terraform.yml

name: Terraform
on: [push]

env:
  REGION: ${{ vars.FVST_PROJECT_REGION }}
  DOCKER_TAG: gh-run-${{ github.run_number }}

jobs:
  build:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        include:
          - environment: "staging"
            service: "blog-graphql"
            use_prisma: true
          - environment: "staging"
            service: "todo-graphql"
            use_prisma: true
          - environment: "staging"
            service: "user-graphql"
            use_prisma: true
          - environment: "staging"
            service: "graphql-gateway"
    env:
      PROJECT: ${{ vars.FVST_PROJECT_PREFIX }}-fvst-${{matrix.environment}}
      REGISTRY: ${{ vars.FVST_PROJECT_REGION }}-docker.pkg.dev/${{ vars.FVST_PROJECT_PREFIX }}-fvst-${{matrix.environment}}/registry

    steps:
      - uses: "actions/checkout@v3"

      - name: "Unpack Key"
        id: "google-key"
        run: |
          GOOGLE_CLOUD_TOKEN=$(echo ${{secrets.GOOGLE_CLOUD_TOKEN_STAGING}} | base64 --decode)
          echo "GOOGLE_CLOUD_TOKEN=$GOOGLE_CLOUD_TOKEN" >> $GITHUB_OUTPUT

      - id: auth
        name: "Authenticate to Google Cloud"
        uses: "google-github-actions/auth@v1"
        with:
          token_format: "access_token"
          credentials_json: ${{steps.google-key.outputs.GOOGLE_CLOUD_TOKEN}}

      - name: "Set up Cloud SDK"
        uses: "google-github-actions/setup-gcloud@v1"
        with:
          version: ">= 417.0.0"

      - name: Info
        run: |
          gcloud info

      - name: Configure docker
        run: gcloud auth configure-docker ${{ vars.FVST_PROJECT_REGION }}-docker.pkg.dev --quiet

      - name: Login to Artifact Registry
        uses: docker/login-action@v2
        with:
          registry: ${{ vars.FVST_PROJECT_REGION }}-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Build and push
        uses: docker/build-push-action@v4
        with:
          push: true
          tags: ${{env.REGISTRY}}/${{matrix.service}}:${{env.DOCKER_TAG}},${{env.REGISTRY}}/${{matrix.service}}:latest
          file: tooling/docker/nest/Dockerfile
          #          cache-from: type=registry,ref=${{env.REGISTRY}}/${{matrix.service}}:buildcache
          cache-to: type=registry,ref=${{env.REGISTRY}}/${{matrix.service}}:buildcache,mode=max
          build-args: |
            APP_NAME=${{matrix.service}}
            USE_PRISMA=${{matrix.use_prisma}}

  deploy:
    runs-on: ubuntu-latest
    needs: build

    strategy:
      matrix:
        include:
          - environment: staging
            google_cloud_token: GOOGLE_CLOUD_TOKEN_STAGING
            terraform_bucket: FVST_PROJECT_TF_STATE_BUCKET_STAGING
    #          - environment: production
    #            google_cloud_token: GOOGLE_CLOUD_TOKEN_PRODUCTION
    #            terraform_bucket: FVST_PROJECT_TF_STATE_BUCKET_PRODUCTION

    env:
      PROJECT: ${{ vars.FVST_PROJECT_PREFIX }}-fvst-${{matrix.environment}}
      GOOGLE_CLOUD_TOKEN_ENV: ${{ secrets[matrix.google_cloud_token] }}
      TERRAFORM_BUCKET: ${{ vars[matrix.terraform_bucket] }}
      TF_VAR_project: ${{ vars.FVST_PROJECT_PREFIX }}-fvst-${{matrix.environment}}
      TF_VAR_region: ${{ vars.FVST_PROJECT_REGION }}
      TF_LOG: DEBUG

    steps:
      - uses: "actions/checkout@v3"

      - name: "Unpack Key"
        id: "google-key"
        run: |
          GOOGLE_CLOUD_TOKEN=$(echo $GOOGLE_CLOUD_TOKEN_ENV | base64 --decode)
          echo "GOOGLE_CLOUD_TOKEN=$GOOGLE_CLOUD_TOKEN" >> $GITHUB_OUTPUT

      - name: "Authenticate to Google Cloud"
        uses: "google-github-actions/auth@v1"
        with:
          credentials_json: "${{steps.google-key.outputs.GOOGLE_CLOUD_TOKEN}}"
          export_environment_variables: true
          create_credentials_file: true

      - name: "Set up Cloud SDK"
        uses: "google-github-actions/setup-gcloud@v1"

      - name: Info
        run: gcloud info

      - name: Setup terraform remote and configuration
        run: |
          cat <<EOT >> "./infra/envs/${{matrix.environment}}/backend.tf"
            terraform {
              backend "gcs" {
                bucket = "$TERRAFORM_BUCKET"
              }
          }
          EOT

      - name: Terraform init
        working-directory: ./infra/envs/${{matrix.environment}}
        run: terraform init

      - name: Terraform apply
        working-directory: ./infra/envs/${{matrix.environment}}
        run: terraform apply -auto-approve