build-and-deploy.yml

name: Bygg og deploy

on:
    push:
        branches:
            - main
        paths-ignore:
            - '**.md'
env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    IMAGE: europe-north1-docker.pkg.dev/${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}/aap/${{ github.event.repository.name }}

jobs:
    bygg:
        permissions:
            contents: write
            id-token: write
        runs-on: ubuntu-latest
        outputs:
            image: ${{ steps.kompiler.outputs.image }}
        steps:
            -   name: Sjekker ut kode
                uses: actions/checkout@v4.1.1

            -   name: Setter opp Java 17
                uses: actions/setup-java@v3.13.0
                with:
                    java-version: 17
                    distribution: temurin
                    cache: maven

           # -   name: Installerer cosign
            #    uses: sigstore/cosign-installer@v3.2.0
             #   with:
              #      cosign-release: 'v1.3.1'

           # -   name: Verifiserer distroless base-image
                # run: cosign verify --key distroless.pub gcr.io/distroless/Java17

            -   name: Setter tag-navn
                run: echo "TAG=$(date +%Y.%m.%d.%H%M%S)-$(echo $GITHUB_SHA | cut -c1-7)" >> $GITHUB_ENV

            -   name: Login GAR
                uses: nais/login@v0
                with:
                    project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
                    identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
                    team: aap

            -   name: Submit Dependency Snapshot
                uses: advanced-security/maven-dependency-submission-action@v3
                with:
                    settings-file: .github/.m2/settings.xml

            -   name: Kompilerer og bygger image
                id: kompiler
                run: |
                    echo "image=${{ env.IMAGE }}:${{ env.TAG }}" >> $GITHUB_OUTPUT
                    ./mvnw  -Dmaven.plugin.validation=VERBOSE --settings .github/.m2/settings.xml -Djib.to.tags=${TAG} -DGAR_TOKEN=${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}  -Drevision=${TAG} package jib:build
                    echo "DIGEST=$(cat target/jib-image.digest)" >> $GITHUB_ENV

            -   name: Attester og signer
                uses: nais/attest-sign@v1.1.0
                with:
                    sbom: target/bom.json
                    image_ref: ${{ env.IMAGE }}@${{ env.DIGEST }}

    deploy:
        strategy:
            matrix:
                cluster: [ dev-gcp, prod-gcp ]
        name: Deploy til ${{matrix.cluster}}
        needs: bygg
        runs-on: ubuntu-latest
        timeout-minutes: 30
        environment: ${{matrix.cluster}}:aap
        env:
            PRINT_PAYLOAD: true
            APIKEY: ${{secrets.NAIS_DEPLOY_APIKEY}}
            RESOURCE: .nais/naiserator.yaml,.nais/${{matrix.cluster}}-alerts.yaml
            CLUSTER: ${{matrix.cluster}}
            VARS: .nais/${{matrix.cluster}}.json
            IMAGE: ${{needs.bygg.outputs.image}}
        steps:
            -   uses: actions/checkout@v4.1.1
            -   uses: nais/deploy/actions/deploy@master