deploy.yml

name: deploy
on:
  push:
jobs:
  test:
    permissions:
      contents: read
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
        with:
          go-version: '>=1.23.4'

      - name: golangci-lint
        uses: golangci/golangci-lint-action@ec5d18412c0aeab7936cb16880d708ba2a64e1ae # v6
        with:
          version: latest
      
      - name: Install dependencies
        run: go get .

      - name: Build
        run: go build -v

      - name: Test with the Go CLI
        run: go test -v -race ./...

  integration-test:
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: build
        run: docker build -t ghat:latest .

      - name: run
        run: |
          echo "${{ secrets.APP_KEY }}" | base64 -d > /tmp/app.key

          docker run -d \
            -e GITHUB_APP_ID="${{ secrets.GH_APP_ID }}" \
            -e GITHUB_INSTALL_ID="${{ secrets.GH_INSTALL_ID }}" \
            -e GITHUB_APP_PRIVATE_KEY=/tmp/app.key \
            -v /tmp/app.key:/tmp/app.key \
            --rm \
            --name ghat \
            -p 8080:8080 \
            ghat:latest

      - name: Wait for container to be ready
        run: |
          TOKEN=$(curl -s \
            -H "Accept: application/json; api-version=2.0" \
            -H "Content-Type: application/json" -d "{}"  \
            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r '.value')
          for i in {1..5}; do
            if curl -s -H "Authorization: Bearer $TOKEN" http://localhost:8080/test | grep "ok"; then
              echo "Auth passed!"
              exit 0
            fi
            echo "Waiting for container to be ready..."
            sleep 2
          done
          echo "Container did not start in time!" && exit 1

      - name: Make sure no JWT fails
        run: |
          response=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/test)
          if [ "$response" -ne 401 ]; then
            echo "Failed: Expected 401 Unauthorized without Authorization header, got $response"
            exit 1
          else
            echo "Pass: 401 Unauthorized without Authorization header"
          fi

      - name: Make sure bad JWT fails
        run: |
          fake_jwt=$(echo -n '{"alg":"RS256","typ":"JWT"}' | base64 | tr -d '=')
          fake_payload=$(echo -n '{"sub":"fake","aud":"fake","iss":"https://fake-issuer"}' | base64 | tr -d '=')
          fake_signature=$(echo -n "fake_signature" | base64 | tr -d '=')
          fake_token="$fake_jwt.$fake_payload.$fake_signature"

          response=$(curl -s -o /dev/null -w "%{http_code}" \
            -H "Authorization: Bearer $fake_token" \
            http://localhost:8080/test)

          if [ "$response" -ne 401 ]; then
            echo "Failed: Expected 401 Unauthorized for non-GitHub signed JWT, got $response"
            exit 1
          else
            echo "Pass: 401 Unauthorized for non-GitHub signed JWT"
          fi

      - name: Stop and remove container
        if: always()
        run: |
          docker logs ghat
          rm /tmp/app.key
          docker stop ghat

  build-push-ar:
    needs: [test, integration-test]
    uses: libops/actions/.github/workflows/build-push.yml@main
    with:
      image: "private/ghat"
    permissions:
      contents: read
      id-token: write
    secrets: inherit

  deploy:
    if: github.ref == 'refs/heads/main'
    needs: [build-push-ar]
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-24.04
    env:
      TF_VAR_project: ${{ secrets.GCLOUD_PROJECT }}
      TF_VAR_vault_addr: ${{ secrets.VAULT_ADDR }}
      TF_VAR_gh_app_id: ${{ secrets.GH_APP_ID }}
      TF_VAR_gh_install_id: ${{ secrets.GH_INSTALL_ID }}
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

    - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
      with:
        terraform_version: 1.5.7

    - name: lint
      run: terraform fmt **/*.tf

    - uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2
      with:
        version: 'latest'

    - id: 'auth'
      uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
      with:
        workload_identity_provider: ${{ secrets.GCLOUD_OIDC_POOL }}
        service_account: ${{ secrets.GSA }}
        token_format: 'access_token'

    - name: Configure gcloud
      run: |
        gcloud config set project ${{ secrets.GCLOUD_PROJECT }}
        gcloud config set disable_prompts true

    - uses: 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567' # v3
      name: 'Docker login'
      with:
        registry: 'us-docker.pkg.dev'
        username: 'oauth2accesstoken'
        password: '${{ steps.auth.outputs.access_token }}'

    - name: Terraform Init
      run: terraform init -upgrade 2>&1 > /tmp/terraform.log

    - name: Terraform Apply
      run: terraform apply -auto-approve 2>&1 >> /tmp/terraform.log

    - name: Upload logs as artifacts
      if: ${{ always() }}
      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
      with:
        name: terraform.log
        path: /tmp/terraform.log

    - name: cleanup
      if: ${{ always() }}
      run: rm /tmp/terraform.log