deploy.yml

name: Deploy

on:
  push:
    branches: [main]
    paths:
      - "packages/backend/**"
      - "packages/shared/**"

permissions:
  contents: read
  id-token: write # Required for Workload Identity Federation

env:
  PROJECT_ID: propagatecli-495615
  REGION: europe-west2
  REPOSITORY: propagate
  IMAGE: propagate-api
  TF_ORGANIZATION: propagateCLI
  TF_WORKSPACE: propagate-cli

jobs:
  build:
    name: Build & Push Image
    runs-on: ubuntu-latest
    outputs:
      # Digest-pinned reference so every deploy produces a unique image string
      # and Cloud Run is forced to roll a new revision.
      image: ${{ steps.ref.outputs.image }}

    steps:
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Configure Docker for Artifact Registry
        run: gcloud auth configure-docker ${{ env.REGION }}-docker.pkg.dev --quiet

      - name: Build and push
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./packages/backend/Dockerfile
          push: true
          tags: |
            ${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.IMAGE }}:latest
            ${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.IMAGE }}:sha-${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Resolve digest-pinned image reference
        id: ref
        run: |
          echo "image=${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.IMAGE }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"

  deploy:
    name: Terraform Plan & Apply
    runs-on: ubuntu-latest
    needs: build
    environment: production

    steps:
      - uses: actions/checkout@v4

      # Pin the Cloud Run image to the freshly built digest by writing it to the
      # workspace `image` variable. Workspace variables take precedence over the
      # config, so this overrides any stale pin and guarantees the new image is
      # deployed instead of whatever the workspace was previously holding.
      - name: Pin Cloud Run image in Terraform Cloud workspace
        env:
          TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
          IMAGE: ${{ needs.build.outputs.image }}
        run: |
          set -euo pipefail

          if [ -z "${IMAGE:-}" ]; then
            echo "No image reference passed from the build job" >&2
            exit 1
          fi

          api="https://app.terraform.io/api/v2"
          auth="Authorization: Bearer ${TF_API_TOKEN}"
          ct="Content-Type: application/vnd.api+json"

          ws_id=$(curl -sf -H "$auth" -H "$ct" \
            "$api/organizations/${TF_ORGANIZATION}/workspaces/${TF_WORKSPACE}" \
            | jq -r '.data.id')

          if [ -z "$ws_id" ] || [ "$ws_id" = "null" ]; then
            echo "Could not resolve workspace ${TF_ORGANIZATION}/${TF_WORKSPACE}" >&2
            exit 1
          fi

          var_id=$(curl -sf -H "$auth" -H "$ct" \
            "$api/workspaces/${ws_id}/vars" \
            | jq -r '.data[] | select(.attributes.key=="image") | .id')

          payload=$(jq -n --arg img "$IMAGE" '{
            data: {
              type: "vars",
              attributes: {
                key: "image",
                value: $img,
                category: "terraform",
                hcl: false,
                sensitive: false
              }
            }
          }')

          if [ -n "$var_id" ] && [ "$var_id" != "null" ]; then
            curl -sf -X PATCH -H "$auth" -H "$ct" \
              "$api/workspaces/${ws_id}/vars/${var_id}" -d "$payload" > /dev/null
          else
            curl -sf -X POST -H "$auth" -H "$ct" \
              "$api/workspaces/${ws_id}/vars" -d "$payload" > /dev/null
          fi

          echo "Pinned workspace image variable to ${IMAGE}"

      - name: Upload Terraform configuration
        uses: hashicorp/tfc-workflows-github/actions/upload-configuration@v1.3.1
        id: upload
        env:
          TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
          TF_CLOUD_ORGANIZATION: ${{ env.TF_ORGANIZATION }}
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          directory: ./packages/backend/infra/terraform

      - name: Create Terraform run
        uses: hashicorp/tfc-workflows-github/actions/create-run@v1.3.1
        id: run
        env:
          TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
          TF_CLOUD_ORGANIZATION: ${{ env.TF_ORGANIZATION }}
        with:
          workspace: ${{ env.TF_WORKSPACE }}
          configuration_version: ${{ steps.upload.outputs.configuration_version_id }}
          message: "Deployed from ${{ github.sha }} — ${{ github.event.head_commit.message }}"

      - name: Apply Terraform run
        uses: hashicorp/tfc-workflows-github/actions/apply-run@v1.3.1
        env:
          TF_API_TOKEN: ${{ secrets.TF_API_TOKEN }}
          TF_CLOUD_ORGANIZATION: ${{ env.TF_ORGANIZATION }}
        with:
          run: ${{ steps.run.outputs.run_id }}
          comment: "Auto-applied via GitHub Actions (commit ${{ github.sha }})"