test_gcp_integration.yaml

name: GCP Deployment

on:
  schedule:
    - cron: "0 0 * * MON"
  workflow_dispatch:
    inputs:
      branch:
        description: 'Nebari branch to deploy, test, destroy'
        required: true
        default: develop
        type: string
      image-tag:
        description: 'Nebari image tag created by the nebari-docker-images repo'
        required: true
        default: main
        type: string
      tf-log-level:
        description: 'Change Terraform log levels'
        required: false
        default: info
        type: choice
        options:
        - info
        - warn
        - debug
        - trace
        - error

env:
  NEBARI_GH_BRANCH: ${{ github.event.inputs.branch || 'develop' }}
  NEBARI_IMAGE_TAG: ${{ github.event.inputs.image-tag || 'main' }}
  TF_LOG: ${{ github.event.inputs.tf-log-level || 'info' }}


jobs:
  test-gcp-integration:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ env.NEBARI_GH_BRANCH }}
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.11

      - name: Install Nebari
        run: |
          pip install .[dev]
          playwright install

      - name: Retrieve secret from Vault
        uses: hashicorp/vault-action@v2.5.0
        with:
          method: jwt
          url: "https://quansight-vault-public-vault-b2379fa7.d415e30e.z1.hashicorp.cloud:8200"
          namespace: "admin/quansight"
          role: "repository-nebari-dev-nebari-role"
          secrets: |
            kv/data/repository/nebari-dev/nebari/google_cloud_platform/nebari-dev-ci/github-nebari-dev-repo-ci project_id | PROJECT_ID;
            kv/data/repository/nebari-dev/nebari/google_cloud_platform/nebari-dev-ci/github-nebari-dev-repo-ci workload_identity_provider | GCP_WORKFLOW_PROVIDER;
            kv/data/repository/nebari-dev/nebari/google_cloud_platform/nebari-dev-ci/github-nebari-dev-repo-ci service_account_name | GCP_SERVICE_ACCOUNT;
            kv/data/repository/nebari-dev/nebari/cloudflare/internal-devops@quansight.com/nebari-dev-ci token | CLOUDFLARE_TOKEN;

      - name: 'Authenticate to GCP'
        uses: 'google-github-actions/auth@v1'
        with:
            token_format: access_token
            workload_identity_provider: ${{ env.GCP_WORKFLOW_PROVIDER }}
            service_account: ${{ env.GCP_SERVICE_ACCOUNT }}

      - name: Set required environment variables
        run: |
          echo "GOOGLE_CREDENTIALS=${{ env.GOOGLE_APPLICATION_CREDENTIALS }}" >> $GITHUB_ENV

      - name: Integration Tests
        run: |
          pytest --version
          pytest tests/tests_integration/ -vvv -s --cloud gcp
        env:
          NEBARI_SECRET__default_images__jupyterhub: "quay.io/nebari/nebari-jupyterhub:${{ env.NEBARI_IMAGE_TAG }}"
          NEBARI_SECRET__default_images__jupyterlab: "quay.io/nebari/nebari-jupyterlab:${{ env.NEBARI_IMAGE_TAG }}"
          NEBARI_SECRET__default_images__dask_worker: "quay.io/nebari/nebari-dask-worker:${{ env.NEBARI_IMAGE_TAG }}"