build_and_push.yaml

name: Build, push, and rollout
on:
  push:
    branches:
      - main

env:
  GOOGLE_REGISTRY: "europe-north1-docker.pkg.dev"
  FEATURE_NAME: "teams-frontend"

jobs:
  build_and_push:
    runs-on: ubuntu-22.04
    permissions:
      contents: "read"
      id-token: "write"
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: 16
      - uses: azure/setup-helm@v3
        with:
          version: "v3.11.1"

      - name: Generate SBOM
        run: |
          npm i
          npm run build
          npm run generate-sbom

      - name: Build docker image
        uses: nais/platform-build-push-sign@main
        id: build_push_sign
        with:
          name: ${{ env.FEATURE_NAME }}
          google_service_account: gh-${{ env.FEATURE_NAME }}
          push: ${{ github.actor != 'dependabot[bot]' }}
          sbom: "sbom.json" # generated by `npm run generate-sbom
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}

      - name: Package chart
        id: package_chart
        env:
          CHART_PATH: ./charts/${{ env.FEATURE_NAME }}
        run: |
          base_version="$(yq '.version' < "${{ env.CHART_PATH }}/Chart.yaml")"
          chart_version="${base_version}-${{ steps.build_push_sign.outputs.version }}"

          yq eval \
            '.version="'"$chart_version"'"' \
            "${{ env.CHART_PATH }}/Chart.yaml" --inplace
          yq eval \
            '.image.tag="${{ steps.build_push_sign.outputs.version }}"' \
            "${{ env.CHART_PATH }}/values.yaml" --inplace

          # helm dependency update "${{ env.CHART_PATH }}"
          helm package "${{ env.CHART_PATH }}" --destination .

          name=$(yq '.name' < "${{ env.CHART_PATH }}/Chart.yaml")
          echo "name=$name" >> $GITHUB_OUTPUT
          echo "version=$chart_version" >> $GITHUB_OUTPUT
          echo "archive=$name-$chart_version.tgz" >> $GITHUB_OUTPUT

      - id: "auth"
        name: "Authenticate to Google Cloud"
        uses: "google-github-actions/auth@v1"
        with:
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: "gh-${{ env.FEATURE_NAME }}@nais-io.iam.gserviceaccount.com"
          token_format: "access_token"

      - name: "Log in to Google Artifact Registry"
        run: |-
          echo '${{ steps.auth.outputs.access_token }}' | docker login -u oauth2accesstoken --password-stdin https://${{ env.GOOGLE_REGISTRY }}

      - name: Push Chart
        run: |-
          chart="${{ steps.package_chart.outputs.archive }}"
          echo "Pushing: $chart"
          helm push "$chart" oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature

    outputs:
      chart_name: ${{ steps.package_chart.outputs.name }}
      chart_version: ${{ steps.package_chart.outputs.version }}
      chart_archive: ${{ steps.package_chart.outputs.archive }}


  rollout:
    runs-on: fasit-deploy
    permissions:
      id-token: write
    needs:
      - build_and_push
    steps:
      - uses: nais/fasit-deploy@v2
        with:
          chart: oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature/${{ needs.build_and_push.outputs.chart_name }}
          version: ${{ needs.build_and_push.outputs.chart_version }}