main.yaml

name: Build and deploy lydia-api
on: [ push ]

permissions: {}

jobs:
  build:
    permissions:
      contents: write
      id-token: write
    name: build
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 21
      - uses: gradle/actions/setup-gradle@v4
        with:
          dependency-graph: generate-and-submit
      - name: Compile, run tests and build
        run: ./gradlew build
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: linux/amd64,linux/arm64
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push docker image
        uses: nais/docker-build-push@v0
        id: docker-push
        with:
          team: pia
          tag: ${{ github.ref == 'refs/heads/main' && 'latest' || 'branch_latest' }}
          project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
          identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
          platforms: linux/amd64,linux/arm64
    outputs:
      image: ${{ steps.docker-push.outputs.image }}

  deploy:
    permissions:
      id-token: write
    strategy:
      matrix:
        cluster: [dev, prod]
    name: Deploy app to ${{ matrix.cluster }}
    needs: build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy application to ${{ matrix.cluster }}
        uses: nais/deploy/actions/deploy@v2
        env:
          IMAGE: ${{ needs.build.outputs.image }}
          CLUSTER: ${{ matrix.cluster }}-gcp
          RESOURCE: .nais/nais.yaml
          VARS: .nais/${{ matrix.cluster }}.yaml

  deploy-dev-branch:
    permissions:
      id-token: write
    name: Deploy app to dev
    needs: build
    if: github.ref == 'refs/heads/sende-melding-til-sf-ved-flytt-behovsv'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy application to dev
        uses: nais/deploy/actions/deploy@v2
        env:
          IMAGE: ${{ needs.build.outputs.image }}
          CLUSTER: dev-gcp
          RESOURCE: .nais/nais.yaml
          VARS: .nais/dev.yaml

  trivy-scan:
    name: Scanner docker image med Trivy
    if: github.ref == 'refs/heads/main'
    needs: build
    permissions:
      contents: read # to write sarif
      security-events: write # push sarif to GitHub security
      id-token: write # for nais/login
    runs-on: ubuntu-latest
    steps:
      - uses: navikt/pia-actions/trivy-scan@v1 # https://github.com/navikt/pia-actions/tree/main/trivy-scan
        with:
          image: ${{ needs.build.outputs.image }}
          team: pia
          project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
          identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}