|
| 1 | +# This workflow uses devbox for dependency management and builds/deploys the library API |
| 2 | +# to Cloud Run when a version tag is pushed (e.g., library-api-v1.0.0). |
| 3 | + |
| 4 | +name: 'Build and Deploy Library API to Cloud Run' |
| 5 | + |
| 6 | +on: |
| 7 | + push: |
| 8 | + tags: |
| 9 | + - 'library-api-v*' |
| 10 | + |
| 11 | +env: |
| 12 | + PROJECT_ID: 'benefit-decision-toolkit-play' |
| 13 | + REGION: 'us-central1' |
| 14 | + SERVICE: 'benefit-decision-toolkit-play' |
| 15 | + API_NAME: 'library-api' |
| 16 | + WORKLOAD_IDENTITY_PROVIDER: 'projects/1034049717668/locations/global/workloadIdentityPools/github-actions-google-cloud/providers/github' |
| 17 | + |
| 18 | +jobs: |
| 19 | + deploy: |
| 20 | + runs-on: 'ubuntu-latest' |
| 21 | + |
| 22 | + permissions: |
| 23 | + contents: 'read' |
| 24 | + id-token: 'write' |
| 25 | + |
| 26 | + steps: |
| 27 | + - name: 'Checkout' |
| 28 | + uses: 'actions/checkout@v4' |
| 29 | + |
| 30 | + # Devbox needs a .env file to exist, even if it's empty |
| 31 | + - name: 'Create .env file' |
| 32 | + run: touch .env |
| 33 | + |
| 34 | + # Setup devbox which includes all our dependencies: Maven, JDK 21, Quarkus, etc. |
| 35 | + - name: 'Install devbox' |
| 36 | + uses: 'jetify-com/devbox-install-action@v0.12.0' |
| 37 | + with: |
| 38 | + enable-cache: true |
| 39 | + |
| 40 | + # Extract version from pom.xml (source of truth) using Maven |
| 41 | + - name: 'Extract version from pom.xml' |
| 42 | + id: extract_version |
| 43 | + run: | |
| 44 | + # Use -f to specify the pom.xml path (devbox runs from repo root) |
| 45 | + VERSION=$(devbox run -q -- mvn -f library-api/pom.xml help:evaluate -Dexpression=project.version -q -DforceStdout 2>&1 | tail -1 | xargs) |
| 46 | +
|
| 47 | + echo "Extracted VERSION: '${VERSION}'" |
| 48 | +
|
| 49 | + # Validate it's a semantic version |
| 50 | + if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then |
| 51 | + echo "ERROR: Invalid version format: '$VERSION'" |
| 52 | + echo "Expected semantic version (e.g., 0.1.2)" |
| 53 | + exit 1 |
| 54 | + fi |
| 55 | +
|
| 56 | + echo "version=${VERSION}" >> "$GITHUB_OUTPUT" |
| 57 | + # Create revision-safe version string (replace dots with dashes for Cloud Run) |
| 58 | + REVISION_VERSION=$(echo "${VERSION}" | tr '.' '-') |
| 59 | + echo "revision_version=${REVISION_VERSION}" >> "$GITHUB_OUTPUT" |
| 60 | + echo "Extracted version from pom.xml: ${VERSION}" |
| 61 | + echo "Revision version: ${REVISION_VERSION}" |
| 62 | +
|
| 63 | + # Validate that git tag exists for this pom.xml version |
| 64 | + - name: 'Validate git tag matches pom.xml version' |
| 65 | + run: | |
| 66 | + devbox run -q -- bin/validate-library-api-version |
| 67 | +
|
| 68 | + # Configure Workload Identity Federation and generate an access token |
| 69 | + - id: 'auth' |
| 70 | + name: 'Authenticate to Google Cloud' |
| 71 | + uses: 'google-github-actions/auth@v2' |
| 72 | + with: |
| 73 | + workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}' |
| 74 | + service_account: cicd-build-deploy-api@benefit-decision-toolkit-play.iam.gserviceaccount.com |
| 75 | + project_id: ${{ env.PROJECT_ID }} |
| 76 | + |
| 77 | + # Configure Docker to use gcloud as a credential helper (using devbox gcloud) |
| 78 | + - name: 'Configure Docker' |
| 79 | + run: | |
| 80 | + devbox run -q -- gcloud auth configure-docker ${{ env.REGION }}-docker.pkg.dev |
| 81 | +
|
| 82 | + # Build the Quarkus app with Maven using devbox environment |
| 83 | + - name: 'Build Quarkus App' |
| 84 | + working-directory: library-api |
| 85 | + run: | |
| 86 | + devbox run -q build-library-api-ci |
| 87 | +
|
| 88 | + - name: 'Build and Push Container' |
| 89 | + working-directory: library-api |
| 90 | + run: |- |
| 91 | + VERSION="${{ steps.extract_version.outputs.version }}" |
| 92 | + DOCKER_TAG_VERSIONED="${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.API_NAME }}:v${VERSION}" |
| 93 | + DOCKER_TAG_LATEST="${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.API_NAME }}:latest" |
| 94 | +
|
| 95 | + # Build and tag with version |
| 96 | + docker build -f src/main/docker/Dockerfile.jvm --tag "${DOCKER_TAG_VERSIONED}" --tag "${DOCKER_TAG_LATEST}" . |
| 97 | +
|
| 98 | + # Push both tags |
| 99 | + docker push "${DOCKER_TAG_VERSIONED}" |
| 100 | + docker push "${DOCKER_TAG_LATEST}" |
| 101 | +
|
| 102 | + echo "Pushed images:" |
| 103 | + echo " - ${DOCKER_TAG_VERSIONED}" |
| 104 | + echo " - ${DOCKER_TAG_LATEST}" |
| 105 | +
|
| 106 | + - name: 'Deploy to Cloud Run' |
| 107 | + id: deploy |
| 108 | + uses: 'google-github-actions/deploy-cloudrun@v2' |
| 109 | + with: |
| 110 | + service: '${{ env.API_NAME }}' |
| 111 | + region: '${{ env.REGION }}' |
| 112 | + image: '${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}/${{ env.API_NAME }}:v${{ steps.extract_version.outputs.version }}' |
| 113 | + tag: '${{ env.API_NAME }}-v${{ steps.extract_version.outputs.revision_version }}' |
| 114 | + flags: '--allow-unauthenticated --max-instances=2 --service-account=library-api-service-account@${{ env.PROJECT_ID }}.iam.gserviceaccount.com' |
| 115 | + |
| 116 | + # Show deployment output |
| 117 | + - name: 'Show deployment output' |
| 118 | + run: | |
| 119 | + echo "Deployment complete!" |
| 120 | + echo "Service URL: ${{ steps.deploy.outputs.url }}" |
| 121 | + echo "Version: v${{ steps.extract_version.outputs.version }}" |
| 122 | + echo "Revision: ${{ env.API_NAME }}-v${{ steps.extract_version.outputs.revision_version }}" |
0 commit comments