cicd-prd.yml

name: "CICD production"

on:
  # On merge
  push:
    branches:
      - main
  # On release
  release:
    types: [published]

jobs:
  build-makefile:
    permissions:
      id-token: write
      contents: write
    runs-on: ubuntu-22.04
    name: "Build image with Makefile"
    strategy:
      fail-fast: false
      matrix:
        application: [developer-portal]
        include:
          - application: developer-portal
            image_name: developer-portal
            path: .
            tag_length: 8
            tag_latest: false
    env:
      DOCKER_DOMAIN: asia-docker.pkg.dev
      REGISTRY: asia-docker.pkg.dev/prj-p-devops-services-tvwmrf63/zilliqa-public
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          submodules: recursive
          ref: ${{ github.event.pull_request.head.ref }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          fetch-depth: 0

      - name: "Authenticate to Google Cloud - production"
        id: google-auth
        uses: "google-github-actions/auth@v1"
        with:
          token_format: "access_token"
          workload_identity_provider: "${{ secrets.GCP_PRD_GITHUB_WIF }}"
          service_account: "${{ secrets.GCP_PRD_GITHUB_SA_DOCKER_REGISTRY }}"
          create_credentials_file: true

      - name: Login to the registry - production
        uses: docker/login-action@v2
        with:
          registry: ${{ env.DOCKER_DOMAIN }}
          username: "oauth2accesstoken"
          password: "${{ steps.google-auth.outputs.access_token }}"

      - name: Get tag version - production
        if: github.event_name == 'push'
        id: set-tag
        uses: Zilliqa/gh-actions-workflows/actions/generate-tag@v1
        with:
          tag: ${{ env.REGISTRY }}/${{ matrix.image_name }}
          length: ${{ matrix.tag_length }}

      - name: "Build and push ${{ matrix.application }} - production"
        if: github.event_name == 'push'
        env:
          ENVIRONMENT: prd
          IMAGE_TAG: ${{ steps.set-tag.outputs.tags }}
        run: |
          cd ${{ matrix.path }}
          make image/build-and-push

      - name: "Build and push ${{ matrix.application }} - production"
        if: github.event_name == 'release'
        env:
          ENVIRONMENT: prd
          IMAGE_TAG: ${{ env.REGISTRY }}/${{ matrix.image_name }}:${{ github.ref_name }}
          ENV_FILES_DECRYPTER_NONPRD: ${{ secrets.ENV_FILES_DECRYPTER_NONPRD }}
          ENV_FILES_DECRYPTER_PRD: ${{ secrets.ENV_FILES_DECRYPTER_PRD }}
        run: |
          cd ${{ matrix.path }}
          make image/build-and-push

      - name: "Build and push ${{ matrix.application }} tag latest - production"
        if: matrix.tag_latest == true && github.event_name == 'release'
        env:
          ENVIRONMENT: prd
          IMAGE_TAG: ${{ env.REGISTRY }}/${{ matrix.image_name }}:latest
          ENV_FILES_DECRYPTER_NONPRD: ${{ secrets.ENV_FILES_DECRYPTER_NONPRD }}
          ENV_FILES_DECRYPTER_PRD: ${{ secrets.ENV_FILES_DECRYPTER_PRD }}
        run: |
          cd ${{ matrix.path }}
          make image/build-and-push

  deploy-to-production:
    needs: [build-makefile]
    permissions:
      id-token: write
      contents: write
    runs-on: ubuntu-22.04
    if: github.event_name == 'release'
    strategy:
      fail-fast: false
      matrix:
        application:
          - developer-portal
    env:
      APP_NAME: ${{ matrix.application }}
      Z_ENV: infra/live/gcp/production/prj-p-prod-apps/z_ase1.yaml
      Z_SERVICE_ACCOUNT: ${{ secrets.GCP_PRD_GITHUB_SA_K8S_DEPLOY }}
      OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN_PRD }}
      GITHUB_PAT: ${{ secrets.GH_PAT }}
      Z_IMAGE: asia-docker.pkg.dev/prj-p-devops-services-tvwmrf63/zilliqa-private/z:latest
      REGISTRY: asia-docker.pkg.dev
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          repository: Zilliqa/devops
          token: ${{ env.GITHUB_PAT }}
          ref: main
          sparse-checkout: |
            ${{ env.Z_ENV }}

      - name: Authenticate to Google Cloud
        id: google-auth
        uses: google-github-actions/auth@v2
        with:
          token_format: "access_token"
          workload_identity_provider: "${{ secrets.GCP_PRD_GITHUB_WIF }}"
          service_account: ${{ env.Z_SERVICE_ACCOUNT }}
          create_credentials_file: true

      - name: Deploy application
        run: |
          gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://${{ env.REGISTRY }}
          docker run --rm \
              -e ZQ_USER='${{ env.Z_SERVICE_ACCOUNT }}' \
              -e Z_ENV='/devops/${{ env.Z_ENV }}' \
              -e OP_SERVICE_ACCOUNT_TOKEN='${{ env.OP_SERVICE_ACCOUNT_TOKEN }}' \
              -e GITHUB_PAT='${{ env.GITHUB_PAT }}' \
              -e CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE='/google/application_default_credentials.json' \
              -v `pwd`:/devops \
              -v ${{ steps.google-auth.outputs.credentials_file_path }}:/google/application_default_credentials.json \
              --name z_container ${{ env.Z_IMAGE }} \
              bash -c "gcloud config set account ${{ env.Z_SERVICE_ACCOUNT }} && z /app /devops app sync --cache-dir .cache ${{ env.APP_NAME }}"