build-and-deploy-nada-backend.yml

name: Build and deploy nada-backend

on:
  push:
    branches:
      - '*'
  workflow_dispatch:
    inputs:
      environment:
        description: Environment du kjører i
        type: choice
        options:
          - dev
          - prod
        required: true

env:
  CI: true

permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  golangci:
    env:
      CGO_ENABLED: 1
      CXX: clang++
      CC: clang
      CGO_CXXFLAGS: -Wno-everything
      CGO_LDFLAGS: -Wno-everything
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: golangci-lint
        uses: golangci/golangci-lint-action@v6
        with:
          version: v1.55.2

  staticchecks:
    env:
      CGO_ENABLED: 1
      CXX: clang++
      CC: clang
      CGO_CXXFLAGS: -Wno-everything
      CGO_LDFLAGS: -Wno-everything
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - uses: dominikh/staticcheck-action@v1
        with:
          version: "latest"
          install-go: false

  test-containers:
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - id: auth
        name: Authenticate with Google Cloud
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: projects/1007056531311/locations/global/workloadIdentityPools/ci-nada-prod/providers/ci-nada-prod
          service_account: ci-nada-images@nada-prod-6977.iam.gserviceaccount.com

      - uses: docker/login-action@v3
        name: Login to Google Artifact Registry
        with:
          registry: europe-north1-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}

      - name: Check if images exist
        id: check-images
        run: |
          set +e
          make check-images
          echo "exit_code=$?" >> $GITHUB_OUTPUT
        continue-on-error: true

      - name: Build and push all images
        if: ${{ steps.check-images.outputs.exit_code != 0 }}
        run: make build-push-all

  tests:
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    needs:
    - test-containers
    steps:
      - uses: actions/checkout@v4
      - id: auth
        name: Authenticate with Google Cloud
        uses: google-github-actions/auth@v2
        with:
          token_format: access_token
          workload_identity_provider: projects/1007056531311/locations/global/workloadIdentityPools/ci-nada-prod/providers/ci-nada-prod
          service_account: ci-nada-images@nada-prod-6977.iam.gserviceaccount.com

      - uses: docker/login-action@v3
        name: Login to Google Artifact Registry
        with:
          registry: europe-north1-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}
      - run: make pull-deps pull-metabase-patched
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - run: make test
      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v4.6.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  build:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - run: make release
      - uses: actions/upload-artifact@v4
        with:
          name: nada-backend
          path: nada-backend

  push:
    name: Push backend image
    permissions:
      contents: write
      id-token: write
    runs-on: ubuntu-latest
    needs:
    - build
    - golangci
    - tests
    - staticchecks
    if: github.actor != 'dependabot[bot]'
    outputs:
      image: ${{ steps.docker-build-push.outputs.image }}
    steps:
      - uses: actions/checkout@v4
      - name: Download nada-backend binary
        uses: actions/download-artifact@v4
        with:
          name: nada-backend
      - name: Push docker image to GAR
        uses: nais/docker-build-push@v0
        id: docker-build-push
        with:
          team: nada
          identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
          project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
          dockerfile: ./resources/images/nada-backend/Dockerfile

  deploy-dev:
    name: Deploy dev gcp
    runs-on: ubuntu-20.04
    needs:
    - push
    if: github.actor != 'dependabot[bot]'
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to dev-gcp
        if: inputs.environment != 'prod'
        uses: nais/deploy/actions/deploy@v2
        env:
          CLUSTER: dev-gcp
          RESOURCE: .nais/dev/nada-backend/nada-backend-config.yaml,.nais/dev/nada-backend/gcp.yaml
          VAR: image=${{ needs.push.outputs.image }}

  deploy-prod:
    name: Deploy prod gcp
    runs-on: ubuntu-20.04
    needs:
    - push
    - deploy-dev
    if: github.ref == 'refs/heads/main' && inputs.environment != 'dev'|| inputs.environment == 'prod'
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to prod-gcp
        uses: nais/deploy/actions/deploy@v2
        env:
          CLUSTER: prod-gcp
          RESOURCE: .nais/prod/nada-backend/nada-backend-config.yaml,.nais/prod/nada-backend/gcp.yaml
          VAR: image=${{ needs.push.outputs.image }}