cd-staging.yaml

name: Deployment (Staging)

on:
  workflow_run:
    workflows: ["Release Image (Staging)"]
    branches:
      - main
    types:
      - completed

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    environment:
      name: staging
      url: https://staging.api.basedosdados.org

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          ref: main

      - name: Import secrets from Vault
        id: import_secrets
        uses: hashicorp/vault-action@v2.4.1
        with:
          url: https://vault.basedosdados.org
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            secret/data/gcp_credentials/basedosdados-dev GCP_PROJECT_ID   | GCP_PROJECT_ID ;
            secret/data/gcp_credentials/basedosdados-dev GH_ACTIONS_SA    | GCP_SA ;
            secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_NAME | GKE_CLUSTER_NAME ;
            secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_ZONE | GKE_CLUSTER_ZONE ;

      - name: Setup Google Cloud CLI
        uses: google-github-actions/setup-gcloud@v0.2.1
        with:
          service_account_key: ${{ steps.import_secrets.outputs.GCP_SA }}
          project_id: ${{ steps.import_secrets.outputs.GCP_PROJECT_ID }}
          export_default_credentials: true

      - name: Get GKE credentials
        uses: google-github-actions/get-gke-credentials@v0.2.1
        with:
          cluster_name: ${{ steps.import_secrets.outputs.GKE_CLUSTER_NAME }}
          location: ${{ steps.import_secrets.outputs.GKE_CLUSTER_ZONE }}
          credentials: ${{ steps.import_secrets.outputs.GCP_SA }}

      - name: Write values.yaml file
        run: |
          cat << EOF > values.yaml
          environment: "staging"
          api:
            name: "api-staging"
            image:
              name: "ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}"
              tag: "staging"
              pullPolicy: "Always"
            replicas: 1
            resources:
              limits:
                cpu: 500m
                memory: 1Gi
              requests:
                cpu: 250m
                memory: 500Mi
            env:
              - name: "BASE_URL_FRONTEND"
                value: "https://staging.basedosdados.org"
              - name: "BASE_URL_API"
                value: "https://staging.api.basedosdados.org"
              - name: "REDIS_DB"
                value: "0"
              - name: "STRIPE_LIVE_SECRET_KEY"
                value: "${{ secrets.STRIPE_LIVE_SECRET_KEY }}"
              - name: "STRIPE_TEST_SECRET_KEY"
                value: "${{ secrets.STRIPE_TEST_SECRET_KEY }}"
              - name: "DJSTRIPE_WEBHOOK_SECRET"
                value: "${{ secrets.DJSTRIPE_WEBHOOK_SECRET }}"
            envFrom:
              - secretRef:
                  name: api-staging-secrets
            settingsModule: "bd_api.settings.remote"
          database:
            host: "cloud-sql-proxy"
            port: 5432
            name: "api_staging"
            user: "api_staging"
            passwordSecret: "api-staging-database-password"
          ingress:
            enabled: true
            host: "staging.api.basedosdados.org"
            annotations:
              kubernetes.io/ingress.class: nginx
              nginx.ingress.kubernetes.io/rewrite-target: /
              cert-manager.io/issuer: "letsencrypt-production"
              nginx.ingress.kubernetes.io/ssl-redirect: "true"
            tls:
              - hosts:
                  - staging.api.basedosdados.org
                secretName: staging-api-basedosdados-org-tls
          EOF

      - name: Deploy using Helm
        run: |
          helm upgrade --install api-staging charts/basedosdados-api/. -n website -f values.yaml --wait