build-image-and-deploy-to-gce.yaml

# 當 release branch 有新的 commit 時：
# - build image 
# - 將 image push 至指定的 GCP Artifact Registry
# - 更新特定 GCE instance 中 container 所使用的 image
###########################################################
name: Build and Deploy to GCE

on:
  push:
    branches: [ "release" ]

env:
  # 聊天機器人的版本，每當升版時需要進行更新
  CHATBOT_VERSION: 1.2.2-recaptcha.0

  # GCP Project ID（Artifact Registry 和 GCE 都在同一個 project）
  PROJECT_ID: hiking-guard
  # GCP Workload Identity Federation Provider ID
  WORKLOAD_IDENTITY_PROVIDER: projects/126249437858/locations/global/workloadIdentityPools/line-chatbot-pool/providers/line-chatbot-provider
  # Service Account Email
  SERVICE_ACCOUNT: line-chatbot-github-cicd@hiking-guard.iam.gserviceaccount.com

  # Google Artifact Registry Location
  GAR_LOCATION: asia-east1
  # Artifact Registry Repository Name
  REPOSITORY: line-chatbot
  # Image Name
  IMAGE: hiking-bot

  # GCE Instance Zone
  INSTANCE_ZONE: 'asia-east1-b'
  # GCE Instance Name
  INSTANCE_NAME: 'line-bot'

jobs:
  setup-build-publish-deploy:
    name: Setup, Build, Publish, and Deploy
    runs-on: ubuntu-latest
    environment: production

    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
    - name: Checkout
      uses: actions/checkout@v3

    # Configure Workload Identity Federation and generate an access token.
    - id: 'auth'
      name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@v0'
      with:
        token_format: 'access_token'
        workload_identity_provider: ${{env.WORKLOAD_IDENTITY_PROVIDER}}
        service_account: ${{env.SERVICE_ACCOUNT}}

    # 安裝 gcloud
    - name: 'Set up Cloud SDK'
      uses: 'google-github-actions/setup-gcloud@v1'
      with:
        version: '>= 363.0.0'

    # Docker Login
    - name: Docker configuration
      run: |-
        echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://${{env.GAR_LOCATION}}-docker.pkg.dev

    # Build the Docker image
    - name: Build
      run: |-
        docker build \
          --tag "${{env.GAR_LOCATION}}-docker.pkg.dev/${{env.PROJECT_ID}}/${{env.REPOSITORY}}/${{env.IMAGE}}:${{env.CHATBOT_VERSION}}" \
          --build-arg GITHUB_SHA="$GITHUB_SHA" \
          --build-arg GITHUB_REF="$GITHUB_REF" \
          .

    # Push the Docker image to Google Artifact Registry
    - name: Publish
      run: |-
        docker push "${{env.GAR_LOCATION}}-docker.pkg.dev/${{env.PROJECT_ID}}/${{env.REPOSITORY}}/${{env.IMAGE}}:${{env.CHATBOT_VERSION}}"

    # Update GCE
    - name: Deploy
      run: |-
        gcloud compute instances update-container "projects/${{env.PROJECT_ID}}/zones/${{env.INSTANCE_ZONE}}/instances/${{env.INSTANCE_NAME}}" \
          --container-image ${{env.GAR_LOCATION}}-docker.pkg.dev/${{env.PROJECT_ID}}/${{env.REPOSITORY}}/${{env.IMAGE}}:${{env.CHATBOT_VERSION}}