cloud-run.yaml

name: Deploy to Cloud Run

on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

jobs:
  deploy:
    runs-on: ubuntu-latest

    permissions:
      id-token: write # federates with GCP

    steps:
    - name: 'Github Actions Runner'
      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
      with:
        egress-policy: audit

    - name: 'Checkout default branch to $GITHUB_WORKSPACE dir'
      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3

    - uses: actions/setup-node@2fddd8803e2f5c9604345a0b591c3020ee971a93 # v3
      with:
        node-version: 16

    - name: Update themes
      run: git submodule update --init --recursive

    - name: npm install
      run: npm install

    - name: npm run build
      run: npm run build

    - name: Authenticate to Google Cloud
      id: auth
      uses: google-github-actions/auth@ceee102ec2387dd9e844e01b530ccd4ec87ce955 # v0
      with:
        token_format: 'access_token'
        project_id: '${{ secrets.PROJECT_ID }}'
        workload_identity_provider: '${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}'
        service_account: '${{ secrets.GCP_SERVICE_ACCOUNT }}'

    - name: Docker Auth
      id: docker-auth
      uses: 'docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a' # v2
      with:
        username: 'oauth2accesstoken'
        password: '${{ steps.auth.outputs.access_token }}'
        registry: '${{ secrets.REGISTRY_URL }}'

    - name: Build and push
      uses: 'docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5' # v3
      with:
        context: .
        push: true
        tags: '${{ secrets.REGISTRY_URL }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ secrets.SERVICE }}:${{ github.sha }}'

    - name: Deploy to Cloud Run
      uses: 'google-github-actions/deploy-cloudrun@5081b8db809e5800ddffa3c692d71da0cb670a34' # v0.10.3
      with:
        service: 'academy'
        image: '${{ secrets.REGISTRY_URL }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ secrets.SERVICE }}:${{ github.sha }}'

    # Attempt to deploy the terraform configuration
    - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v2.0.0
      with:
        terraform_version: 1.6
    - env:
        TF_VAR_image: '${{ secrets.REGISTRY_URL }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ secrets.SERVICE }}:${{ github.sha }}'
        TF_VAR_project_id: ${{ secrets.PROJECT_ID }}
      working-directory: ./iac
      run: |
        terraform init

        terraform plan

        terraform apply -auto-approve