deploy.yaml

# Copyright 2024 The Sigstore Authors
# SPDX-License-Identifier: Apache-2.0

name: deploy-terraform

on:
  push:
    branches:
      - "main"
  workflow_dispatch:

concurrency: deploy

jobs:
  deploy:
    runs-on: ubuntu-latest

    if: github.repository == 'sigstore/sigstore-devops-tools'

    permissions:
      contents: read  # clone the repository contents
      id-token: write # federates with GCP

    steps:
    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
    - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
      with:
        go-version: '1.22'
        check-latest: true

    - uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2.1.6
      id: auth
      with:
        workload_identity_provider: "projects/801815070094/locations/global/workloadIdentityPools/tooling-pool/providers/github-actions-provider"
        service_account: "github-actions@sigstore-support-tooling.iam.gserviceaccount.com"

    # Attempt to deploy the terraform configuration
    - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v2.0.0
      with:
        terraform_version: 1.8

    - working-directory: ./iac
      run: |
        terraform init

        terraform plan -out=plan.out

        terraform apply -auto-approve "plan.out"

    - uses: rtCamp/action-slack-notify@4e5fb42d249be6a45a298f3c9543b111b02f7907 # v2.3.0
      if: ${{ failure() }}
      env:
        SLACK_ICON: http://github.com/chainguard-dev.png?size=48
        SLACK_USERNAME: guardian
        SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
        SLACK_CHANNEL: 'sigstore-devops-tools-alerts' # Use a channel
        SLACK_COLOR: '#8E1600'
        MSG_MINIMAL: 'true'
        SLACK_TITLE: Deploying sigstore-devops-tools failed
        SLACK_MESSAGE: |
          For detailed logs: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}