api.yaml

name: Build & Deploy Spring Boot API [api]

on:
  push:
    branches: [ "main" ]
    paths:
      - 'api/**'
  workflow_dispatch:
    

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: arnaublanch/setlist-to-playlist-api


jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
    outputs:
      IMAGE_VERSION: ${{ steps.tag_version.outputs.new_version }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3    
      - name: Install cosign
        uses: sigstore/cosign-installer@df6c89e679716101b2628c1c3cd997f7626f27b8 #v2.8.1
        with:
          cosign-release: 'v1.13.1'
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325
      - name: Setup Java 17
        uses: actions/setup-java@v3
        with:
          distribution: temurin
          java-version: 17
      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Bump version and push tag
        id: tag_version
        uses: mathieudutour/github-tag-action@v6.1
        with:
          tag_prefix: api-v
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Create a GitHub release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.tag_version.outputs.new_tag }}
          name: ${{ steps.tag_version.outputs.new_tag }}
          body: ${{ steps.tag_version.outputs.changelog }}
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}},value=${{ steps.tag_version.outputs.new_version }}
            type=sha,enable=false
          flavor: |
            latest=true
            
      - name: Gradle Build
        run: |
          cd api
          gradle build
        
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5
        with:
          context: api
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Sign the published Docker image
        env:
          COSIGN_EXPERIMENTAL: "true"
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
        
  release:
    runs-on: ubuntu-latest
    needs: build
    environment: Production
    steps:
      - name: Deploy to Dokku
        uses: dokku/github-action@master
        with:
          git_remote_url: 'ssh://dokku@${{ secrets.DOKKU_HOST }}:22/${{ secrets.API_APP_NAME }}'
          ssh_private_key: ${{ secrets.SSH_PRIVATE_KEY }}
          deploy_docker_image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build.outputs.IMAGE_VERSION }}