main.yaml

name: Build and push image and chart
on:
  push:
    branches:
      - main
env:
  NAME: nais-api-reconcilers
  IMAGE_REPOSITORY: oci://europe-north1-docker.pkg.dev/nais-io/nais
jobs:
  build_push:
    outputs:
      version: ${{ steps.build-push-sign.outputs.version }}
      chart_version: ${{ steps.package_chart.outputs.version }}
    permissions:
      contents: read
      id-token: write
    name: Build and push
    runs-on: ubuntu-latest-16-cores
    steps:
      - uses: actions/checkout@v4
      - uses: asdf-vm/actions/setup@v3
      - id: asdf-cache
        uses: actions/cache@v4
        with:
          path: ~/.asdf/
          key: ${{ runner.os }}-asdf-${{ hashFiles('**/.tool-versions') }}
      - uses: asdf-vm/actions/install@v3
        if: steps.asdf-cache.outputs.cache-hit != 'true'
        with:
          before_install: |
            asdf install golang latest
            asdf global golang latest
      - name: Find go cache dir
        id: go-cache
        run: |
          go version
          # Clear cache dirs to avoid error when restoring
          go clean -cache -modcache
          echo "gocache=$(go env GOCACHE)" >> $GITHUB_OUTPUT
          echo "gomodcache=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
      - name: Cache go modules
        uses: actions/cache@v4
        with:
          path: |
            ${{ steps.go-cache.outputs.gocache }}
            ${{ steps.go-cache.outputs.gomodcache }}
          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
      - run: go test ./...
      - run: helm lint --strict ./charts
      - run: make staticcheck
      - run: make vulncheck
      - name: Check code format and run code generators
        run: |
          make fmt
          make generate
          git diff --exit-code --name-only
      - id: go_version
        run: echo "go_version=$(asdf current golang | awk '{print $2}')" >> $GITHUB_OUTPUT
      - uses: nais/platform-build-push-sign@main
        id: build-push-sign
        with:
          name: ${{ env.NAME }}
          build_args: |
            GO_VERSION=${{ steps.go_version.outputs.go_version }}-
          google_service_account: gh-api-reconcilers
          workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
          push: true
      - name: Package chart
        id: package_chart
        env:
          CHART_PATH: ./charts
        run: |
          base_version="$(yq '.version' < "${{ env.CHART_PATH }}/Chart.yaml")"
          chart_version="${base_version}-${{ steps.build-push-sign.outputs.version }}"

          yq eval \
            '.version="'"$chart_version"'"' \
            "${{ env.CHART_PATH }}/Chart.yaml" --inplace
          yq eval \
            '.image.tag="${{ steps.build-push-sign.outputs.version }}"' \
            "${{ env.CHART_PATH }}/values.yaml" --inplace

          helm package "${{ env.CHART_PATH }}" --destination .

          name=$(yq '.name' < "${{ env.CHART_PATH }}/Chart.yaml")
          echo "name=$name" >> $GITHUB_OUTPUT
          echo "version=$chart_version" >> $GITHUB_OUTPUT
          echo "archive=$name-$chart_version.tgz" >> $GITHUB_OUTPUT
      - name: Push Chart
        if: github.ref == 'refs/heads/main'
        run: |-
          chart="${{ steps.package_chart.outputs.archive }}"
          echo "Pushing: $chart"
          helm push "$chart" ${{ env.IMAGE_REPOSITORY }}
  rollout:
    runs-on: fasit-deploy
    permissions:
      id-token: write
    needs:
      - build_push
    steps:
      - uses: nais/fasit-deploy@v2
        if: github.ref == 'refs/heads/main'
        with:
          chart: ${{ env.IMAGE_REPOSITORY }}/${{ env.NAME }}
          version: ${{ needs.build_push.outputs.chart_version }}