build-master.yaml

name: Build master
on:
  push:
    branches:
      - master
    paths-ignore:
      - '**.md'
      - '**.MD'
      - '.gitignore'
      - 'LICENSE'
      - 'CODEOWNERS'
  workflow_dispatch:

jobs:
  codeql:
    uses: navikt/sif-gha-workflows/.github/workflows/gradle-codeql.yml@main
    permissions:
      actions: read
      contents: read
      pull-requests: read
      security-events: write
    secrets: inherit
    with:
      javaversion: 21
      package-command: './gradlew clean build -x test'
      branch: master

  test:
    uses: navikt/sif-gha-workflows/.github/workflows/gradle-test.yml@main
    permissions:
      contents: read
    secrets: inherit
    with:
      javaversion: 21

  build:
    uses: navikt/sif-gha-workflows/.github/workflows/gradle-build.yml@main
    permissions:
      contents: write
      id-token: write
    secrets: inherit
    with:
      team: k9saksbehandling
      javaversion: 21

  trivy:
    needs: [ build ]
    uses: navikt/sif-gha-workflows/.github/workflows/trivy.yml@main
    permissions:
      contents: write
      security-events: write
      id-token: write
      actions: read
    secrets: inherit
    with:
      image: ${{ needs.build.outputs.image }}
      team: k9saksbehandling

  deploy-dev:
    runs-on: ubuntu-latest
    needs: [ build, test ]
    environment: "dev-fss:k9saksbehandling"
    concurrency: "dev-fss:k9saksbehandling"
    outputs:
      image: ${{ needs.build.outputs.image }}
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # ratchet:actions/checkout@v3
      - name: Deploy til dev-fss
        uses: nais/deploy/actions/deploy@c73efa8384743a5c14b94d4a4b9c1cf5a260b532 # ratchet:nais/deploy/actions/deploy@v2
        env:
          IMAGE: ${{ needs.build.outputs.image }}
          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
          CLUSTER: dev-fss
          RESOURCE: nais/naiserator.yaml
          VARS: nais/dev-fss.json

  deploy-prod:
    runs-on: ubuntu-latest
    needs: [ build, test ]
    environment: "prod-fss:k9saksbehandling"
    concurrency: "prod-fss:k9saksbehandling"
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # ratchet:actions/checkout@v3
      - name: Deploy til prod-fss
        uses: nais/deploy/actions/deploy@c73efa8384743a5c14b94d4a4b9c1cf5a260b532 # ratchet:nais/deploy/actions/deploy@v2
        env:
          IMAGE: ${{ needs.build.outputs.image }}
          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
          CLUSTER: prod-fss
          RESOURCE: nais/naiserator.yaml
          VARS: nais/prod-fss.json