build-and-deploy.yml

# This workflow trigger on push to any branch.
name: Build
on:
  push:
    paths-ignore:
      - '**.md'
      - '.gitignore'
      - 'LICENSE'
      - 'CODEOWNERS'
      - 'nais/alerterator.yml'
      - '.github/workflows/apply-alerts.yml'
    branches:

jobs:
  sonar:
    uses: navikt/sif-gha-workflows/.github/workflows/gradle-sonar.yml@main
    permissions:
      contents: read
      pull-requests: read
    secrets: inherit
    with:
      readertoken: false

  test:
    uses: navikt/sif-gha-workflows/.github/workflows/gradle-test.yml@main
    permissions:
      contents: read
    secrets: inherit
    with:
      readertoken: false

  codeql:
    uses: navikt/sif-gha-workflows/.github/workflows/gradle-codeql.yml@main
    permissions:
      actions: read
      contents: read
      pull-requests: read
      security-events: write
    secrets: inherit
    with:
      readertoken: false
      package-command: './gradlew clean build -x test'
      branch: master

  build:
    uses: navikt/sif-gha-workflows/.github/workflows/gradle-build.yml@main
    if: startsWith(github.ref, 'refs/heads/dev-') || startsWith(github.ref, 'refs/heads/master') || github.event.deployment.payload.triggered # Build and push docker if branch is either master or dev-*
    permissions:
      contents: write
      id-token: write
    secrets: inherit
    with:
      team: dusseldorf
      readertoken: false

  trivy:
    needs: [ build ]
    if: startsWith(github.ref, 'refs/heads/dev-') || startsWith(github.ref, 'refs/heads/master') || github.event.deployment.payload.triggered # Build and push docker if branch is either master or dev-*
    uses: navikt/sif-gha-workflows/.github/workflows/trivy.yml@main
    permissions:
      contents: write
      security-events: write
      id-token: write
      actions: read
    secrets: inherit
    with:
      image: ${{ needs.build.outputs.image }}
      team: dusseldorf

  deploy:
    needs: [ test, build ]
    if: startsWith(github.ref, 'refs/heads/dev-') || startsWith(github.ref, 'refs/heads/master') # Deploy if branch is either master or dev-*
    uses: navikt/sif-gha-workflows/.github/workflows/gradle-deploy.yml@main
    permissions:
      contents: read
      id-token: write
    secrets: inherit
    with:
      image: ${{ needs.build.outputs.image }}
      environment: gcp
      deploy-prod: ${{ startsWith(github.ref, 'refs/heads/master')}}