action.yaml

name: 'initial-setup'
runs:
  using: "composite"
  steps:
    - name: Use Githubs federated identity with AWS
      uses: aws-actions/configure-aws-credentials@v1
      with:
        role-to-assume: ${{ env.IAM_ROLE }}
        aws-region: ${{ env.AWS_REGION }}

    - name: Get secrets from AWS Secrets Manager
      uses: aws-actions/aws-secretsmanager-get-secrets@v1
      with:
        aws-region: ${{ env.AWS_REGION }}
        secret-ids: |
          DEV_INDEXER_V2
          DEV_OPERATOR_V2
          COMMON
        parse-json-secrets: true # to be able to get the json k/v pairs

    - name: Login to ECR
      id: login-ecr
      uses: aws-actions/amazon-ecr-login@v1

    - name: Checkout the code
      uses: actions/checkout@v4

    - name: Set up QEMU action
      uses: docker/setup-qemu-action@v3

    # This is a separate action that sets up buildx runner
    - name: Set up Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@v2

    # So now you can use Actions' own caching!
    - name: Cache Docker layers
      uses: actions/cache@v2
      with:
        path: /tmp/.buildx-cache
        key: ${{ runner.os }}-single-buildx-${{ github.sha }}
        restore-keys: |
          ${{ runner.os }}-single-buildx

    # And make it available for builds
    - name: Build image
      uses: docker/build-push-action@v2
      with:
        context: .
        builder: ${{ steps.buildx.outputs.name }}
        file: Dockerfile
        build-args: AWS_ECR_URL=${{ steps.login-ecr.outputs.registry }}
        platforms: linux/amd64,linux/arm64/v8
        tags: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}:${{ env.IMAGE_TAG }}
        cache-from: type=local,src=/tmp/.buildx-cache
        cache-to: type=local,dest=/tmp/.buildx-cache-new
        push: true # set false to deactivate the push to ECR

    # This ugly bit is necessary if you don't want your cache to grow forever until it hits GitHub's limit of 5GB.
    # https://github.com/docker/build-push-action/issues/252 & https://github.com/moby/buildkit/issues/1896
    - name: Move cache
      shell: bash
      run: |
        rm -rf /tmp/.buildx-cache
        mv /tmp/.buildx-cache-new /tmp/.buildx-cache

    - name: Configure AWS creds to access EKS
      # TIP: the deployment user must be in the masters group in the aws-auth config map in the cluster
      uses: aws-actions/configure-aws-credentials@v1
      with:
        aws-access-key-id: ${{ env.AWS_KEY_ID }} #notice: unique for each env
        aws-secret-access-key: ${{ env.AWS_ACCESS_KEY }} #notice: unique for each env
        aws-region: ${{ env.AWS_REGION }}

    # NOTICE: --- INDEXER ---
    - name: Pull the holograph-indexer helm chart version x.x.x from ECR
      shell: bash
      env:
        CHART_REPO: holo-indexer
        CHART_VERSION: ${{ env.STG_HOLOGRAPH_INDEXER_HELM_CHART_VERSION }}
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
      run: |
        helm pull oci://$ECR_REGISTRY/$CHART_REPO --version $CHART_VERSION

    # NOTICE: --- OPERATOR ---
    - name: Pull the holograph-operator helm chart version x.x.x from ECR
      shell: bash
      env:
        CHART_REPO: holo-operator
        CHART_VERSION: ${{ env.STG_HOLOGRAPH_OPERATOR_HELM_CHART_VERSION }}
        ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
      run: |
        helm pull oci://$ECR_REGISTRY/$CHART_REPO --version $CHART_VERSION