push.yml

name: Push

on:
  push:
    branches:
      - main

permissions:
  contents: read
  id-token: write

jobs:
  apply-changes:
    name: Apply changes (${{ matrix.project }} @ ${{ matrix.stack-name }})
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        include:
          - project: core-infra
            stack-name: bjerk/prod
          - project: bjerk-io
            stack-name: bjerk/prod

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v4

      - uses: pnpm/action-setup@v2

      - name: Use Node LTS ✨
        uses: actions/setup-node@v3
        with:
          node-version: lts/*
          cache: pnpm

      - name: Authenticate with Google 🔑
        uses: google-github-actions/auth@v1
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}

      - uses: simenandre/setup-gke-gcloud-auth-plugin@v1

      - name: Install dependencies 📦️
        run: pnpm install --frozen-lockfile

      - name: Run Pulumi 🚀
        uses: pulumi/actions@v4
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
        with:
          command: up
          stack-name: ${{ matrix.stack-name }}
          work-dir: projects/${{ matrix.project }}