deploy.yaml

name: Deploy

on:
  repository_dispatch:
    types:
      - HelmRelease/mirror.*

permissions:
  contents: write
  pull-requests: write

defaults:
  run:
    shell: bash

env:
  LC_ALL: C.UTF-8

jobs:
  deploy:
    name: Deploy
    runs-on: mirror-node-linux-medium
    if: github.event.client_payload.severity == 'info'
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: deploy
          token: ${{ secrets.HEDERA_BOT_TOKEN }}

      - name: Install yq
        env:
          BINARY: yq_linux_amd64
          TARGET: /home/runner/.local/bin
          VERSION: v4.44.2
        run: |
          mkdir -p "${TARGET}"
          cd "${TARGET}"
          curl -sL https://github.com/mikefarah/yq/releases/download/${VERSION}/${BINARY}.tar.gz --output - | tar -xvz
          mv ${BINARY} yq

      - name: Get chart version
        id: release
        run: |
          VERSION=$(echo ${{ github.event.client_payload.metadata.revision }} | cut -d '+' -f1)
          echo VERSION=${VERSION} >> $GITHUB_OUTPUT

      - name: Set chart version in HelmRelease
        env:
          CHART_VERSION: ${{ steps.release.outputs.version }}
          CLUSTER: ${{ github.event.client_payload.metadata.cluster }}
          NAMESPACES: ${{ github.event.client_payload.metadata.namespaces }}
        run: |
          for namespace in $(echo "${NAMESPACES}" | tr "," "\n"); do
            yq eval '.spec.chart.spec.version=env(CHART_VERSION)' -i "./clusters/${CLUSTER}/${namespace}/helmrelease.yaml"
          done

      - name: Import GPG Key
        id: gpg_importer
        uses: step-security/ghaction-import-gpg@6c8fe4d0126a59d57c21f87c9ae5dd3451fa3cca # v6.1.0
        with:
          git_commit_gpgsign: true
          git_tag_gpgsign: true
          git_user_signingkey: true
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Open deployment PR
        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
        with:
          author: ${{ steps.gpg_importer.outputs.name }} <${{ steps.gpg_importer.outputs.email }}>
          body: Deploy v${{ steps.release.outputs.version }} to ${{ github.event.client_payload.metadata.namespaces }} in ${{ github.event.client_payload.metadata.cluster }}
          branch: deploy-${{ github.event.client_payload.metadata.cluster }}-${{ steps.release.outputs.version }}
          commit-message: Deploy v${{ steps.release.outputs.version }} to ${{ github.event.client_payload.metadata.namespaces }} in ${{ github.event.client_payload.metadata.cluster }}
          committer: ${{ steps.gpg_importer.outputs.name }} <${{ steps.gpg_importer.outputs.email }}>
          delete-branch: true
          signoff: true
          title: Deploy v${{ steps.release.outputs.version }} to ${{ github.event.client_payload.metadata.cluster }}
          token: ${{ secrets.HEDERA_BOT_TOKEN }}