website.yml

name: Website - Test, Build, and Deploy to GCP

on:
  push:
    paths:
      - 'src/website/**'
      - '.github/workflows/website.yml'
      - '.github/actions/website/**'
      - 'src/common/**'

defaults:
  run:
    working-directory: src/website

permissions:
  id-token: write
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version-file: src/website/.node-version
      - run: |
          npm ci
          cd ../common && npm ci

      - name: Test
        run: |
          npm run lint

  deploy-staging:
    name: Build, and Deploy to Staging
    runs-on: ubuntu-latest
    needs: test
    environment:
      name: Staging
    if: github.ref == 'refs/heads/staging'

    steps:
      - name: 🚀 Deploy
        uses: agrc/cloud-run-docker-deploy-composite-action@v2
        with:
          docker-context: ./src
          docker-file: ./src/website/Dockerfile
          identity-provider: ${{ secrets.IDENTITY_PROVIDER }}
          service-account-email: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}
          project-id: ${{ secrets.PROJECT_ID }}
          service: website
          flags: |
            --service-account=cloud-run-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
            --min-instances=0
            --allow-unauthenticated

  deploy-prod:
    name: Build, and Deploy to Production
    runs-on: ubuntu-latest
    needs: test
    environment:
      name: Production
    if: github.ref == 'refs/heads/production'

    steps:
      - name: 🚀 Deploy
        uses: agrc/cloud-run-docker-deploy-composite-action@v2
        with:
          docker-context: ./src
          docker-file: ./src/website/Dockerfile
          identity-provider: ${{ secrets.IDENTITY_PROVIDER }}
          service-account-email: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}
          project-id: ${{ secrets.PROJECT_ID }}
          service: website
          flags: |
            --service-account=cloud-run-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
            --min-instances=1
            --allow-unauthenticated