deploy.yml

name: deploy
on:
  push:
    branches: [main]
  workflow_dispatch:
jobs:
  run:
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

    - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3
      with:
        terraform_version: 1.5.7

    - name: lint
      run: terraform fmt **/*.tf

    - id: 'auth'
      uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
      with:
        workload_identity_provider: ${{ secrets.GCLOUD_OIDC_POOL }}
        service_account: ${{ secrets.GSA }}
        token_format: 'access_token'

    - uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2
      with:
        version: 'latest'

    - name: Configure gcloud
      run: |
        gcloud config set project ${{ secrets.GCLOUD_PROJECT }}
        gcloud config set disable_prompts true

    - uses: 'docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567' # v3
      name: 'Docker login'
      with:
        registry: 'us-docker.pkg.dev'
        username: 'oauth2accesstoken'
        password: '${{ steps.auth.outputs.access_token }}'

    - id: 'id_token'
      uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
      with:
        workload_identity_provider: ${{ secrets.GCLOUD_OIDC_POOL }}
        service_account: ${{ secrets.GSA }}
        id_token_audience: "vault/ci"
        token_format: 'id_token'
        id_token_include_email: true

    - name: Install vault
      env:
        VAULT_VERSION: 1.18.3
      run: |
        wget -q https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip
        unzip vault_${VAULT_VERSION}_linux_amd64.zip
        sudo mv vault /usr/bin/

    - name: terraform apply
      env:
        TF_VAR_project: ${{ secrets.GCLOUD_PROJECT }}
        TF_VAR_region: ${{ secrets.GCLOUD_REGION }}
        VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
      run: ./scripts/run.sh ci "${{ steps.id_token.outputs.id_token }}" > terraform.log 2>&1

    - name: Upload terraform log
      if: ${{ always() }}
      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4
      with:
        name: terraform.log-${{ github.sha }}
        path: ./terraform.log
        overwrite: true

    - name: cleanup
      if: ${{ always() }}
      run: rm terraform.log