release.yml

name: Release

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*.*.*'
    branches: [master]
    paths-ignore:
      - '**.md'

jobs:
  build-api-docker-image:
    name: Build API docker image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Packages Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get tag
        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Get sha
        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=master-$(echo $GITHUB_SHA | cut -c 1-6)" >> $GITHUB_ENV

      - name: Build and push
        uses: docker/build-push-action@v6
        env:
          NODE_ENV: production
        with:
          push: true
          target: production
          build-args: |
            APP_VERSION=${{ env.VERSION }}
          tags: |
            ghcr.io/podkrepi-bg/api:master
            ghcr.io/podkrepi-bg/api:${{ env.VERSION }}

      - name: Scan with Mondoo
        uses: mondoohq/actions/docker-image@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          image: ghcr.io/podkrepi-bg/api:${{ env.VERSION }}

  build-migrations-docker-image:
    name: Build migrations docker image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Packages Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get tag
        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Get sha
        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=master-$(echo $GITHUB_SHA | cut -c 1-6)" >> $GITHUB_ENV

      - name: Build and push
        uses: docker/build-push-action@v6
        env:
          NODE_ENV: production
        with:
          push: true
          file: Dockerfile.migrations
          target: base
          build-args: |
            APP_VERSION=${{ env.VERSION }}
          tags: |
            ghcr.io/podkrepi-bg/api/migrations:master
            ghcr.io/podkrepi-bg/api/migrations:${{ env.VERSION }}

      - name: Scan with Mondoo
        uses: mondoohq/actions/docker-image@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          image: ghcr.io/podkrepi-bg/api/migrations:${{ env.VERSION }}

  build-seed-docker-image:
    name: Build seed docker image
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Packages Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get tag
        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Get sha
        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=master-$(echo $GITHUB_SHA | cut -c 1-6)" >> $GITHUB_ENV

      - name: Build and push
        uses: docker/build-push-action@v6
        env:
          NODE_ENV: production
        with:
          push: true
          file: Dockerfile.migrations
          target: seed
          tags: |
            ghcr.io/podkrepi-bg/api/seed:master
            ghcr.io/podkrepi-bg/api/seed:${{ env.VERSION }}

  scan-manifests:
    name: Scan k8s manifests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install kustomize
        uses: imranismail/setup-kustomize@v2

      - name: Build development manifests
        run: kustomize build manifests/overlays/development > dev-manifests.yaml

      - name: Scan development manifests with Mondoo
        uses: mondoohq/actions/k8s-manifest@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          path: dev-manifests.yaml

      - name: Build production manifests
        run: kustomize build manifests/overlays/production > prod-manifests.yaml

      - name: Scan production manifests with Mondoo
        uses: mondoohq/actions/k8s-manifest@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          path: prod-manifests.yaml

  release-dev:
    name: Release to dev
    runs-on: ubuntu-latest
    needs: [build-api-docker-image, build-migrations-docker-image]
    environment:
      name: dev
      url: https://dev.podkrepi.bg/swagger
    steps:
      - uses: actions/checkout@v4

      - name: Install kubectl
        uses: azure/setup-kubectl@v4

      - name: Install kustomize
        uses: imranismail/setup-kustomize@v2

      - name: Get tag
        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Get sha
        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=master-$(echo $GITHUB_SHA | cut -c 1-6)" >> $GITHUB_ENV

      - name: Set container versions in manifests
        working-directory: manifests/overlays/development
        run: |
          kustomize edit set image ghcr.io/podkrepi-bg/api=ghcr.io/podkrepi-bg/api:$VERSION
          kustomize edit set image ghcr.io/podkrepi-bg/api/migrations=ghcr.io/podkrepi-bg/api/migrations:$VERSION
          kustomize edit set annotation app.komodor.com/app.ref:$GITHUB_SHA

      - name: Set kubeconfig
        run: echo ${{ secrets.K8S_DEV_CONFIG }} | base64 -d > config.yaml

      - name: Apply new manifests
        run: kubectl apply -k manifests/overlays/development --kubeconfig config.yaml

      - name: Wait until deployment is ready
        run: kubectl wait --for=condition=Available=True deployment/api-headless --timeout=180s -n podkrepibg-dev --kubeconfig config.yaml

      - name: Delete kubeconfig
        if: always()
        run: rm config.yaml

  release-gh:
    name: Github release
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    needs: [release-dev]
    permissions:
      contents: write
    steps:
      - name: Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true

  release-prod:
    name: Release to prod
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    needs: [release-gh]
    environment:
      name: prod
      url: https://podkrepi.bg/swagger
    steps:
      - uses: actions/checkout@v4

      - name: Install kubectl
        uses: azure/setup-kubectl@v4

      - name: Install kustomize
        uses: imranismail/setup-kustomize@v2

      - name: Get tag
        run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Set container versions in manifests
        working-directory: manifests/overlays/production
        run: |
          kustomize edit set image ghcr.io/podkrepi-bg/api=ghcr.io/podkrepi-bg/api:$VERSION
          kustomize edit set image ghcr.io/podkrepi-bg/api/migrations=ghcr.io/podkrepi-bg/api/migrations:$VERSION
          kustomize edit set annotation app.komodor.com/app.ref:$GITHUB_SHA

      - name: Set kubeconfig
        run: echo ${{ secrets.K8S_CONFIG }} | base64 -d > config.yaml

      - name: Apply new manifests
        run: kubectl apply -k manifests/overlays/production --kubeconfig config.yaml

      - name: Wait until deployment is ready
        run: kubectl wait --for=condition=Available=True deployment/api-headless --timeout=180s -n podkrepibg --kubeconfig config.yaml

      - uses: sarisia/actions-status-discord@v1
        if: always()
        with:
          webhook: ${{ secrets.DISCORD_WEBHOOK }}
          title: 'deploy'
          url: https://podkrepi.bg/swagger
          description: Version ${{ env.VERSION }} of the API is deployed. The list of changes can be found at https://github.com/podkrepi-bg/api/releases/tag/${{ env.VERSION }}
          color: 0x26A641

      - name: Delete kubeconfig
        if: always()
        run: rm config.yaml