docker-e2e-deploy.yml

name: Docker | E2E | Deployment

on: push

jobs:
  build-and-push-images:
    strategy:
      matrix:
        folder: [authentik, backend, frontend, presenter]
    runs-on: ubuntu-latest
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository }}/${{ matrix.folder }}
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.1.7
      - name: Log in to the Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@70b2cdc6480c1a8b86edf1777157f8f437de2166
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=schedule
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=ref,event=branch
            type=ref,event=pr
            type=sha
      - name: Build and push Docker images
        id: push
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
        with:
          context: ${{ matrix.folder }}
          target: production
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      # This will clutter our packages. I think it's fine to leave that out:
      # https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
      #
      # - name: Generate artifact attestation
      #   uses: actions/attest-build-provenance@210c1913531870065f03ce1f9440dd87bc0938cd # v1.4.0
      #   with:
      #     subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
      #     subject-digest: ${{ steps.push.outputs.digest }}
      #     push-to-registry: true

  e2e-tests:
    name: Run all E2E tests
    runs-on: ubuntu-latest
    needs: build-and-push-images
    steps:
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.1.7
      - uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.3
        with:
          node-version-file: './.tool-versions'
      - run: echo "IMAGE_TAG=sha-$(echo $GITHUB_SHA | cut -c 1-7)" > .env
      - run: touch backend/.env # docker-compose requires `env_file:` to be present https://github.com/docker/compose/issues/3560
      - run: docker compose -f docker-compose.yml up -d --wait --quiet-pull
      - name: Install cucumber-json-formatter
        run: |
          wget --no-verbose -O /opt/cucumber-json-formatter "https://github.com/cucumber/json-formatter/releases/download/v19.0.0/cucumber-json-formatter-linux-386"
          chmod +x /opt/cucumber-json-formatter
          sudo ln -fs /opt/cucumber-json-formatter /usr/bin/cucumber-json-formatter
      - name: E2E | Run all tests
        id: e2e-run
        uses: cypress-io/github-action@0da3c06ed8217b912deea9d8ee69630baed1737e # v6.7.2
        with:
          working-directory: tests
      - name: E2E | if tests failed, compile html report
        if: ${{ failure() && steps.e2e-run.conclusion == 'failure' }}
        run: |
          cd cypress/
          npx tsx create-cucumber-html-report.ts
        working-directory: tests
      - name: Get PR number
        if: ${{ failure() && steps.e2e-run.conclusion == 'failure' }}
        uses: jwalton/gh-find-current-pr@89ee5799558265a1e0e31fab792ebb4ee91c016b # v1.3.3
        id: pr-number
      - name: E2E | if tests failed, upload report
        if: ${{ failure() && steps.e2e-run.conclusion == 'failure' }}
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: dreammall-e2e-test-report-pr-${{ steps.pr-number.outputs.pr }}
          path: /home/runner/work/dreammall.earth/dreammall.earth/tests/cypress/reports/dreammall-e2e_html_report

  deploy-to-kubernetes:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/master'
    needs: build-and-push-images
    steps:
      - uses: mdgreenwald/mozilla-sops-action@d9714e521cbaecdae64a89d2fdd576dd2aa97056 # v1.6.0
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.1.7
      - run: |
          mkdir -p ~/.config/sops/age
          echo $SOPS_KEY | base64 --decode > ~/.config/sops/age/keys.txt
        env:
          SOPS_KEY: ${{ secrets.SOPS_KEY }}
      - run: |
          mkdir -p ~/.kube
          sops decrypt ./infrastructure/helmfile/secrets/kubeconfig > ~/.kube/config
      - run: echo "IMAGE_TAG=sha-$(echo $GITHUB_SHA | cut -c 1-7)" >> $GITHUB_ENV
      - uses: helmfile/helmfile-action@80fbb6408b98822310f94d8d1321a2cacf87f78f #v1.9.2
        with:
          helmfile-args: apply --environment master
          helmfile-workdirectory: ./infrastructure/helmfile
          helm-plugins: >
            https://github.com/databus23/helm-diff,
            https://github.com/jkroepke/helm-secrets