build-and-deploy.yml

name: Docker build & deploy

on:
  push:
    branches:
      - master

env:
  GHCR_IMAGE_TAG: ghcr.io/${{ github.repository_owner }}/se2gha
  GCP_PROJECT_ID: vvakame-playground
  GCP_IMAGE_TAG:  gcr.io/vvakame-playground/se2gha:commit_${{ github.sha }}
  GCP_REGION:     us-central1
  SERVICE_NAME:   se2gha

jobs:
  deploy:
    name: Docker build & deploy
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v3

      - run: |
          docker build . --tag $GHCR_IMAGE_TAG

      - uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          # se2gha-ghcr-write
          password: ${{ secrets.DOCKER_CR_PAT }}
      - name: Push tagged image to GitHub Container Registry
        run: |
          docker push $GHCR_IMAGE_TAG

      - uses: google-github-actions/setup-gcloud@v1
        with:
          version: "417.0.0"
      - uses: google-github-actions/auth@v1
        with:
          workload_identity_provider: projects/381521917100/locations/global/workloadIdentityPools/github-actions/providers/gha-provider
          service_account: se2gha-deployer@vvakame-playground.iam.gserviceaccount.com
          access_token_lifetime: 1200s
      - name: Push tagged image to Google Container Registry
        run: |
          gcloud auth configure-docker
          docker tag $GHCR_IMAGE_TAG $GCP_IMAGE_TAG
          docker push $GCP_IMAGE_TAG
      - name: Deploy
        run: |-
          gcloud run deploy "${SERVICE_NAME}" \
              --project "${GCP_PROJECT_ID}" \
              --region "${GCP_REGION}" \
              --image "${{ env.GCP_IMAGE_TAG }}" \
              --platform managed \
              --allow-unauthenticated \
              --no-traffic \
              --set-env-vars "GOOGLE_CLOUD_PROJECT=${GCP_PROJECT_ID}" \
              --set-env-vars "SLACK_ACCESS_TOKEN=${{ secrets.SLACK_ACCESS_TOKEN }}" \
              --set-env-vars "SLACK_SIGNING_SECRET=${{ secrets.SLACK_SIGNING_SECRET }}" \
              --set-env-vars "GHA_REPO_TOKEN=${{ secrets.GHA_REPO_TOKEN }}" \
              --set-env-vars "GHA_REPOS=${{ secrets.GHA_REPOS }}" \
              --quiet
      - name: Release
        run: |-
          gcloud run services update-traffic "${SERVICE_NAME}" \
              --to-latest \
              --region "${GCP_REGION}" \
              --platform managed \
              --quiet