google-registry-prod.yaml

# This workflow build and push a Docker container to Google Artifact Registry and deploy it on Google Kubernetes Engine when a commit is pushed to the "develop" branch
# You can start your commit with `#update` and the workflow will just trigger an update of the Helm installation, without building a new image
#
# To configure this workflow:
#
# 1. Ensure the required Google Cloud APIs are enabled in the project:
#
#    Cloud Build              cloudbuild.googleapis.com
#    Kubernetes Engine API    container.googleapis.com
#    Artifact Registry        artifactregistry.googleapis.com
#
# 2. Create a service account (if you don't have one) with the following fields:
#
#    Service Account Name     <PROJECT-NAME>-github-actions
#    Service Account ID       <PROJECT-NAME>-github-actions
#
# 3. Ensure the service account have the required IAM permissions granted:
#
#    Kubernetes Engine Developer
#      roles/container.developer         (kubernetes engine developer)
#
#    Artifact Registry
#      roles/artifactregistry.repoAdmin  (artifact registry repository administrator)
#      roles/artifactregistry.admin      (artifact registry administrator)
#
#    Service Account
#      roles/iam.serviceAccountUser      (act as the Cloud Run runtime service account)
#
#    Basic Roles
#      roles/viewer                      (viewer)
#
#    NOTE: You should always follow the principle of least privilege when assigning IAM roles
#
# 4. Ensure you have the following GitHub Secrets and Variables:
#
#    GitHub Secrets
#      GCP_SA_KEY                        (Google Cloud Project Service Account Key) ref visit https://github.com/Datawheel/company/wiki/Setting-Up-a-Service-Account-for-Workflows#use-the-service-account-on-github-secrets
#
#    GitHub Variables
#      GCP_PROJECT_ID                    (Google Cloud Project ID)
#      GCP_ARTIFACT_REGISTRY_NAME        (Google Cloud Articaft Registry Repository Name)
#      GCP_ARTIFACT_REGISTRY_LOCATION    (Google Cloud Artifact Registry Reposotiry Location)
#
# 5. Ensure you have the following GitHub Variables for each environment that you will set up:
#
#    GitHub Variables
#      GCP_IMAGE_NAME                    (Docker Image Name)
#      GKE_APP_NAME                      (Google Kubernetes Engine Deployment Name)
#      GKE_APP_NAMESPACE                 (Google Kubernetes Engine Deployment Namespace)
#      GKE_CLUSTER                       (Google Kubernetes Engine Cluster Name)
#      GKE_ZONE                          (Google Kubernetes Engine Cluster Zone)
#
# Further reading:
#    Kubernetes Developer                      - https://cloud.google.com/iam/docs/understanding-roles#container.developer
#    Artifact Registry IAM permissions         - https://cloud.google.com/artifact-registry/docs/access-control#roles
#    Container Registry vs Artifact Registry   - https://cloud.google.com/blog/products/application-development/understanding-artifact-registry-vs-container-registry
#    Principle of least privilege              - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege
#    Deploy CloudRun Github Actions            - https://github.com/google-github-actions/deploy-cloudrun
name: "[GCP][PROD] Build API to Google Registry"

on:
  push:
    branches: [ "main" ]
    paths:
      - schema/**

env:
  GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
  GCP_ARTIFACT_REGISTRY_NAME: ${{ vars.GCP_ARTIFACT_REGISTRY_NAME }}
  GCP_ARTIFACT_REGISTRY_LOCATION: ${{ vars.GCP_ARTIFACT_REGISTRY_LOCATION }}
  GCP_IMAGE_NAME: ${{ vars.GCP_IMAGE_NAME }}
  GKE_APP_NAME: ${{ vars.GKE_APP_NAME }}
  GKE_APP_NAMESPACE: ${{ vars.GKE_APP_NAMESPACE }}
  GKE_CLUSTER: ${{ vars.GKE_CLUSTER }}
  GKE_ZONE: ${{ vars.GKE_ZONE }}
  ACTIONS_ALLOW_UNSECURE_COMMANDS: true

jobs:
  build:
    environment: production
    runs-on: ubuntu-latest
    # runs-on: self-hosted
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      # Authentication via credentials json
      - name: Google Auth
        id: auth
        uses: google-github-actions/auth@v2
        with:
          project_id: ${{ env.GCP_PROJECT_ID }}
          credentials_json: ${{ secrets.GCP_SA_KEY }}
      
      # Install Cloud SDK
      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v1
        with:
          install_components: beta

      # Build image on Google Cloud Artifact Registry
      - name: Build Docker Image
        run: |-
          gcloud builds submit \
            --quiet \
            --timeout=40m \
            --config=cloudbuild.yml \
            --substitutions=_GCP_PROJECT_ID=${{ env.GCP_PROJECT_ID }},_GCP_ARTIFACT_REGISTRY_NAME=${{ env.GCP_ARTIFACT_REGISTRY_NAME }},_GCP_ARTIFACT_REGISTRY_LOCATION=${{ env.GCP_ARTIFACT_REGISTRY_LOCATION }},_GCP_IMAGE_NAME=${{ env.GCP_IMAGE_NAME }},_GCP_IMAGE_TAG=${{ github.sha }},_GCP_IMAGE_ENVIRONMENT=${{ env.GKE_APP_NAMESPACE }}