build.yml

name: build

on:
  push:
    branches:
      - master
      - "deploy/**"

  pull_request:
    types:
      - opened
      - synchronize
      - reopened

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: ruby/setup-ruby@v1
        with:
          bundler-cache: true

      - run: bundle exec rspec
      - run: bundle exec functions-framework-ruby --verify --verbose --target regional-rb-calendar

      - name: Integration test
        run: |
          set -xe
          bundle exec functions-framework-ruby --target regional-rb-calendar &
          
          # FIXME: Wait for booting
          sleep 3

          # Check status code
          curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/api/calendar/doorkeeper.ics | grep "200"

          pid=$(jobs -l | grep functions-framework-ruby | awk '{print $2}')
          kill -9 $pid

      - name: Slack Notification
        uses: act10ns/slack@v2
        if: always()
        continue-on-error: true
        with:
          status: ${{ job.status }}
          webhook-url: ${{ secrets.SLACK_WEBHOOK }}

  deploy:
    needs:
      - test

    if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/deploy/')

    env:
      # e.g. projects/123456789/locations/global/workloadIdentityPools/github-actions/providers/github-actions
      WORKLOAD_IDENTITY_PROVIDER: "projects/238873626137/locations/global/workloadIdentityPools/regional-rb-calendar/providers/github-actions"

      # e.g. terraform@GCP_PROJECT_ID.iam.gserviceaccount.com
      SERVICE_ACCOUNT_EMAIL: "deployer@regional-rb-calendar-2.iam.gserviceaccount.com"

    environment: production
    concurrency: production

    permissions:
      contents: read
      id-token: write

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - id: auth
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.SERVICE_ACCOUNT_EMAIL }}

      - name: GCP Authenticate
        uses: google-github-actions/setup-gcloud@v2
        with:
          version: latest
          project_id: ${{ env.GCP_PROJECT }}

      - name: Add credential path to .gcloudignore
        run: |
          # e.g.
          # CREDENTIAL_FILE_PATH: /home/runner/work/regional-rb-calendar/regional-rb-calendar/a08afad6ea60285b8fd69e2e
          # GITHUB_WORKSPACE: /home/runner/work/regional-rb-calendar/regional-rb-calendar
          # After: a08afad6ea60285b8fd69e2e
          echo $CREDENTIAL_FILE_PATH | sed -e "s#${GITHUB_WORKSPACE}/##g" >> .gcloudignore
        env:
          CREDENTIAL_FILE_PATH: ${{ steps.auth.outputs.credentials_file_path }}

      - name: Deploy function
        run: |
          gcloud functions deploy regional-rb-calendar \
            --trigger-http --allow-unauthenticated \
            --gen2 \
            --region=asia-northeast1 \
            --memory=128Mi \
            --runtime=ruby33 \
            --timeout=15s \
            --vpc-connector main \
            --egress-settings all \
            --set-env-vars=GCP_PROJECT=${GCP_PROJECT},RACK_ENV=production,SENTRY_RELEASE=${GITHUB_SHA} \
            --set-secrets=SENTRY_DSN=SENTRY_DSN:latest,DOORKEEPER_ACCESS_TOKEN=DOORKEEPER_ACCESS_TOKEN:latest \
            --run-service-account=function@regional-rb-calendar-2.iam.gserviceaccount.com

      - name: Slack Notification
        uses: act10ns/slack@v2
        if: always()
        continue-on-error: true
        with:
          status: ${{ job.status }}
          webhook-url: ${{ secrets.SLACK_WEBHOOK }}