release.yml

name: Release
run-name: Releasing ${{ github.event.release.tag_name }}

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*.*.*'
    branches: [master]
    paths-ignore:
      - '**/*.md'

jobs:
  build-maintenance-image:
    name: Build maintenance container image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Packages Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          push: true
          file: Dockerfile.maintenance
          tags: ghcr.io/podkrepi-bg/frontend/maintenance:master

      - name: Scan with Mondoo
        uses: mondoohq/actions/docker-image@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          image: ghcr.io/podkrepi-bg/frontend/maintenance:master

  build-frontend-image:
    name: Build frontend container image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - name: Login to GitHub Packages Docker Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get tag
        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Get sha
        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=master-$(echo $GITHUB_SHA | cut -c 1-6)" >> $GITHUB_ENV

      - name: Build and push
        uses: docker/build-push-action@v5
        env:
          NODE_ENV: production
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          GHOST_API_URL: https://blog.podkrepi.bg
          GHOST_CONTENT_KEY: ${{ secrets.GHOST_CONTENT_KEY }}
        with:
          push: true
          target: runner
          build-args: |
            SENTRY_AUTH_TOKEN=${{ env.SENTRY_AUTH_TOKEN }}
            GHOST_API_URL=${{ env.GHOST_API_URL }}
            GHOST_CONTENT_KEY=${{ env.GHOST_CONTENT_KEY }}
            VERSION=${{ env.VERSION }}
          tags: ghcr.io/podkrepi-bg/frontend:${{ env.VERSION }}

      - name: Scan with Mondoo
        uses: mondoohq/actions/docker-image@main
        env:
          MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
        with:
          image: ghcr.io/podkrepi-bg/frontend:${{ env.VERSION }}

 scan-manifests:
   name: Scan k8s manifests
   runs-on: ubuntu-latest
   steps:
     - uses: actions/checkout@v4

     - name: Install kustomize
       uses: imranismail/setup-kustomize@v2

     - name: Build development manifests
       run: kustomize build manifests/overlays/development > dev-manifests.yaml

     - name: Scan development manifests with Mondoo
       uses: mondoohq/actions/k8s-manifest@main
       env:
         MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
       with:
         path: dev-manifests.yaml

     - name: Build production manifests
       run: kustomize build manifests/overlays/production > prod-manifests.yaml

     - name: Scan production manifests with Mondoo
       uses: mondoohq/actions/k8s-manifest@main
       env:
         MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_SECRET }}
       with:
         path: prod-manifests.yaml

  run-playwright:
    name: Run Playwright
    uses: ./.github/workflows/playwright.yml
    secrets: inherit

  release-dev:
    name: Release to dev
    runs-on: ubuntu-latest
    needs: [build-frontend-image, build-maintenance-image, run-playwright]
    environment:
      name: dev
      url: https://dev.podkrepi.bg
    steps:
      - uses: actions/checkout@v4

      - name: Install kubectl
        uses: azure/setup-kubectl@v3

      - name: Install kustomize
        uses: imranismail/setup-kustomize@v2

      - name: Get tag
        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Get sha
        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
        run: echo "VERSION=master-$(echo $GITHUB_SHA | cut -c 1-6)" >> $GITHUB_ENV

      - name: Set container versions in manifests
        working-directory: manifests/overlays/development
        run: |
          kustomize edit set image ghcr.io/podkrepi-bg/frontend=ghcr.io/podkrepi-bg/frontend:$VERSION
          kustomize edit set annotation app.komodor.com/app.ref:$GITHUB_SHA

      - name: Set kubeconfig
        run: echo ${{ secrets.K8S_DEV_CONFIG }} | base64 -d > config.yaml

      - name: Apply new manifests
        run: kubectl apply -k manifests/overlays/development --kubeconfig config.yaml

      - name: Wait until deployment is ready
        run: kubectl wait --for=condition=Available=True deployment/frontend --timeout=180s -n podkrepibg-dev --kubeconfig config.yaml

      - name: Delete kubeconfig
        if: always()
        run: rm config.yaml

  release-gh:
    name: Github release
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    needs: [release-dev]
    permissions:
      contents: write
    steps:
      - name: Release
        uses: softprops/action-gh-release@v1
        with:
          generate_release_notes: true

  release-prod:
    name: Release to prod
    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
    runs-on: ubuntu-latest
    needs: [release-gh]
    environment:
      name: prod
      url: https://podkrepi.bg
    steps:
      - uses: actions/checkout@v4

      - name: Install kubectl
        uses: azure/setup-kubectl@v3

      - name: Install kustomize
        uses: imranismail/setup-kustomize@v2

      - name: Get tag
        run: echo "VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV

      - name: Set container versions in manifests
        working-directory: manifests/overlays/production
        run: |
          kustomize edit set image ghcr.io/podkrepi-bg/frontend=ghcr.io/podkrepi-bg/frontend:$VERSION
          kustomize edit set annotation app.komodor.com/app.ref:$GITHUB_SHA

      - name: Set kubeconfig
        run: echo ${{ secrets.K8S_CONFIG }} | base64 -d > config.yaml

      - name: Apply new manifests
        run: kubectl apply -k manifests/overlays/production --kubeconfig config.yaml

      - name: Wait until deployment is ready
        run: kubectl wait --for=condition=Available=True deployment/frontend --timeout=180s -n podkrepibg --kubeconfig config.yaml

      - uses: sarisia/actions-status-discord@v1
        if: always()
        with:
          webhook: ${{ secrets.DISCORD_WEBHOOK }}
          title: 'deploy'
          url: https://podkrepi.bg/
          description: Version ${{ env.VERSION }} of the website is deployed. The list of changes can be found at https://github.com/podkrepi-bg/frontend/releases/tag/${{ env.VERSION }}
          color: 0x26A641

      - name: Delete kubeconfig
        if: always()
        run: rm config.yaml