deploy-step.yml

on:
  workflow_call:
    inputs:
      CREATE_REVIEW_PATH:
        required: true
        type: string
      environment:
        required: true
        type: string
      GCP_PROJECT_ID:
        required: true
        type: string
      GCP_WORKLOAD_IDENTITY_PROVIDER:
        required: true
        type: string
      GCP_SERVICE_ACCOUNT:
        required: true
        type: string
      GH_APP_ID:
        required: true
        type: string
      SUBSCRIPTION_NAME:
        required: true
        type: string
      TOPIC_NAME:
        required: true
        type: string
      WEBHOOK_PATH:
        required: true
        type: string
    secrets:
      GH_PRIVATE_KEY:
        required: true
      GH_WEBHOOK_SECRET:
        required: true
      CHAT_GPT_API_KEY:
        required: true

jobs:
  provision:
    name: 'Provision and deploy'
    runs-on: ubuntu-latest

    permissions:
      contents: 'read'
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: 'Authenticate with GCP'
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ inputs.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ inputs.GCP_SERVICE_ACCOUNT }}

      - name: 'Set up Cloud SDK'
        uses: google-github-actions/setup-gcloud@v2
        with:
          project_id: ${{ inputs.GCP_PROJECT_ID }}

      - name: Update secrets in GCP Secret Manager
        uses: nearform-actions/github-action-gcp-secrets@v1
        with:
          secrets: |-
            gh-private-key-${{ inputs.environment }}:"${{ secrets.GH_PRIVATE_KEY }}"
            gh-webhook-secret-${{ inputs.environment }}:"${{ secrets.GH_WEBHOOK_SECRET }}"
            chat-gpt-api-key-${{ inputs.environment }}:"${{ secrets.CHAT_GPT_API_KEY }}"

      - name: 'Deploy webhook to Cloud Run'
        id: deploy-webhook
        run: >-
          gcloud functions deploy ${{ inputs.WEBHOOK_PATH }}
          --runtime=nodejs20
          --source=.
          --entry-point=webhook
          --set-secrets=PRIVATE_KEY=projects/${{ inputs.GCP_PROJECT_ID }}/secrets/gh-private-key-${{ inputs.environment }}:latest
          --set-secrets=WEBHOOK_SECRET=projects/${{ inputs.GCP_PROJECT_ID }}/secrets/gh-webhook-secret-${{ inputs.environment }}:latest
          --set-env-vars=APP_ID="${{ inputs.GH_APP_ID }}"
          --set-env-vars=PROJECT_ID="${{ inputs.GCP_PROJECT_ID }}"
          --set-env-vars=TOPIC_NAME="${{ inputs.TOPIC_NAME }}"
          --trigger-http
          --allow-unauthenticated
          --region=us-central1
          --gen2

      - name: 'Deploy createReview to Cloud Run'
        id: deploy-createReview
        run: >-
          gcloud functions deploy ${{ inputs.CREATE_REVIEW_PATH }}
          --runtime=nodejs20
          --source=.
          --entry-point=createReview
          --set-secrets=PRIVATE_KEY=projects/${{ inputs.GCP_PROJECT_ID }}/secrets/gh-private-key-${{ inputs.environment }}:latest
          --set-secrets=CHAT_GPT_API_KEY=projects/${{ inputs.GCP_PROJECT_ID }}/secrets/chat-gpt-api-key-${{ inputs.environment }}:latest
          --set-env-vars=APP_ID="${{ inputs.GH_APP_ID }}"
          --set-env-vars=SUBSCRIPTION_NAME="${{ inputs.SUBSCRIPTION_NAME }}"
          --trigger-topic="${{ inputs.TOPIC_NAME }}"
          --allow-unauthenticated
          --region=us-central1
          --gen2

      - name: 'Show summary'
        run: >-
          echo "App successfully deployed."