deploy-to-nais.yml

name: Deploy to NAIS

on:
  workflow_dispatch:
    inputs:
      registry:
        description: Registry, for example "europe-north1-docker.pkg.dev"
        required: true
        type: string
      repository:
        description: Registry repository
        required: true
        type: string
      image-name:
        description: Image name
        required: true
        type: string
      image-tag:
        description: Tag for the image
        required: true
        type: string
      cluster:
        description: NAIS cluster environment
        required: true
        type: string
      nais-config-path:
        description: Path to the NAIS configuration file
        required: true
        type: string
      ref:
        description: "Commit reference of the deployment"
        required: false
        default: master
        type: string

  workflow_call:
    inputs:
      registry:
        description: Registry, for example "europe-north1-docker.pkg.dev"
        required: true
        type: string
      repository:
        description: Registry repository
        required: true
        type: string
      image-name:
        description: Image name
        required: true
        type: string
      image-tag:
        description: Tag for the image
        required: true
        type: string
      cluster:
        description: NAIS cluster environment
        required: true
        type: string
      nais-config-path:
        description: Path to the NAIS configuration file
        required: true
        type: string
      ref:
        description: "Commit reference of the deployment"
        required: false
        default: master
        type: string
    secrets:
      registry-project:
        description: Artifact Registry project

jobs:
  deploy:
    name: Deploy to NAIS cluster
    runs-on: ubuntu-latest
    permissions:
      contents: "read"
      id-token: "write"
    steps:
      - uses: actions/checkout@v4

      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ secrets.DAPLA_BOT_APP_ID }}
          private-key: ${{ secrets.DAPLA_BOT_PRIVATE_KEY }}
          owner: statisticsnorway
          repositories: maskinporten-guardian, dapla-stat-iac

      - uses: actions/checkout@v4
        name: Retrieve protected configuration
        with:
          repository: "statisticsnorway/dapla-stat-iac"
          path: "ext-config"
          token: ${{ steps.app-token.outputs.token }}
          sparse-checkout: |
            apps/nais/maskinporten-guardian/${{ inputs.cluster }}

      - name: Set app_config environment variable
        run: |
          ext_config_dir="ext-config/apps/nais/maskinporten-guardian/${{ inputs.cluster }}"
          ls -la ${ext_config_dir}
          tree -L 6 ext-config
          echo ${ext_config_dir}
          ls -la ${ext_config_dir}
          cat ${ext_config_dir}/maskinporten-clients.yml
          echo "ext_config=${ext_config_dir}" >> $GITHUB_ENV

      - uses: nais/deploy/actions/deploy@v2
        env:
          CLUSTER: ${{ inputs.cluster }}
          RESOURCE: ${{ inputs.nais-config-path }},${{ env.ext_config }}/maskinporten-clients.yml
          VAR: image=${{ inputs.registry }}/${{ secrets.NAIS_MANAGEMENT_PROJECT_ID }}/${{ inputs.repository }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
          DEPLOY_SERVER: deploy.ssb.cloud.nais.io:443
          REF: ${{ inputs.ref }}