build-content.yml

name: buildContentImage
on:
  workflow_dispatch:

env:
  REGISTRY: ghcr.io

jobs:
  get-content-file:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/cached-checkout-install
      - run: npm run dumpCmsToFile
        env:
          STRAPI_API: "${{ secrets.STRAPI_API }}"
          STRAPI_ACCESS_KEY: "${{ secrets.STRAPI_ACCESS_KEY }}"
      - run: npm run verifyEmails
      - run: npm run verifyWebsites
      - name: Calculate content checksum
        id: checksum
        run: echo "content_checksum=$(./docker.sh --contentHash)" >> $GITHUB_OUTPUT
      - name: Upload content.json
        uses: actions/upload-artifact@v4
        with:
          name: content-file
          path: content.json
    outputs:
      content_checksum: ${{ steps.checksum.outputs.content_checksum }}

  verify-local-e2e:
    needs: [get-content-file]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/cached-checkout-install
      - name: Get Playwright version
        run: echo "PLAYWRIGHT_VERSION=$(node -e "console.log(require('./package-lock.json').packages[''].devDependencies['@playwright/test'])")" >> $GITHUB_ENV

      - name: Download Content File
        uses: actions/download-artifact@v4
        with:
          name: content-file

      - name: Cache Playwright browsers
        uses: actions/cache@v4
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ env.PLAYWRIGHT_VERSION }}

      - name: Install Playwright browsers
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: npx playwright install --with-deps chromium

      - id: fetchLatestImageApp
        run: ./docker.sh --appFromImage && rsync -a ./a2j-app/* ./

      - name: Run Playwright e2e tests
        env:
          GERICHTSFINDER_ENCRYPTION_KEY: "${{ secrets.GERICHTSFINDER_ENCRYPTION_KEY }}"
        run: CMS=FILE npx playwright test

      - name: Upload Playwright test results
        uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 30

  build-push-content-image:
    runs-on: ubuntu-latest
    needs: [verify-local-e2e]
    steps:
      - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/checkout@v4
      - name: Download Content File
        uses: actions/download-artifact@v4
        with:
          name: content-file
      - run: ./docker.sh --build content
      - run: ./docker.sh --push content
      - run: ./docker.sh --build prod
      - run: ./docker.sh --push prod
      - id: prod_image_tag
        run: echo "prod_image_tag=$(./docker.sh --prodImageTag)" >> $GITHUB_OUTPUT
    outputs:
      prod_image_tag: ${{ steps.prod_image_tag.outputs.prod_image_tag }}

  deploy-preview:
    needs: [build-push-content-image, get-content-file]
    runs-on: ubuntu-latest
    environment: preview
    steps:
      - name: Report Deployment
        uses: digitalservicebund/github-actions/track-deployment@34a48d29a9c4cc2fd6710b8eb37e13618a08fa88
        with:
          project: a2j-rechtsantragstelle
          environment: preview
          metrics_deployment_webhook_url: ${{ secrets.METRICS_DEPLOYMENT_WEBHOOK_URL }}
          metrics_webhook_token: ${{ secrets.METRICS_WEBHOOK_TOKEN }}

      - name: Deploy new preview image
        uses: digitalservicebund/github-actions/argocd-deploy@a223a68bc5982e5175beb73c708d99d8f9ba7858
        with:
          environment: preview
          version: ${{ needs.build-push-content-image.outputs.prod_image_tag }}
          deploying_repo: a2j-rechtsantragstelle
          infra_repo: a2j-rechtsantragstelle-infra
          deploy_key: ${{ secrets.DEPLOY_KEY }}
          app: a2j-rast-preview
          argocd_pipeline_password: ${{ secrets.ARGOCD_PIPELINE_PASSWORD }}
          argocd_server: ${{ secrets.ARGOCD_SERVER }}
          argocd_sync_timeout: 300

  verify-preview-e2e:
    needs: [deploy-preview]
    uses: ./.github/workflows/e2e-test.yml
    secrets:
      BASE_URL: https://a2j-test.dev.ds4g.net
    with:
      use-existing-server: true
      e2e-target: preview

  deploy-production:
    needs: [verify-preview-e2e, build-push-content-image]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Report Deployment
        uses: digitalservicebund/github-actions/track-deployment@34a48d29a9c4cc2fd6710b8eb37e13618a08fa88
        with:
          project: a2j-rechtsantragstelle
          environment: production
          metrics_deployment_webhook_url: ${{ secrets.METRICS_DEPLOYMENT_WEBHOOK_URL }}
          metrics_webhook_token: ${{ secrets.METRICS_WEBHOOK_TOKEN }}

      - name: Deploy new production image
        uses: digitalservicebund/github-actions/argocd-deploy@a223a68bc5982e5175beb73c708d99d8f9ba7858
        with:
          environment: production
          version: ${{ needs.build-push-content-image.outputs.prod_image_tag }}
          deploying_repo: a2j-rechtsantragstelle
          infra_repo: a2j-rechtsantragstelle-infra
          deploy_key: ${{ secrets.DEPLOY_KEY }}
          app: a2j-rast-production
          argocd_pipeline_password: ${{ secrets.ARGOCD_PIPELINE_PASSWORD }}
          argocd_server: ${{ secrets.ARGOCD_SERVER }}
          argocd_sync_timeout: 300

  test-production-text:
    needs: [deploy-production]
    permissions:
      packages: read
    runs-on: ubuntu-latest
    steps:
      - run: curl -s "https://service.justiz.de" | grep -q "Justiz-Services"