flytter permissions

.github/workflows/master.yml

@@ -6,89 +6,81 @@ on:
       - master
 
 env:
-  IMAGE: ghcr.io/${{ github.repository }}:${{ github.sha }}
+  APP: medlemskap-oppslag
+permissions:
+  contents: "read"
+  id-token: "write"
+  packages: "write"
 jobs:
-  build:
+  build_and_push:
+    name: Build and publish Docker image for PR-branch
     runs-on: ubuntu-latest
-    permissions:
-      packages: write
+    env:
+      IMAGE: ghcr.io/${{ github.repository }}:${{ github.sha }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@master
-      - name: Cache
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Set up Java
+        uses: actions/[email protected]
+        with:
+          java-version: '20'
+          distribution: 'temurin'
+          check-latest: true
+      - name: Cache gradle dependencies
         uses: actions/cache@v4
         with:
           path: ~/.gradle/caches
           key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle.kts') }}
           restore-keys: |
             ${{ runner.os }}-gradle-
-      - name: Set up JDK 20
-        uses: actions/[email protected]
-        with:
-          distribution: 'adopt'
-          java-version: '20'
-          check-latest: true
-          cache: 'gradle'
-      - name: Bygg med gradle
-        run: ./gradlew test shadowJar
+      - name: Build with Gradle
+        run: ./gradlew test shadowJar --info
         env:
           ORG_GRADLE_PROJECT_githubUser: x-access-token
           ORG_GRADLE_PROJECT_githubPassword: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build docker image
-        run: docker build -t $IMAGE .
-      - name: Login to Github package registry
-        run: docker login ghcr.io -u ${GITHUB_REPOSITORY} -p ${GITHUB_TOKEN}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Push docker image
-        run: docker push $IMAGE
-      - name: Post failures to Slack
-        if: failure()
-        run: |
-          curl -X POST --data-urlencode "payload={\"channel\": \"$CHANNEL\", \"text\": \"$MESSAGE\", \"icon_emoji\": \":ghost:\"}" $WEBHOOK_URL
-        env:
-          MESSAGE: "Bygg feilet"
-          CHANNEL: "#team-p3-medlemskap-notifications"
-          WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}
+      - uses: nais/docker-build-push@v0
+        id: docker-push
+        with:
+          team: medlemskap # required
+          project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }} # required, but is defined as an organization variable
+          identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }} # required, but is defined as an organization secret
+    outputs:
+      image: ${{ steps.docker-push.outputs.image }}
+
   deploypreprod:
-    name: Deploy to Preprod
-    needs: build
-    if: github.ref == 'refs/heads/master'
+    name: Deploy to to production
+    needs: [build_and_push]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
-        name: Checkout code
-      - uses: nais/deploy/actions/deploy@master
+      - uses: actions/checkout@v4
+      - uses: nais/deploy/actions/deploy@v2
         env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_API_KEY }}
+          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
           CLUSTER: dev-gcp
           RESOURCE: deploy/preprod.yaml
-      - name: Post failures to Slack
-        if: failure()
-        run: |
-          curl -X POST --data-urlencode "payload={\"channel\": \"$CHANNEL\", \"text\": \"$MESSAGE\", \"icon_emoji\": \":ghost:\"}" $WEBHOOK_URL
-        env:
-          MESSAGE: "Deploy til preprod feilet"
-          CHANNEL: "#team-p3-medlemskap-notifications"
-          WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}
+          IMAGE: ${{ needs.build_and_push.outputs.image }}
+          TELEMETRY: ${{ needs.build_and_push.outputs.telemetry }}
   deployprod:
-    name: Deploy to Prod
-    needs: deploypreprod
-    if: github.ref == 'refs/heads/master'
+    name: Deploy PR-branch to dev
+    needs: [ build_and_push ]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
-        name: Checkout code
-      - uses: nais/deploy/actions/deploy@master
+      - uses: actions/checkout@v4
+      - uses: nais/deploy/actions/deploy@v2
         env:
-          APIKEY: ${{ secrets.NAIS_DEPLOY_API_KEY }}
+          APIKEY: ${{ secrets.NAIS_DEPLOY_APIKEY }}
           CLUSTER: prod-gcp
           RESOURCE: deploy/prod.yaml
+          IMAGE: ${{ needs.build_and_push.outputs.image }}
+          TELEMETRY: ${{ needs.build_and_push.outputs.telemetry }}
       - name: Post failures to Slack
         if: failure()
         run: |
-          curl -X POST --data-urlencode "payload={\"channel\": \"$CHANNEL\", \"text\": \"$MESSAGE\", \"icon_emoji\": \":ghost:\"}" $WEBHOOK_URL
-        env:
-          MESSAGE: "Deploy til prod feilet"
-          CHANNEL: "#team-p3-medlemskap-notifications"
-          WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}
+            curl -X POST --data-urlencode "payload={\"channel\": \"$CHANNEL\", \"text\": \"$MESSAGE\", \"icon_emoji\": \":ghost:\"}" $WEBHOOK_URL
+          env:
+            MESSAGE: "Deploy til prod feilet"
+            CHANNEL: "#team-p3-medlemskap-notifications"
+            WEBHOOK_URL: ${{ secrets.WEBHOOK_URL }}