deploy.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# GitHub recommends pinning actions to a commit SHA.
# To get a newer version, you will need to update the SHA.
# You can also reference a tag or branch, but the action may change without warning.

name: Build, Release and Deploy to GKE

on:
  push:
    branches:
      - master
      - latest
      - develop-*

env:
  PROJECT_ID: ${{ secrets.GKE_PROJECT }}
  GKE_CLUSTER: ${{ vars.GKE_CLUSTER }}    # Add your cluster name here.
  GKE_REGION: ${{ vars.GKE_REGION }}   # Add your cluster zone here.
  DEPLOYMENT_NAME: ${{ secrets.DEPLOYMENT_NAME }} # Add your deployment name here.
  SLACK_NOTIFICACTION_URL: ${{ secrets.SLACK_NOTIFICACTION_URL }}
  SLACK_NOTIFICACTION_CHANNEL: ${{ secrets.SLACK_NOTIFICACTION_CHANNEL }}
  AR_LOCATION: ${{ vars.AR_LOCATION }}
  AR_REPOSITORY: ${{ vars.AR_REPOSITORY }}
  IMAGE_NAME: ${{vars.AR_LOCATION}}-docker.pkg.dev/${{secrets.GKE_PROJECT}}/${{vars.AR_REPOSITORY}}/${{github.ref_name}}

jobs:
  setup-build-publish-deploy:
    name: Setup, Build, Publish, and Deploy
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    environment:
      name: ${{ github.ref_name }}

    steps:
    - uses: actions/checkout@v4

    # fetch Tag from package.json version
    - name: Get Tag from package.json
      id: version
      run: echo "TAG=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT

    # echo Tag
    - name: Echo Tag
      run: echo ${{ steps.version.outputs.TAG }}

    # parse the changelog to get the release description
    - name: Parse Changelog Entries
      uses: actions/github-script@v7
      id: changelog
      with:
        script: |
          const { open } = require('fs/promises');

          const version ='${{ steps.version.outputs.TAG }}';
          const delimiter = '### ';
          const file = await open('./changes.md');

          let description = [];
          let found = false;

          for await (let line of file.readLines()) {
            line = line.trim();
            
            if ( line.startsWith(`${delimiter}${version}`) ) {
              found = true;
              continue;
            }
            
            if (!found) continue;
            if ( line.startsWith(delimiter) )  break;

            description.push(line);
          }

          if ( !description.length ) core.setFailed(`Release ${version} not found in the changelog!`);

          core.setOutput('description', description.join('\n') );

    # Setup gcloud CLI
    - id: 'auth'
      uses: 'google-github-actions/auth@v2'
      with:
        credentials_json: '${{ secrets.GKE_SA_KEY }}'

    # Set up Cloud SDK
    - name: 'Set up Cloud SDK'
      uses: 'google-github-actions/setup-gcloud@v2'
      with:
        project_id: ${{ secrets.GKE_PROJECT }}

    # Configure Docker to use the gcloud command-line tool as a credential
    # helper for authentication
    - run: |-
        gcloud --quiet auth configure-docker $AR_LOCATION-docker.pkg.dev
    # Get the GKE credentials so we can deploy to the cluster
    - uses: google-github-actions/get-gke-credentials@v2
      with:
        cluster_name: ${{ env.GKE_CLUSTER }}
        location: ${{ env.GKE_REGION }}
        project_id: ${{ secrets.GKE_PROJECT }}

    # Build the Docker image
    - name: Build
      run: |-
        docker build \
          --tag "${{env.IMAGE_NAME}}:${{ steps.version.outputs.TAG }}" \
          --build-arg GITHUB_SHA="$GITHUB_SHA" \
          --build-arg GITHUB_REF="$GITHUB_REF" \
          .
          
    # Push the Docker image to Google Container Registry
    - name: Publish
      run: |-
        docker push "${{env.IMAGE_NAME}}:${{ steps.version.outputs.TAG }}"

    # Scan Docker image for vulnerabilities
    - name: Scan Docker Image using Trivy
      if: github.ref_name == 'master'
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: "${{env.IMAGE_NAME}}:${{ steps.version.outputs.TAG }}"
        exit-code: '0'
        timeout: '60m0s'
        format: 'sarif'
        output: 'trivy-results.sarif'

    # Upload Trivy scan results to GitHub Security tab
    - name: Upload Trivy scan results to GitHub Security tab
      if: github.ref_name == 'master'
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'trivy-results.sarif'

