cycorgi/.github/workflows/deploy-dev.yml at main · pineapaul/cycorgi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: Deploy to GCP Dev

on:
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: read

concurrency:
  group: cycorgi-dev
  cancel-in-progress: false

env:
  PROJECT_ID: cycorgi-grc-platform
  REGION: us-central1
  REPOSITORY: grc-containers
  IMAGE_NAME: grc-dev

jobs:
  deploy:
    name: Build and Deploy to GCP Dev
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      # Authenticate to GCP using Workload Identity Federation
      - name: Authenticate to Google Cloud (OIDC)
        id: auth
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: 'projects/720149050668/locations/global/workloadIdentityPools/github-pool/providers/github-provider'
          service_account: 'terraform-deployer@cycorgi-grc-platform.iam.gserviceaccount.com'

      - name: Set up gcloud CLI
        uses: google-github-actions/setup-gcloud@v2

      # Configure Docker to push to Artifact Registry
      - name: Configure Docker for Artifact Registry
        run: gcloud auth configure-docker ${{ env.REGION }}-docker.pkg.dev --quiet

      - name: Set IMAGE_TAG
        id: vars
        run: echo "tag=gh-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"

      - name: Build Docker image
        run: |
          docker build \
            -t $REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE_NAME:${{ steps.vars.outputs.tag }} \
            .

      - name: Push Docker image
        run: |
          docker push \
            $REGION-docker.pkg.dev/$PROJECT_ID/$REPOSITORY/$IMAGE_NAME:${{ steps.vars.outputs.tag }}

      - name: Set up Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.8.5

      - name: Terraform Init
        working-directory: infra/environments/dev
        run: terraform init -upgrade

      - name: Terraform Apply
        working-directory: infra/environments/dev
        env:
          TF_VAR_image_tag: ${{ steps.vars.outputs.tag }}
          TF_INPUT: "false"
        run: terraform apply -auto-approve -lock-timeout=120s -input=false