main.yml

name: Build and deploy elector

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    paths-ignore:
      - '*.md'

env:
  GOOGLE_REGISTRY: "europe-north1-docker.pkg.dev"

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    env:
      RUNNER_IMG: "gcr.io/distroless/static-debian11"
      RUNNERIMG_IDENTITY: "keyless@distroless.iam.gserviceaccount.com"
      RUNNERIMG_ISSUER: "https://accounts.google.com"
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # ratchet:actions/checkout@v3
      - name: Install cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # ratchet:sigstore/cosign-installer@v3.7.0
        with:
          cosign-release: 'v2.2.1'
      - name: Verify runner image
        run: cosign verify --certificate-identity ${{ env.RUNNERIMG_IDENTITY }} --certificate-oidc-issuer ${{ env.RUNNERIMG_ISSUER }} ${{ env.RUNNER_IMG }}
      - uses: nais/platform-build-push-sign@main # ratchet:exclude
        id: build-push-sign
        with:
          name: elector
          dockerfile: Dockerfile
          google_service_account: gh-elector
          push: ${{ github.actor != 'dependabot[bot]' }}
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
          multi-platform: true
          cache_from: type=gha
          cache_to: type=gha,mode=max
    outputs:
      version: "${{ steps.build-push-sign.outputs.version }}"

  chart:
    permissions:
      contents: 'read'
      id-token: 'write'
    name: Build and push chart
    runs-on: ubuntu-latest
    needs:
      - build
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # ratchet:actions/checkout@v4
      - id: 'auth'
        name: 'Authenticate to Google Cloud'
        if: github.ref == 'refs/heads/main'
        uses: 'google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70' # ratchet:google-github-actions/auth@v2.1.6
        with:
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: 'gh-elector@nais-io.iam.gserviceaccount.com'
          token_format: 'access_token'
      - name: 'Set up Cloud SDK'
        uses: 'google-github-actions/setup-gcloud@f0990588f1e5b5af6827153b93673613abdc6ec7' # ratchet:google-github-actions/setup-gcloud@v1
      - name: 'Log in to Google Artifact Registry'
        if: github.ref == 'refs/heads/main'
        run: |-
          echo '${{ steps.auth.outputs.access_token }}' | docker login -u oauth2accesstoken --password-stdin https://${{ env.GOOGLE_REGISTRY }}
      - uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # ratchet:azure/setup-helm@v3
        name: 'Setup Helm'
        with:
          version: '3.8.0'
      - name: Set versions
        run: |-
          for chart in charts/*; do
            yq e '.version = "${{ needs.build.outputs.version }}"' --inplace "${chart}/Chart.yaml"
            yq e '.image.tag = "${{ needs.build.outputs.version }}"' --inplace "${chart}/values.yaml"
          done
      - name: Build Chart
        run: |-
          for chart in charts/*; do
            helm package "$chart"
          done
      - name: Push Chart
        if: github.ref == 'refs/heads/main'
        run: |-
          for chart in *.tgz; do
            helm push "$chart" oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature
          done

  rollout:
    name: Rollout
    if: github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/main'
    needs:
      - build
      - chart
    runs-on: fasit-deploy
    permissions:
      id-token: write
    steps:
      - uses: nais/fasit-deploy@v2 # ratchet:exclude
        with:
          chart: oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature/elector
          version: ${{ needs.build.outputs.version }}
          feature_name: elector