ci.yaml

name: CI
on: [ push, pull_request, workflow_dispatch ]
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
    - uses: actions/checkout@v4
    - name: Import Secrets
      id: secrets
      uses: hashicorp/vault-action@v3.0.0
      with:
        exportToken: true
        exportEnv: true
        method: jwt
        url: ${{ secrets.VAULT_ADDR }}
        role: cicd
        secrets: |
          kv/data/cicd/github api_token | GITHUB_API_TOKEN
    - name: Docker Login
      run: docker login ghcr.io -u ${{ github.repository_owner }} -p ${GITHUB_API_TOKEN}
    - name: Install Pack
      uses: buildpacks/github-actions/setup-pack@v5.5.4
    - name: Install GraalVM
      uses: graalvm/setup-graalvm@v1
      with:
        java-version: '21'
        distribution: 'graalvm'
        cache: 'maven'
        github-token: ${{ secrets.GITHUB_TOKEN }}
    - name: Unit Tests
      run: ./mvnw -V --no-transfer-progress clean test
    - name: Executable Jar
      run: |
        set -e
        ./mvnw -V --no-transfer-progress package -DskipTests
        java -jar target/ssr-react-spring-boot-graalvm-js-0.0.1-SNAPSHOT.jar &
        .github/workflows/wait.sh
        curl --fail --show-error --silent http://localhost:8080
        curl --fail --show-error --silent http://localhost:8080/posts/1
        pkill -KILL java
    - name: Native Image
      run: |
        set -e
        ./mvnw -V --no-transfer-progress -Pnative native:compile -DskipTests
        ./target/ssr-react-spring-boot-graalvm-js &
        .github/workflows/wait.sh
        curl --fail --show-error --silent http://localhost:8080
        curl --fail --show-error --silent http://localhost:8080/posts/1
        pkill -KILL ssr-react-spring-boot-graalvm-js || true
    - name: Pack Build
      if: github.ref == 'refs/heads/main'
      run: |
        mkdir -p pack
        mv ./target/ssr-react-spring-boot-graalvm-js ./pack
        cat <<EOF > pack/Procfile
        web: ./ssr-react-spring-boot-graalvm-js
        EOF
        pack build ghcr.io/${{ github.repository_owner }}/ssr-react-spring-boot-graalvm-js --gid 1000 --publish --builder paketobuildpacks/builder-jammy-tiny --path pack
    - name: Revoke token
      if: always()
      run: |
        curl -X POST -s -H "X-Vault-Token: ${VAULT_TOKEN}" ${{ secrets.VAULT_ADDR }}/v1/auth/token/revoke-self