build-and-deploy-gcp.yml

name: Build and deploy to prod gcp
on:
    push:
        paths-ignore:
            - '**.md'
            - '.gitignore'
            - 'LICENCE'
            - 'CODEOWNERS'
            - 'nais/proxy/*'
        branches:
            - master
jobs:
    lint:
        uses: ./.github/workflows/lint.yml
        secrets:
            READER_TOKEN: ${{ secrets.READER_TOKEN }}
    test:
        uses: ./.github/workflows/test.yml
        secrets:
            READER_TOKEN: ${{ secrets.READER_TOKEN }}
    test-cypress:
        uses: ./.github/workflows/cypress-tester.yml
        secrets:
            READER_TOKEN: ${{ secrets.READER_TOKEN }}
    build:
        uses: ./.github/workflows/build.yml
        secrets:
            READER_TOKEN: ${{ secrets.READER_TOKEN }}
    deploy:
        name: Deploye til PROD
        runs-on: ubuntu-latest
        permissions:
            contents: read
            id-token: write
        needs: [lint, test, test-cypress, build]
        outputs:
            image: ${{ steps.docker-push.outputs.image }}
        steps:
            - name: Hente kode
              uses: actions/checkout@v4

            - name: Setup .yarnrc.yml
              run: |
                  yarn config set npmScopes.navikt.npmRegistryServer "https://npm.pkg.github.com"
                  yarn config set npmScopes.navikt.npmAlwaysAuth true
                  yarn config set npmScopes.navikt.npmAuthToken $NPM_AUTH_TOKEN
              env:
                  NPM_AUTH_TOKEN: ${{ secrets.READER_TOKEN }}

            - name: Sette opp Node
              uses: actions/setup-node@v4
              with:
                  node-version: 18.x
                  registry-url: https://npm.pkg.github.com/
                  scope: '@navikt'

            - uses: actions/download-artifact@v4
              with:
                  name: dist
                  path: ./dist

            - name: Installere moduler
              run: yarn workspaces focus @k9-punsj-frontend/server --production
              env:
                  NODE_AUTH_TOKEN: ${{ secrets.READER_TOKEN }}

            - name: Opprett release med Sentry
              run: yarn sentry-release
              env:
                  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}

            - uses: nais/docker-build-push@v0
              id: docker-push
              with:
                  tag: 'latest'
                  team: k9saksbehandling
                  project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
                  identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}

            - name: Sett image for nais deploy
              run: |
                  echo "IMAGE=${{steps.docker-push.outputs.image}}" >> $GITHUB_OUTPUT
                  echo "IMAGE=${{steps.docker-push.outputs.image}}" >> $GITHUB_ENV

            - name: Deploye til prod gcp
              uses: nais/deploy/actions/deploy@v2
              env:
                  CLUSTER: prod-gcp
                  RESOURCE: nais/k9-punsj-frontend.yml
                  VARS: nais/prod-gcp.yml
    trivy:
        needs: [deploy]
        uses: navikt/sif-gha-workflows/.github/workflows/trivy.yml@main
        permissions:
            contents: write
            security-events: write
            actions: read
            id-token: write
        secrets: inherit
        with:
            team: k9saksbehandling
            image: ${{ needs.deploy.outputs.image }}