deploy-staging.yml

name: Deploy Staging

on:
  push:
    branches: [ main ]
    paths-ignore:
      - 'doc/**'
      - 'README.md'

permissions:
  contents: read
  pull-requests: write

jobs:
  deploy:
    name: Deploy to staging
    runs-on: ubuntu-24.04
    environment: staging
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      # - uses: ./.github/actions/setup-languages

      # - name: Restore asset cache
      #   uses: actions/cache/restore@v4
      #   with:
      #     key: cache-staging-assets
      #     path: public/assets

      - name: Terraform apply
        uses: dflook/terraform-apply@v1
        env:
          TF_VAR_cf_user: ${{ secrets.CF_USERNAME }}
          TF_VAR_cf_password: ${{ secrets.CF_PASSWORD }}
          TF_VAR_rails_master_key: ${{ secrets.RAILS_MASTER_KEY }}
          TERRAFORM_PRE_RUN: |
            apt-get update
            apt-get install -y zip
        with:
          path: terraform
          var_file: terraform/staging.tfvars
          backend_config: >
            access_key=${{ secrets.TERRAFORM_STATE_ACCESS_KEY }}
            secret_key=${{ secrets.TERRAFORM_STATE_SECRET_ACCESS_KEY }}
            bucket=${{ secrets.TERRAFORM_STATE_BUCKET_NAME }}
            key=terraform.tfstate.staging

      - name: Set restricted egress
        uses: cloud-gov/cg-cli-tools@main
        with:
          cf_username: ${{ secrets.CF_USERNAME }}
          cf_password: ${{ secrets.CF_PASSWORD }}
          cf_org: gsa-tts-devtools-prototyping
          cf_space: capoc-stage
          cf_command: bind-security-group trusted_local_networks_egress $INPUT_CF_ORG --space $INPUT_CF_SPACE
      - name: Set public egress
        uses: cloud-gov/cg-cli-tools@main
        with:
          cf_username: ${{ secrets.CF_USERNAME }}
          cf_password: ${{ secrets.CF_PASSWORD }}
          cf_org: gsa-tts-devtools-prototyping
          cf_space: capoc-stage-egress
          cf_command: bind-security-group public_networks_egress $INPUT_CF_ORG --space $INPUT_CF_SPACE