ci.yml

name: CI

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'

      - name: Download dependencies
        run: go mod download

      - name: Run tests
        run: go test -race -v ./...

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'

      - name: golangci-lint
        uses: golangci/golangci-lint-action@v7
        with:
          version: v2.9.0

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'

      - name: Install gosec
        run: go install github.com/securego/gosec/v2/cmd/gosec@latest

      - name: Run gosec
        # All false positives are suppressed with inline #nosec comments.
        # No global exclusions — every suppression is documented at the call site.
        run: gosec ./...

  build:
    runs-on: ubuntu-latest
    needs: [test, lint]
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v5
        with:
          go-version: '1.26'

      - name: Build
        run: go build -v ./...

  scan:
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'

  deploy:
    runs-on: ubuntu-latest
    needs: [build, security, scan]
    # Only deploy on version tag pushes (e.g. v1.0.0)
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')

    environment:
      name: production
      url: ${{ steps.show-url.outputs.url }}

    permissions:
      contents: read
      id-token: write  # Required for Workload Identity Federation

    env:
      PROJECT_ID: "github-copy-code-examples"
      SERVICE_NAME: "examples-copier"
      REGION: "us-central1"

    steps:
      - uses: actions/checkout@v4

      - name: Extract version from tag
        id: version
        run: |
          RAW_TAG="${GITHUB_REF#refs/tags/}"
          # Cloud Run traffic tags: lowercase, a-z0-9-, max 63 chars, no leading/trailing -
          TRAFFIC_TAG=$(echo "$RAW_TAG" | tr '.' '-' | tr '[:upper:]' '[:lower:]')
          echo "tag=$RAW_TAG" >> $GITHUB_OUTPUT
          echo "traffic_tag=$TRAFFIC_TAG" >> $GITHUB_OUTPUT

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2

      - name: Deploy to Cloud Run
        run: |
          gcloud run deploy $SERVICE_NAME \
            --source . \
            --region $REGION \
            --project $PROJECT_ID \
            --allow-unauthenticated \
            --set-env-vars="^|^CONFIG_REPO_OWNER=grove-platform|CONFIG_REPO_NAME=github-copier|CONFIG_REPO_BRANCH=main|PEM_NAME=CODE_COPIER_PEM|WEBHOOK_SECRET_NAME=webhook-secret|MONGO_URI_SECRET_NAME=mongo-uri|WEBSERVER_PATH=/events|MAIN_CONFIG_FILE=.copier/main.yaml|USE_MAIN_CONFIG=true|DEPRECATION_FILE=deprecated_examples.json|COMMITTER_NAME=GitHub Copier App|COMMITTER_EMAIL=bot@mongodb.com|GOOGLE_CLOUD_PROJECT_ID=github-copy-code-examples|COPIER_LOG_NAME=code-copier-log|AUDIT_ENABLED=false|METRICS_ENABLED=true|GITHUB_APP_ID=${{ secrets.APP_ID }}|INSTALLATION_ID=${{ secrets.INSTALLATION_ID }}" \
            --set-build-env-vars="VERSION=${{ steps.version.outputs.tag }}" \
            --tag="${{ steps.version.outputs.traffic_tag }}" \
            --max-instances=10 \
            --cpu=1 \
            --memory=512Mi \
            --timeout=300s \
            --concurrency=80 \
            --port=8080 \
            --platform=managed

      - name: Show deployment URL
        id: show-url
        run: |
          URL=$(gcloud run services describe $SERVICE_NAME \
            --region $REGION \
            --project $PROJECT_ID \
            --format='value(status.url)')
          echo "url=$URL" >> $GITHUB_OUTPUT
          echo "Deployed ${{ steps.version.outputs.tag }} to: $URL"