docker.yaml

name: Build, push to AWS ECR, and deploy
on:
  push:
    branches:
      - main

env:
  AWS_REGION: ca-central-1
  DOCKER_ORG: public.ecr.aws/v6b8u5o6
  DOCKER_SLUG: public.ecr.aws/v6b8u5o6/notify-api
  KUBECTL_VERSION: '1.23.6'
  OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN_STAGING }}

permissions:
  id-token: write   # This is required for requesting the OIDC JWT
  contents: read    # This is required for actions/checkout

jobs:
  deploy:
    runs-on: ubuntu-latest
    name: Build and push
    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - name: Install AWS CLI
      run: |
        curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
        unzip -q awscliv2.zip
        sudo ./aws/install --update
        aws --version

    - name: Configure credentials to CDS public ECR using OIDC
      uses: aws-actions/configure-aws-credentials@master
      with:
        role-to-assume: arn:aws:iam::283582579564:role/notification-api-apply
        role-session-name: NotifyApiGitHubActions
        aws-region: "us-east-1"
  
    - name: Login to ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@5a88a04c91d5c6f97aae0d9be790e64d9b1d47b7 # v1.7.1
      with:
        registry-type: public

    - name: Build
      run: |
        docker pull $DOCKER_SLUG:latest
        docker build \
        --cache-from $DOCKER_SLUG:latest \
        --build-arg GIT_SHA=${GITHUB_SHA::7} \
        -t $DOCKER_SLUG:${GITHUB_SHA::7} \
        -t $DOCKER_SLUG:latest \
        -f ci/Dockerfile .

    - name: Publish
      run: |
        docker push $DOCKER_SLUG:latest && docker push $DOCKER_SLUG:${GITHUB_SHA::7}

    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
      with:
        aws-access-key-id: ${{ secrets.STAGING_AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.STAGING_AWS_SECRET_ACCESS_KEY }}
        aws-region: ca-central-1

    - name: Install OpenVPN
      run: |
        sudo apt update
        sudo apt install -y openvpn openvpn-systemd-resolved

    - name: Install 1Pass CLI
      run: |
        curl -o 1pass.deb https://downloads.1password.com/linux/debian/amd64/stable/1password-cli-amd64-latest.deb
        sudo dpkg -i 1pass.deb

    - name: Setup Terraform tools
      uses: cds-snc/terraform-tools-setup@v1
      env: # In case you want to override default versions
        CONFTEST_VERSION: 0.30.0 
        TERRAFORM_VERSION: 1.9.5
        TERRAGRUNT_VERSION: 0.66.9
        TF_SUMMARIZE_VERSION: 0.2.3                           

    - name: Fetch VPN
      run: |
        curl https://raw.githubusercontent.com/cds-snc/notification-manifests/refs/heads/main/scripts/createVPNConfig.sh | bash -s staging

    - name: Connect to VPN
      uses: "kota65535/github-openvpn-connect-action@cd2ed8a90cc7b060dc4e001143e811b5f7ea0af5"
      with:
        config_file: /var/tmp/staging.ovpn
        echo_config: false       
        
    - name: Configure kubeconfig
      run: |
        aws eks update-kubeconfig --name notification-canada-ca-staging-eks-cluster     

    - name: Update images in staging
      run: |
        DOCKER_TAG=${GITHUB_SHA::7}
        kubectl set image deployment.apps/api api=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config
        kubectl set image deployment.apps/celery-beat celery-beat=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config
        kubectl set image deployment.apps/celery-sms celery-sms=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config
        kubectl set image deployment.apps/celery-primary celery-primary=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config
        kubectl set image deployment.apps/celery-scalable celery-scalable=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config
        kubectl set image deployment.apps/celery-sms-send-primary celery-sms-send-primary=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config
        kubectl set image deployment.apps/celery-sms-send-scalable celery-sms-send-scalable=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config
        kubectl set image deployment.apps/celery-email-send-primary celery-email-send-primary=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config
        kubectl set image deployment.apps/celery-email-send-scalable celery-email-send-scalable=$DOCKER_SLUG:$DOCKER_TAG -n=notification-canada-ca --kubeconfig=$HOME/.kube/config        


    - name: my-app-install token
      id: notify-pr-bot
      uses: getsentry/action-github-app-token@38a3ce582e170ddfe8789f509597c6944f2292a9 # v1.0.6
      with:
        app_id: ${{ secrets.NOTIFY_PR_BOT_APP_ID }}
        private_key: ${{ secrets.NOTIFY_PR_BOT_PRIVATE_KEY }}

    - uses: cds-snc/notification-pr-bot@main
      env:
        TOKEN: ${{ steps.notify-pr-bot.outputs.token }}

    - name: Generate docker SBOM
      uses: cds-snc/security-tools/.github/actions/generate-sbom@34794baf2af592913bb5b51d8df4f8d0acc49b6f # v3.2.0
      env:
        TRIVY_DB_REPOSITORY: ${{ vars.TRIVY_DB_REPOSITORY }}
      with:
        docker_image: "${{ env.DOCKER_SLUG }}:latest"
        dockerfile_path: "ci/Dockerfile"
        sbom_name: "notification-api"
        token: "${{ secrets.GITHUB_TOKEN }}"

    - name: Notify Slack channel if this job failed
      if: ${{ failure() }}
      run: |
        json="{'text':'<!here> CI is failing in <https://github.com/cds-snc/notification-api/actions/runs/${GITHUB_RUN_ID}|notification-api> !'}"
        curl -X POST -H 'Content-type: application/json' --data "$json"  ${{ secrets.SLACK_WEBHOOK }}