pan.dev/.github/workflows/deploy-live.yml at master · CyberFerg/pan.dev · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: Deploy Live

on:
  push:
    branches: [ master ]
  workflow_dispatch:

permissions: {}

concurrency:
  group: deploy-live
  cancel-in-progress: false

jobs:
   build:
      if: github.repository_owner == 'PaloAltoNetworks' && github.ref == 'refs/heads/master'
      name: Build
      runs-on: pan-dev-runner-xl
      permissions:
        contents: read

      steps:
        - name: Checkout repository
          uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
          with:
            persist-credentials: false

        - name: Setup node
          uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
          with:
            node-version: '20'
            cache: 'yarn'

        - name: Get yarn cache
          id: yarn-cache
          run: echo "YARN_CACHE_DIR=$(yarn cache dir)" >> "${GITHUB_OUTPUT}"

        # - name: Cache dependencies
        #   uses: actions/cache@v4
        #   with:
        #     path: ${{ steps.yarn-cache.outputs.YARN_CACHE_DIR }}
        #     key: ${{ runner.os }}-pandev-${{ hashFiles('**/yarn.lock') }}
        #     restore-keys: |
        #       ${{ runner.os }}-pandev-

        # - name: Cache docusaurus build
        #   uses: actions/cache@v4
        #   with:
        #     path: node_modules/.cache/webpack
        #     key: pandev-live-${{ github.run_id }}
        #     restore-keys: |
        #       pandev-live

        - name: Install dependencies
          run: yarn --prefer-offline --frozen-lockfile --ignore-scripts

        # needed for fetching Hashicorp blog feed
        - name: Cache Playwright
          id: playwright-cache
          uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
          with:
            path: |
              ~/.cache/ms-playwright
            key: ${{ runner.os }}-playwright-master-${{ hashFiles('package.json') }}
            restore-keys: |
              ${{ runner.os }}-playwright-master-

        - name: Install Playwright
          if: steps.playwright-cache.outputs.cache-hit != 'true'
          run: |
            npx playwright install chromium
            npx playwright install-deps chromium

        - name: Build site
          run: |
            FEED_SOFT_FAIL=1 FEED_DEBUG=1 yarn build-github
            rm -f build.zip
            zip -r build.zip build
          env:
            REACT_APP_ERROR_REPORTER_APIKEY: ${{ secrets.ERROR_REPORTER_APIKEY }}

        - name: Verify build did not modify critical files
          run: |
            git diff --exit-code -- \
              firebase.json .firebaserc package.json yarn.lock docusaurus.config.ts \
              'scripts/**' '.github/**' 'src/theme/**' 'plugin-sitemap-coveo/**'

        - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
          with:
            name: build
            path: build.zip

   deploy:
      name: Deploy
      needs: build
      if: github.repository_owner == 'PaloAltoNetworks' && github.ref == 'refs/heads/master'
      runs-on: pan-dev-runner-lg
      environment: production
      permissions:
        contents: read
        id-token: write

      steps:
        - name: Checkout repository
          uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
          with:
            persist-credentials: false

        - name: Setup node
          uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
          with:
            node-version: '20'
            cache: 'yarn'

        - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
          with:
            name: build

        - name: Unzip build artifact
          run: unzip -n build.zip 'build/*'

        - name: Authenticate to Google Cloud
          id: auth
          uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
          with:
            workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
            service_account: ${{ secrets.WIF_SERVICE_ACCOUNT }}

        - name: Read GCP credentials
          id: creds
          run: |
            creds=$(cat "${{ steps.auth.outputs.credentials_file_path }}")
            echo "::add-mask::$creds"
            echo "sa_key=$creds" >> "$GITHUB_OUTPUT"

        - name: Deploy to Firebase
          id: deploy_live
          uses: FirebaseExtended/action-hosting-deploy@e2eda2e106cfa35cdbcf4ac9ddaf6c4756df2c8c # v0.10.0
          with:
            repoToken: '${{ secrets.GITHUB_TOKEN }}'
            firebaseServiceAccount: "${{ steps.creds.outputs.sa_key }}"
            projectId: pan-dev-f1b58
            channelId: live
          env:
            FIREBASE_CLI_PREVIEWS: hostingchannels