deploy-app.yml

name: deploy-app

on:
  workflow_call:
    inputs:
      env:
        required: true
        type: string
      GCP_PROJECT_ID:
        required: true
        type: string
      GCP_WORKLOAD_IDENTITY_PROVIDER:
        required: true
        type: string
      GCP_SERVICE_ACCOUNT:
        required: true
        type: string
      APP_ID_GITHUB:
        required: true
        type: string
      PR_AUTHOR:
        required: true
        type: string
      PROJECT_NUMBER:
        required: true
        type: string
      COLUMN_NAME:
        required: true
        type: string
      webhook_path:
        required: true
        type: string

    secrets:
      gcp_webhook_secret:
        required: true
      gcp_app_key:
        required: true

jobs:
    deploy:
        name: Setup Gcloud Account
        permissions:
          id-token: write
          contents: read
        runs-on: ubuntu-latest
        env:
          gcp_service_region: us-central1

        steps:
        - name: Deploy New App Version
          uses: actions/checkout@v4
          with:
            ref: ${{ github.head_ref }}

        - name: 'Authenticate with GCP'
          uses: google-github-actions/auth@v2
          with:
            workload_identity_provider: ${{ inputs.GCP_WORKLOAD_IDENTITY_PROVIDER }}
            service_account: ${{ inputs.GCP_SERVICE_ACCOUNT }}

        - name: 'Set up Cloud SDK'
          uses: google-github-actions/setup-gcloud@v2
          with:
            project_id: ${{ inputs.GCP_PROJECT_ID }}

        - name: Update secrets in GCP Secret Manager
          uses: nearform-actions/github-action-gcp-secrets@v1
          with:
            secrets: |-
              unbreak_${{ inputs.env }}_webhook_secret:"${{ secrets.GCP_WEBHOOK_SECRET }}"
              unbreak_${{ inputs.env }}_app_key:"${{ secrets.GCP_APP_KEY }}"

        - name: 'Deploy webhook to Cloud Run'
          id: deploy-webhook
          run: >-
            gcloud functions deploy ${{ inputs.webhook_path }}
            --runtime=nodejs20
            --source=.
            --entry-point=webhook
            --set-secrets=APP_KEY=projects/${{ inputs.GCP_PROJECT_ID }}/secrets/unbreak_${{ inputs.env }}_app_key:latest
            --set-secrets=WEBHOOK_SECRET=projects/${{ inputs.GCP_PROJECT_ID }}/secrets/unbreak_${{ inputs.env }}_webhook_secret:latest
            --set-env-vars=APP_ID="${{ inputs.APP_ID_GITHUB  }}"
            --set-env-vars=PR_AUTHOR="${{ inputs.PR_AUTHOR }}"
            --set-env-vars=PROJECT_NUMBER="${{ inputs.PROJECT_NUMBER }}"
            --set-env-vars=COLUMN_NAME="${{ inputs.COLUMN_NAME }}"
            --set-env-vars=LOG_LEVEL=info
            --trigger-http
            --allow-unauthenticated
            --region=us-central1
            --gen2