deploy-staging.yaml

---
name: Deploy (Staging)
on:
  workflow_run:
    workflows: [Release Image (Staging)]
    branches: [staging]
    types: [completed]
jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    if: |
      ${{ github.event_name == 'workflow_dispatch' }}
      || ${{ github.event.workflow_run.conclusion == 'success' }}
    environment:
      name: staging
      url: https://staging.backend.basedosdados.org
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: staging
      - name: Import secrets from Vault
        id: import_secrets
        uses: hashicorp/vault-action@v2.8.0
        with:
          url: https://vault.basedosdados.org
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            secret/data/gcp_credentials/basedosdados-dev GCP_PROJECT_ID   | GCP_PROJECT_ID ;
            secret/data/gcp_credentials/basedosdados-dev GH_ACTIONS_SA    | GCP_SA ;
            secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_NAME | GKE_CLUSTER_NAME ;
            secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_ZONE | GKE_CLUSTER_ZONE ;
      - name: Setup Google Cloud CLI
        uses: google-github-actions/setup-gcloud@v0.2.1
        with:
          service_account_key: ${{ steps.import_secrets.outputs.GCP_SA }}
          project_id: ${{ steps.import_secrets.outputs.GCP_PROJECT_ID }}
          export_default_credentials: true
      - name: Get GKE credentials
        uses: google-github-actions/get-gke-credentials@v0.2.1
        with:
          cluster_name: ${{ steps.import_secrets.outputs.GKE_CLUSTER_NAME }}
          location: ${{ steps.import_secrets.outputs.GKE_CLUSTER_ZONE }}
          credentials: ${{ steps.import_secrets.outputs.GCP_SA }}
      - name: Write values.yaml file
        run: |
          cat << EOF > values.yaml
          environment: "staging"
          api:
            name: "api-staging"
            image:
              name: "ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}"
              tag: "staging"
              pullPolicy: "Always"
            replicas: 1
            resources:
              limits:
                cpu: 500m
                memory: 1Gi
              requests:
                cpu: 250m
                memory: 500Mi
            envFrom:
              - secretRef:
                  name: api-staging-secrets
            settingsModule: "backend.settings.remote"
          database:
            host: "cloud-sql-proxy"
            port: 5432
            name: "api_staging"
            user: "api_staging"
            passwordSecret: "api-staging-database-password"
          ingress:
            enabled: true
            host: "staging.backend.basedosdados.org"
            annotations:
              kubernetes.io/ingress.class: nginx
              nginx.ingress.kubernetes.io/rewrite-target: /
              cert-manager.io/issuer: "letsencrypt-production"
              nginx.ingress.kubernetes.io/ssl-redirect: "true"
            tls:
              - hosts:
                  - staging.backend.basedosdados.org
                secretName: staging-api-basedosdados-org-tls
          EOF
      - name: Deploy using Helm
        run: |-
          helm upgrade \
            --wait \
            --install \
            --namespace website \
            --values values.yaml \
            api-staging charts/basedosdados-api/.