build-deploy-release.yaml

name: Build and Deploy on Release

on:
  release:
    types: [ released ]

env:
  TAG: ${{ github.event.release.tag_name }}

jobs:
  build-production:
    name: Build production ${{ github.event.release.tag_name }}
    uses: mlibrary/platform-engineering-workflows/.github/workflows/build-production.yml@v1
    with:
      image_name: ${{ vars.IMAGE_NAME }}
      tag: ${{ github.event.release.tag_name }}
      dockerfile: Dockerfile
    secrets: inherit

  #scan-image:
    #needs: build-production
    #runs-on: ubuntu-latest
    #steps:
      #- name: Run Trivy vulnerability scanner
        #uses: aquasecurity/trivy-action@master
        #with:
          #image-ref: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.release.tag_name }}
          #format: 'table'
          #exit-code: '1'
          #ignore-unfixed: true
          #vuln-type: 'os,library'
          #severity: 'CRITICAL,HIGH'

  
  deploy-production:
    needs: build-production
    name: Deploy to production
    uses: mlibrary/platform-engineering-workflows/.github/workflows/deploy.yml@v1
    with:
      image: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.release.tag_name }}
      file: environments/browse/production/web-image.txt
      CONFIG_REPO_RW_APP_ID: ${{ vars.CONFIG_REPO_RW_APP_ID }}
      CONFIG_REPO_FULL_NAME: ${{ vars.CONFIG_REPO_FULL_NAME }}
    secrets: inherit