05h_deploy_with_github_runner.yml

name: Deploy on AKS

on:
  workflow_call:
    inputs:
      environment:
        required: true
        description: The name of the environment where to deploy
        type: string
      target:
        required: true
        description: The environment target of the job
        type: string

env:
  APP_NAME: pagopa-node-cfg-sync


permissions:
  id-token: write
  contents: read

jobs:
  create_runner:
    name: Create Runner
    runs-on: ubuntu-22.04
    environment:
      name: ${{ inputs.environment }}
    if: ${{ inputs.target == inputs.environment || inputs.target == 'all' }}
    outputs:
      runner_name: ${{ steps.create_github_runner.outputs.runner_name }}
    steps:
      - name: Create GitHub Runner
        id: create_github_runner
        # from https://github.com/pagopa/eng-github-actions-iac-template/tree/main/azure/github-self-hosted-runner-azure-create-action
        uses: pagopa/eng-github-actions-iac-template/azure/github-self-hosted-runner-azure-create-action@main
        with:
          client_id: ${{ secrets.CD_CLIENT_ID }}
          tenant_id: ${{ secrets.TENANT_ID }}
          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
          container_app_environment_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_NAME }}
          resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }} # RG of the runner
          pat_token: ${{ secrets.BOT_TOKEN_GITHUB }}
          self_hosted_runner_image_tag: "latest"

  deploy:
    needs: [ create_runner ]
    runs-on: [ self-hosted, "${{ needs.create_runner.outputs.runner_name }}" ]
    if: ${{ inputs.target == inputs.environment || inputs.target == 'all' }}
    name: Deploy on AKS
    environment: ${{ inputs.environment }}
    steps:
      - name: Deploy
        uses: pagopa/github-actions-template/aks-deploy@main
        with:
          branch: ${{ github.ref_name }}
          client_id: ${{ secrets.CD_CLIENT_ID }}
          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
          tenant_id: ${{ secrets.TENANT_ID }}
          env: ${{ inputs.environment }}
          namespace: ${{ vars.NAMESPACE }}
          cluster_name: ${{ vars.CLUSTER_NAME }}
          resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
          app_name: ${{ env.APP_NAME }}
          helm_upgrade_options: "--debug --set microservice-chart.forceRedeploy=true"

  cleanup_runner:
    name: Cleanup Runner
    needs: [ create_runner, deploy ]
    if: ${{ success() || failure() && inputs.target == inputs.environment || inputs.target == 'all' }}
    runs-on: ubuntu-22.04
    environment: ${{ inputs.environment }}
    steps:
      - name: Cleanup GitHub Runner
        id: cleanup_github_runner
        # from https://github.com/pagopa/eng-github-actions-iac-template/tree/main/azure/github-self-hosted-runner-azure-cleanup-action
        uses: pagopa/eng-github-actions-iac-template/azure/github-self-hosted-runner-azure-cleanup-action@0ee2f58fd46d10ac7f00bce4304b98db3dbdbe9a
        with:
          client_id: ${{ secrets.CD_CLIENT_ID }}
          tenant_id: ${{ secrets.TENANT_ID }}
          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
          resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }}
          runner_name: ${{ needs.create_runner.outputs.runner_name }}
          pat_token: ${{ secrets.BOT_TOKEN_GITHUB }}
  update_openapi:
    needs: [ deploy ]
    runs-on: ubuntu-latest
    name: Update OpenAPI
    if: ${{ inputs.target == inputs.environment || inputs.target == 'all' }}
    environment: ${{ inputs.environment }}
    steps:
      - name: Checkout
        id: checkout
        # from https://github.com/actions/checkout/commits/main
        uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707
        with:
          persist-credentials: false

      - name: Setup Terraform
        # from https://github.com/hashicorp/setup-terraform/commits/main
        uses: hashicorp/setup-terraform@8feba2b913ea459066180f9cb177f58a881cf146
        with:
          terraform_version: "1.3.6"

      - name: Login
        id: login
        # from https://github.com/Azure/login/commits/master
        uses: azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2
        with:
          client-id: ${{ secrets.CD_CLIENT_ID }}
          tenant-id: ${{ secrets.TENANT_ID }}
          subscription-id: ${{ secrets.SUBSCRIPTION_ID }}

      - name: Terraform Apply
        shell: bash
        run: |
          cd ./infra
          export ARM_CLIENT_ID="${{ secrets.CD_CLIENT_ID }}"
          export ARM_SUBSCRIPTION_ID=$(az account show --query id --output tsv)
          export ARM_TENANT_ID=$(az account show --query tenantId --output tsv)
          export ARM_USE_OIDC=true
          export ARM_ACCESS_KEY=$(az storage account keys list --resource-group io-infra-rg --account-name pagopainfraterraform${{inputs.environment}} --query '[0].value' -o tsv)
          bash ./terraform.sh init weu-${{ inputs.environment }}
          bash ./terraform.sh apply weu-${{ inputs.environment }} -auto-approve