casecomp/.github/workflows/deploy.yml at main · Pyronewbic/casecomp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
name: Deploy
on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write

env:
  PROJECT_ID: casecomp-495718
  SERVICE: casecomp-api
  IMAGE: gcr.io/casecomp-495718/casecomp-api

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.digest.outputs.digest }}
    steps:
      - uses: actions/checkout@v6

      - uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: projects/129850122606/locations/global/workloadIdentityPools/github-pool/providers/github-provider
          service_account: casecomp-deploy@casecomp-495718.iam.gserviceaccount.com

      - uses: google-github-actions/setup-gcloud@v3

      - name: Build and push
        run: |
          BUILD_ID=$(gcloud builds submit \
            --config=cloudbuild.yml \
            --project ${{ env.PROJECT_ID }} \
            --async \
            --format='value(id)' .)
          echo "Waiting for build $BUILD_ID..."
          while true; do
            STATUS=$(gcloud builds describe $BUILD_ID --project ${{ env.PROJECT_ID }} --format='value(status)' 2>/dev/null)
            echo "  status: $STATUS"
            case "$STATUS" in
              SUCCESS) break ;;
              FAILURE|TIMEOUT|CANCELLED|INTERNAL_ERROR) echo "Build failed: $STATUS"; exit 1 ;;
              *) sleep 15 ;;
            esac
          done

      - name: Get image digest
        id: digest
        run: |
          DIGEST=$(gcloud container images describe ${{ env.IMAGE }}:latest \
            --project ${{ env.PROJECT_ID }} \
            --format='value(image_summary.digest)')
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
          echo "Image digest: $DIGEST"

      - name: Configure Docker auth for GCR
        run: gcloud auth configure-docker --quiet

      - uses: sigstore/cosign-installer@v3

      - name: Sign image (keyless)
        run: |
          cosign sign --yes \
            --oidc-issuer=https://token.actions.githubusercontent.com \
            "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}"

      - name: Verify signature
        run: |
          cosign verify \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            --certificate-identity-regexp="github.com/Pyronewbic/casecomp" \
            "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}" || true

      - name: Attest SLSA provenance
        run: |
          cat > /tmp/provenance.json << 'PROV'
          {
            "buildType": "https://slsa.dev/provenance/v1",
            "builder": { "id": "https://github.com/Pyronewbic/casecomp/.github/workflows/deploy.yml" },
            "invocation": {
              "configSource": {
                "uri": "git+https://github.com/Pyronewbic/casecomp@refs/heads/main",
                "digest": { "sha1": "${{ github.sha }}" },
                "entryPoint": ".github/workflows/deploy.yml"
              }
            }
          }
          PROV
          cosign attest --yes \
            --oidc-issuer=https://token.actions.githubusercontent.com \
            --predicate /tmp/provenance.json \
            --type slsaprovenance \
            "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}"

  deploy:
    needs: build
    runs-on: ubuntu-latest
    strategy:
      matrix:
        region: [asia-south1, us-central1]
      fail-fast: false
    steps:
      - uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: projects/129850122606/locations/global/workloadIdentityPools/github-pool/providers/github-provider
          service_account: casecomp-deploy@casecomp-495718.iam.gserviceaccount.com

      - uses: google-github-actions/setup-gcloud@v3

      - name: Deploy to Cloud Run (${{ matrix.region }})
        run: |
          gcloud run deploy ${{ env.SERVICE }} \
            --image "${{ env.IMAGE }}@${{ needs.build.outputs.digest }}" \
            --region ${{ matrix.region }} \
            --project ${{ env.PROJECT_ID }} \
            --port 3000 \
            --allow-unauthenticated