main.yml

name: app-engine

env:
  GCLOUD_PROJECT_ID: kvaapagarrot
  NODE_ENV: production

on:
  push:
    branches:
      - main-kampf
  pull_request:
    branches:
      - main-kampf
    types: [opened, synchronize, reopened]

jobs:

  cancel-previous:
    name: Cancel Previous Jobs
    # Skip workflow entirely for [skip ci] commits
    if: |
      false == contains(github.event.commits[0].message, '[skip ci]') &&
      false == contains(github.event.commits[0].message, '[no ci]')
    runs-on: ubuntu-latest
    steps:
      - name: Cancel Previous Runs
        uses: styfle/cancel-workflow-action@0.9.1

  lint:
    name: Lint Code
    # Skip workflow entirely for [skip ci] commits
    if: |
      false == contains(github.event.commits[0].message, '[skip ci]') &&
      false == contains(github.event.commits[0].message, '[no ci]')
    runs-on: ubuntu-latest
    # Map a step output to a job output
    outputs:
      yarn-cache-dir: ${{ steps.yarn-cache-dir.outputs.dir }}

    steps:
      - name: Checkout
        uses: actions/checkout@v2

      # Preferable to use the same version as in GAE environment
      - name: Set Node.js version
        uses: actions/setup-node@v2
        with:
          node-version: '14.17.6'

      - name: Get yarn cache directory path
        id: yarn-cache-dir
        run: echo "::set-output name=dir::$(yarn cache dir)"

      - name: Cache yarn cache dir
        uses: actions/cache@v2.1.7
        with:
          path: ${{ steps.yarn-cache-dir.outputs.dir }}
          key: yarn-cache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
          restore-keys: |
            yarn-cache-${{ runner.os }}-
            yarn-cache-

      - name: Cache node modules
        uses: actions/cache@v2.1.7
        with:
          path: node_modules
          key: node_modules-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
          restore-keys: |
            node_modules-${{ runner.os }}-
            node_modules-

      - name: Run linters
        run: |
          yarn install --production=false --frozen-lockfile --non-interactive
          yarn lint
          yarn slint

  deploy-gae:
    name: App Engine Deployment
    environment: production
    # Skip workflow entirely for [skip ci] commits
    if: |
      false == contains(github.event.commits[0].message, '[skip ci]') &&
      false == contains(github.event.commits[0].message, '[no ci]')
    runs-on: ubuntu-latest
    needs: [lint]
    # Map a step output to a job output
    outputs:
      version-url: ${{ steps.version-url.outputs.url }}

    steps:
      - name: Checkout
        uses: actions/checkout@v2

      # Preferable to use the same version as in GAE environment
      - name: Set Node.js version
        uses: actions/setup-node@v2
        with:
          node-version: '14.17.6'

      - name: Cache yarn cache dir
        uses: actions/cache@v2.1.7
        with:
          path: ${{needs.lint.outputs.yarn-cache-dir}}
          key: yarn-cache-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
          restore-keys: |
            yarn-cache-${{ runner.os }}-
            yarn-cache-

      - name: Cache node modules
        uses: actions/cache@v2.1.7
        with:
          path: node_modules
          key: node_modules-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
          restore-keys: |
            node_modules-${{ runner.os }}-
            node_modules-

      - name: Build all
        run: |
          yarn install --production=false --frozen-lockfile --non-interactive
          yarn build
          rm public/dist/main.js

      - name: Generate static route handlers
        run: yarn static

      - name: Save prod dependencies for GAE upload
        run: |
          yarn install --production=true --frozen-lockfile --non-interactive
          tar -czf node_modules.tar.gz node_modules
          ls -lah node_modules.tar.gz | awk '{print $5,$9}'

      - name: Import Service Account key
        run: echo "${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}" | base64 -d > /tmp/auth.json

      - name: GCloud Auth
        run: |
          gcloud --quiet auth \
          activate-service-account "${{ secrets.GCP_SA_EMAIL }}" \
          --key-file=/tmp/auth.json \
          --project="${GCLOUD_PROJECT_ID}"

      - name: Deploy
        run: |
          yarn deploy --no-promote --version "${GITHUB_ACTOR//[\[\]]/}-${GITHUB_SHA:0:7}"

      - id: version-url
        name: Get deployed app version URL
        run: |
          VERSION_URL=$(gcloud app versions describe "${GITHUB_ACTOR//[\[\]]/}-${GITHUB_SHA:0:7}" --service=default --format "value(versionUrl)")
          echo $VERSION_URL
          echo "::set-output name=url::$(echo $VERSION_URL)"

  lighthouse:
    name: Lighthouse Audit
    environment: production
    runs-on: ubuntu-latest
    # Run only after successful deployment
    needs: [deploy-gae]
    env:
      LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}
      LHCI_BUILD_CONTEXT__CURRENT_HASH: ${{ github.sha }}

    steps:
      - name: Set Lighthouse CI config
        run: |
          curl "https://raw.githubusercontent.com/irkfap/kvaapagarrot.com/${GITHUB_SHA}/lighthouserc.json" \
          --silent --location --output "$GITHUB_WORKSPACE/lighthouserc.json"

      - name: Warmup deployed instance
        run: curl --silent --fail --head --write-out "%{http_code}" --request GET "${{needs.deploy-gae.outputs.version-url}}"

      - name: Check static deployed
        run: curl --silent --fail --include --request GET "${{needs.deploy-gae.outputs.version-url}}/robots.txt"

      - name: Audit URLs using Lighthouse
        uses: treosh/lighthouse-ci-action@8.2.0
        with:
          urls: |
            ${{needs.deploy-gae.outputs.version-url}}
          uploadArtifacts: true # save results as an action artifacts
          temporaryPublicStorage: true # upload lighthouse report to the temporary storage
          configPath: ${{ github.workspace }}/lighthouserc.json

  production:
    name: Update Production
    environment: production
    runs-on: ubuntu-latest
    # Run only after successful deployment and Lighthouse audit
    needs: [deploy-gae, lighthouse]
    # Run only on push to master
    if: ${{ success() && github.ref == 'refs/heads/main-kampf' }}

    steps:
      - name: Import Service Account key
        run: echo "${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}" | base64 -d > /tmp/auth.json

      - name: GCloud Auth
        run: |
          gcloud --quiet auth \
          activate-service-account "${{ secrets.GCP_SA_EMAIL }}" \
          --key-file=/tmp/auth.json \
          --project="${GCLOUD_PROJECT_ID}"

      - name: Promote deployed version to production
        run: |
          gcloud --quiet app versions migrate "${GITHUB_ACTOR//[\[\]]/}-${GITHUB_SHA:0:7}" --service=default