wonderwall/.github/workflows/deploy.yaml

name: Build wonderwall
on: [push]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
env:
  GOOGLE_REGISTRY: europe-north1-docker.pkg.dev
  GITHUB_REGISTRY: ghcr.io
permissions:
  contents: read
jobs:
  verify:
    name: ${{ matrix.task }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        task: [check, test]
    steps:
      - name: Checkout latest code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # ratchet:actions/setup-go@v7
        with:
          go-version-file: 'go.mod'
      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # ratchet:jdx/mise-action@v4
      - run: mise run ${{ matrix.task }}
  build:
    needs: verify
    name: Publish to Google and GitHub registries
    if: github.ref == 'refs/heads/master'
    permissions:
      id-token: "write"
      packages: "write"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # ratchet:sigstore/cosign-installer@v4.1.2
      - name: Verify runner image
        run: cosign verify --certificate-oidc-issuer https://accounts.google.com  --certificate-identity keyless@distroless.iam.gserviceaccount.com gcr.io/distroless/static-debian12:nonroot
      - uses: nais/platform-build-push-sign@07a21e2293624a78499c79eeea3ce6d314f8a8d9 # ratchet:nais/platform-build-push-sign@main
        id: build_push_sign
        with:
          name: wonderwall
          dockerfile: Dockerfile
          google_service_account: gh-wonderwall
          multi-platform: true
          push: true
          push_ghcr: true
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
    outputs:
      version: ${{ steps.build_push_sign.outputs.version }}
  charts:
    needs: build
    name: Build and push chart
    if: github.ref == 'refs/heads/master'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        chart: ["wonderwall", "wonderwall-forward-auth"]
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7
      - id: "auth"
        name: "Authenticate to Google Cloud"
        uses: "google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093" # ratchet:google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: "gh-wonderwall@nais-io.iam.gserviceaccount.com"
          token_format: "access_token"
      - name: "Login to registry"
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # ratchet:docker/login-action@v4
        with:
          registry: "${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature"
          username: "oauth2accesstoken"
          password: "${{ steps.auth.outputs.access_token }}"
      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # ratchet:azure/setup-helm@v5
        name: 'Setup Helm'
        with:
          version: '3.13.2'
      - name: Package chart
        id: package_chart
        env:
          CHART_PATH: ./charts/${{ matrix.chart }}
        run: |
          base_version="1.0.0"
          chart_version="${base_version}-${{ needs.build.outputs.version }}"

          yq eval \
            '.version="'"$chart_version"'"' \
            "${{ env.CHART_PATH }}/Chart.yaml" --inplace
          yq eval \
            '.image.tag="${{ needs.build.outputs.version }}"' \
            "${{ env.CHART_PATH }}/values.yaml" --inplace

          helm dependency update "${{ env.CHART_PATH }}"
          helm package "${{ env.CHART_PATH }}" --destination .

          name=$(yq '.name' < "${{ env.CHART_PATH }}/Chart.yaml")
          echo "name=$name" >> $GITHUB_OUTPUT
          echo "version=$chart_version" >> $GITHUB_OUTPUT
          echo "archive=$name-$chart_version.tgz" >> $GITHUB_OUTPUT
      - name: Push Chart
        run: |-
          chart="${{ steps.package_chart.outputs.archive }}"
          echo "Pushing: $chart"
          helm push "$chart" oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature
  rollout:
    name: Rollout
    if: github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/master'
    needs: [build, charts]
    runs-on: fasit-deploy
    permissions:
      id-token: write
    steps:
      - uses: nais/fasit-deploy@53e433b1bdd08fc622e03a78584c0832c9083bd3 # ratchet:nais/fasit-deploy@v4.1.1
        with:
          chart: oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature/wonderwall
          version: "1.0.0-${{ needs.build.outputs.version }}"
          targets: |
            [
              { "target": { "kind": "tenant", "tenant": "ci-nais" }, "wait": true },
              { "target": { "kind": "tenant" } }
            ]
      - uses: nais/fasit-deploy@53e433b1bdd08fc622e03a78584c0832c9083bd3 # ratchet:nais/fasit-deploy@v4.1.1
        with:
          chart: oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature/wonderwall-forward-auth
          version: "1.0.0-${{ needs.build.outputs.version }}"
          targets: |
            [
              { "target": { "kind": "management", "tenant": "ci-nais" }, "wait": true },
              { "target": { "kind": "management" } }
            ]