deploy.yaml

name: Deploy

on:
  repository_dispatch:
    types:
      - HelmRelease/mirror.*

permissions:
  contents: write
  pull-requests: write

defaults:
  run:
    shell: bash

env:
  LC_ALL: C.UTF-8

jobs:
  deploy:
    name: Deploy
    runs-on: [self-hosted, Linux, large, ephemeral]
    if: github.event.client_payload.severity == 'info'
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit

      - name: Checkout Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: deploy
          token: ${{ secrets.HEDERA_BOT_TOKEN }}

      - name: Install yq
        env:
          BINARY: yq_linux_amd64
          TARGET: /home/runner/.local/bin
          VERSION: v4.44.2
        run: |
          mkdir -p "${TARGET}"
          curl -sL https://github.com/mikefarah/yq/releases/download/${VERSION}/${BINARY}.tar.gz --output - | tar -xvz "${BINARY}"
          mv ${BINARY} "${TARGET}/yq"
        working-directory: ${{ env.RUNNER_TEMP }}

      - name: Get chart version
        id: release
        run: |
          VERSION=$(echo ${{ github.event.client_payload.metadata.revision }} | cut -d '+' -f1)
          echo VERSION=${VERSION} >> $GITHUB_OUTPUT

      - name: Set chart version in HelmRelease
        env:
          CHART_VERSION: ${{ steps.release.outputs.version }}
          CLUSTER: ${{ github.event.client_payload.metadata.cluster }}
          NAMESPACES: ${{ github.event.client_payload.metadata.namespaces }}
        run: |
          for namespace in $(echo "${NAMESPACES}" | tr "," "\n"); do
            yq eval '.spec.chart.spec.version=env(CHART_VERSION)' -i "./clusters/${CLUSTER}/${namespace}/helmrelease.yaml"
          done

      - name: Import GPG Key
        id: gpg_importer
        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
        with:
          git_commit_gpgsign: true
          git_tag_gpgsign: true
          git_user_signingkey: true
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Open deployment PR
        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
        with:
          author: ${{ steps.gpg_importer.outputs.name }} <${{ steps.gpg_importer.outputs.email }}>
          body: Deploy v${{ steps.release.outputs.version }} to ${{ github.event.client_payload.metadata.namespaces }} in ${{ github.event.client_payload.metadata.cluster }}
          branch: deploy-${{ github.event.client_payload.metadata.cluster }}-${{ steps.release.outputs.version }}
          commit-message: Deploy v${{ steps.release.outputs.version }} to ${{ github.event.client_payload.metadata.namespaces }} in ${{ github.event.client_payload.metadata.cluster }}
          committer: ${{ steps.gpg_importer.outputs.name }} <${{ steps.gpg_importer.outputs.email }}>
          delete-branch: true
          signoff: true
          title: Deploy v${{ steps.release.outputs.version }} to ${{ github.event.client_payload.metadata.cluster }}
          token: ${{ secrets.HEDERA_BOT_TOKEN }}