy failure