push.back.yml

name: Back End Workflow

on:
  push:
    branches:
      - main
      - dev
    paths:
      - 'src/**'
      - '.github/workflows/dotnet.yml'

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

permissions:
  id-token: write
  contents: read

jobs:
  deploy-gcp-dev:
    name: Deploy dev GCP infrastructure
    runs-on: ubuntu-latest
    environment:
      name: dev
    if: github.ref == 'refs/heads/dev'

    steps:
      - name: ⬇️ Set up code
        uses: actions/checkout@v4
        with:
          show-progress: false

      - name: 🗝️ Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          create_credentials_file: true
          token_format: access_token
          workload_identity_provider: ${{ secrets.IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}

      - name: 🐳 Set up Docker Buildx
        id: builder
        uses: docker/setup-buildx-action@v3

      - name: 🗝️ Authenticate Docker to Google Cloud
        uses: docker/login-action@v3
        with:
          registry: gcr.io
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}

      - name: 🏷️ Extract tags from GitHub
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: gcr.io/${{ secrets.PROJECT_ID }}/app
          tags: |
            type=ref,suffix=-{{sha}},event=branch
            type=ref,prefix=pr-,suffix=-{{sha}},event=pr
            type=semver,pattern={{version}}
            latest

      - name: 📦 Build and push image
        uses: docker/build-push-action@v5
        with:
          builder: ${{ steps.builder.outputs.name }}
          tags: ${{ steps.meta.outputs.tags }}
          file: ./src/Dockerfile
          context: .
          build-args: |
            VITE_DISCOVER=${{ secrets.UGRC_DISCOVER_KEY }}
            VITE_WEB_API=${{ secrets.UGRC_API_KEY }}
            VITE_PRINT_PROXY=${{ secrets.UGRC_PRINT_PROXY_URL }}
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: false

      - name: 🚀 Deploy to Cloud Run
        id: deploy
        uses: google-github-actions/deploy-cloudrun@v2
        with:
          service: app
          image: gcr.io/${{ secrets.PROJECT_ID }}/app
          region: us-central1
          flags: |
            --service-account=cloud-run-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
            --vpc-connector=${{ secrets.VPC }}
            --vpc-egress=all-traffic
            --max-instances=5
            --concurrency=250
            --cpu=1
            --memory=512Mi
            --timeout=5m
          env_vars: >
            ASPNETCORE_URLS=http://+:8080,
            ASPNETCORE_ENVIRONMENT=Production
          secrets: |
            /secrets/dotnet/appsettings.Production.json=dotnet-appsettings:latest

  deploy-gcp-prod:
    name: Deploy prod GCP infrastructure
    runs-on: ubuntu-latest
    environment:
      name: prod
    if: github.ref == 'refs/heads/main'

    steps:
      - name: ⬇️ Set up code
        uses: actions/checkout@v4
        with:
          show-progress: false

      - name: 🗝️ Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v2
        with:
          create_credentials_file: true
          token_format: access_token
          workload_identity_provider: ${{ secrets.IDENTITY_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}

      - name: 🐳 Set up Docker Buildx
        id: builder
        uses: docker/setup-buildx-action@v3

      - name: 🗝️ Authenticate Docker to Google Cloud
        uses: docker/login-action@v3
        with:
          registry: gcr.io
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}

      - name: 🏷️ Extract tags from GitHub
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: gcr.io/${{ secrets.PROJECT_ID }}/app
          tags: |
            type=ref,suffix=-{{sha}},event=branch
            type=ref,prefix=pr-,suffix=-{{sha}},event=pr
            type=semver,pattern={{version}}
            latest

      - name: 📦 Build and push image
        uses: docker/build-push-action@v5
        with:
          builder: ${{ steps.builder.outputs.name }}
          tags: ${{ steps.meta.outputs.tags }}
          file: ./src/Dockerfile
          provenance: false
          context: .
          build-args: |
            VITE_DISCOVER=${{ secrets.UGRC_DISCOVER_KEY }}
            VITE_WEB_API=${{ secrets.UGRC_API_KEY }}
            VITE_PRINT_PROXY=${{ secrets.UGRC_PRINT_PROXY_URL }}
          push: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: 🚀 Deploy to Cloud Run
        id: deploy
        uses: google-github-actions/deploy-cloudrun@v2
        with:
          service: app
          image: gcr.io/${{ secrets.PROJECT_ID }}/app
          region: us-central1
          flags: |
            --service-account=cloud-run-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
            --vpc-connector=${{ secrets.VPC }}
            --vpc-egress=all-traffic
            --max-instances=5
            --concurrency=250
            --cpu=1
            --memory=512Mi
            --timeout=5m
          env_vars: >
            ASPNETCORE_URLS=http://+:8080,
            ASPNETCORE_ENVIRONMENT=Production
          secrets: |
            /secrets/dotnet/appsettings.Production.json=dotnet-appsettings:latest

      - name: 🔔 Publish deployment worknote
        uses: agrc/service-now-worknote-action@v1
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          username: ${{ secrets.SN_USERNAME }}
          password: ${{ secrets.SN_PASSWORD }}
          instance-name: ${{ secrets.SN_INSTANCE }}
          table-name: ${{ secrets.SN_TABLE }}
          system-id: ${{ secrets.SN_SYS_ID }}