    # Generate SPDX SBOM
    - name: Generate SBOM with Anchore Action
      if: github.ref_name == 'master'
      id: sbom
      uses: anchore/sbom-action@v0
      with:
        image: "${{env.IMAGE_NAME}}:${{ steps.version.outputs.TAG }}"
        output-file: sbom.spdx.json
        format: spdx-json

    # Create a release with the version changelog as a description and attach the sbom
    - name: Create GitHub Release
      if: github.ref_name == 'master'
      id: create_github_release
      uses: softprops/action-gh-release@v1
      with:
        name: "Release ${{ steps.version.outputs.TAG }}"
        body: "${{ steps.changelog.outputs.description }}"
        tag_name: ${{ steps.version.outputs.TAG }}
        prerelease: false
        files: |
          ./sbom.spdx.json
    
    # Set up kustomize
    - name: Set up Kustomize
      run: |-
        curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.3.0/kustomize_v5.3.0_linux_amd64.tar.gz
        chmod u+x ./kustomize
    # Deploy secret variables
    - run: |
        sed -i.bak "s|CLUSTER_NAME_VALUE|${{ vars.GKE_CLUSTER }}|g" ci/deployment-v2.yml
        sed -i.bak "s|CLUSTER_ENDPOINT_VALUE|${{ secrets.KUBERNETES_CLUSTER_ENDPOINT }}|g" ci/deployment-v2.yml
        sed -i.bak "s|CLUSTER_NAMESPACE_VALUE|${{ secrets.KUBERNETES_CLUSTER_NAMESPACE }}|g" ci/deployment-v2.yml
        sed -i.bak "s|CLUSTER_USER_TOKEN_VALUE|${{ secrets.KUBERNETES_CLUSTER_USER_TOKEN }}|g" ci/deployment-v2.yml
        sed -i.bak "s|CLUSTER_SERVICEACCOUNT_VALUE|${{ secrets.KUBERNETES_CLUSTER_SERVICEACCOUNT }}|g" ci/deployment-v2.yml
        sed -i.bak "s|CLUSTER_CERTIFICATE_VALUE|${{ secrets.KUBERNETES_CLUSTER_CERTIFICATE }}|g" ci/deployment-v2.yml
        sed -i.bak "s|CLUSTER_USER_SECRET_VALUE|${{ secrets.KUBERNETES_CLUSTER_USER_SECRET }}|g" ci/deployment-v2.yml
        sed -i.bak "s|CLUSTER_CONTEXT_VALUE|${{ secrets.KUBERNETES_CLUSTER_CONTEXT }}|g" ci/deployment-v2.yml
        sed -i.bak "s|ACCESS_TOKEN_VALUE|${{ secrets.ACCESS_TOKEN }}|g" ci/deployment-v2.yml
        sed -i.bak "s|SLACK_NOTIFICACTION_URL_VALUE|${{ secrets.SLACK_NOTIFICACTION_URL }}|g" ci/deployment-v2.yml
        sed -i.bak "s|SLACK_NOTIFICACTION_CHANNEL_VALUE|${{ secrets.SLACK_NOTIFICACTION_CHANNEL }}|g" ci/deployment-v2.yml
        sed -i.bak "s|IMAGE_VERSION|${{ steps.version.outputs.TAG }}|g" ci/deployment-v2.yml
        sed -i.bak "s|GITHUB_ORG|$GITHUB_REPOSITORY_OWNER|g" ci/service.yml
        sed -i.bak "s|GITHUB_ORG|$GITHUB_REPOSITORY_OWNER|g" ci/deployment-v2.yml
        sed -i.bak "s|GITHUB_BRANCH|$GITHUB_REF_NAME|g" ci/service.yml
        sed -i.bak "s|GITHUB_BRANCH|$GITHUB_REF_NAME|g" ci/deployment-v2.yml
        sed -i.bak "s|PROJECT_ID|$PROJECT_ID|g" ci/deployment-v2.yml
        sed -i.bak "s|AR_LOCATION|$AR_LOCATION|g" ci/deployment-v2.yml
    # Deploy the Docker image to the GKE cluster
    - run: |
        kubectl apply -n ${{ secrets.KUBERNETES_CLUSTER_NAMESPACE }} -f ci/service.yml && \
        kubectl apply -n ${{ secrets.KUBERNETES_CLUSTER_NAMESPACE }} -f ci/deployment-v2.yml