deploy.yaml

name: Build and deploy

on:
  push:
    branches-ignore:
      - 'dependabot/**'
    paths-ignore:
      - 'docs/**'

jobs:
  build:
    name: Build and publish Docker image
    runs-on: ubuntu-latest
    permissions: # Sjekk https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
      contents: "write" # For å submitte dependency graph
      checks: "write"
      pull-requests: "write"
      id-token: "write"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
      - uses: gradle/actions/wrapper-validation@v4
      - uses: gradle/actions/setup-gradle@v4
        env:
          # Eksluder test dependencies
          DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: compileClasspath|runtimeClasspath
        with:
          dependency-graph: generate-and-submit
          cache-encryption-key: ${{ secrets.GradleEncryptionKey }}
      - run: ./gradlew --configuration-cache build

      - name: Publish results (unit test)
        uses: EnricoMi/publish-unit-test-result-action@v2
        if: success() || failure()
        with:
          junit_files: "**/build/test-results/test/TEST-*.xml"

      - name: docker-build-push
        uses: nais/docker-build-push@v0
        id: docker-build-push
        with:
          team: teamdagpenger
          tag: ${{ github.sha }}
          dockerfile: mediator/Dockerfile # optional, default Dockerfile
          docker_context: mediator # optional, default .
          identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
          project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
          salsa: false
    outputs:
      image: ${{ steps.docker-build-push.outputs.image }}
      digest: ${{ steps.docker-build-push.outputs.digest }}

  salsa:
    name: Generate SBOM, attest and sign image
    needs: [ build ]
    runs-on: ubuntu-latest
    permissions:
      id-token: "write"
    steps:
      - uses: navikt/dagpenger/actions/attest-sign@master
        with:
          digest: ${{ needs.build.outputs.digest }}
          identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
          project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
          team: teamdagpenger

  deploy-dev:
    name: Deploy to dev
    needs: [ build ]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: dev-gcp
    steps:
      - uses: actions/checkout@v4
      - uses: nais/deploy/actions/deploy@v2
        env:
          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
          CLUSTER: dev-gcp
          RESOURCE: .nais/nais.yaml,.nais/unleash.yaml
          VAR: image=${{ needs.build.outputs.image }},unleashEnvironment=development
          VARS: .nais/vars-dev.yaml
          PRINT_PAYLOAD: true

  deploy-prod:
    name: Deploy to Production
    needs: [ build ]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: prod-gcp
    steps:
      - uses: actions/checkout@v4
      - uses: nais/deploy/actions/deploy@v2
        env:
          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
          CLUSTER: prod-gcp
          RESOURCE: .nais/nais.yaml,.nais/unleash.yaml #,.nais/alerts.yaml
          VARS: .nais/vars-prod.yaml
          VAR: image=${{ needs.build.outputs.image }},unleashEnvironment=production
          PRINT_PAYLOAD: true