release.yml

name: Release ROR Webapp

on:
  push:
    tags:
      - 'v*'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: norskhelsenett/ror-webapp
  APP: ror-webapp

jobs:
  setenv:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    outputs:
      rorversion: ${{ steps.env.outputs.ROR_VERSION }}
      shortsha: ${{ steps.env.outputs.SHA_SHORT }}
    steps:
      - uses: actions/checkout@v3
      - id: env
        name: Set env
        run: |
          echo "ROR_VERSION=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
          echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"

  build-ror-webapp-container-image:
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    needs: setenv

    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - uses: actions/checkout@v3
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
        with:
          cosign-release: 'v2.2.4'
      - name: Install jq
        uses: dcarbone/install-jq-action@v3.0.1

      - name: Use node.js
        uses: actions/setup-node@v3
        with:
          node-version: '22.x'
      - name: Build webapp
        run: |
          echo "Building ${{ env.APP }} ${{ needs.setenv.outputs.rorversion}} (${{ needs.setenv.outputs.shortsha}})"
      - run: mv package.json package-backup.json
      - run: jq --arg rorversion ${{ needs.setenv.outputs.rorversion}} --arg shortsha ${{ needs.setenv.outputs.shortsha}} '.version = $rorversion | .commit = $shortsha' package-backup.json > package.json
      - run: npm ci
      - run: npm run build:prod

      # Set up BuildKit Docker container builder to be able to build
      # multi-platform images and export cache
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=latest
            type=raw,value=${{ needs.setenv.outputs.rorversion }}

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Sign the resulting Docker image digest except on PRs.
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        if: ${{ github.event_name != 'pull_request' }}
        env:
          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

  publish-helm:
    if: github.ref_type == 'tag'
    runs-on: ubuntu-latest
    needs:
      - setenv
      - build-ror-webapp-container-image
    steps:
      - uses: actions/checkout@v3

      - name: Install helm
        uses: azure/setup-helm@v1
        with:
          version: v3.16.4
      - name: install-yq
        run: |
          wget https://github.com/mikefarah/yq/releases/download/${VERSION}/${BINARY}.tar.gz -O - | tar xz && mv ${BINARY} yq && chmod +x yq
        env:
          VERSION: v4.44.5
          BINARY: yq_linux_amd64
      - name: Build helm chart
        run: |
          export HELM_VERSION=${ROR_VERSION#v*}
          ./yq e -i '.version = strenv(HELM_VERSION),.appVersion = strenv(ROR_VERSION)' charts/${{ env.APP }}/Chart.yaml
          ./yq e -i '.image.tag = strenv(ROR_VERSION),.image.repository = "ghcr.io/norskhelsenett/${{ env.APP }}"' charts/${{ env.APP }}/values.yaml
          helm package charts/${{ env.APP }}
          echo  ${{ secrets.GITHUB_TOKEN }} | helm registry login -u ${{ github.actor }} ${{ env.REGISTRY }} --password-stdin
          helm push ${{ env.APP }}-${HELM_VERSION}.tgz oci://${{ env.REGISTRY }}/norskhelsenett/helm/
        env:
          ROR_VERSION: ${{ needs.setenv.outputs.rorversion }}