IAM docs update, focus on roles and role-bindings (#1493) #990
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to Cloud Run | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| workflow_dispatch: | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write # federates with GCP | |
| steps: | |
| - name: 'Github Actions Runner' | |
| uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 | |
| with: | |
| egress-policy: audit | |
| - name: 'Checkout default branch to $GITHUB_WORKSPACE dir' | |
| uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3 | |
| - uses: actions/setup-node@2fddd8803e2f5c9604345a0b591c3020ee971a93 # v3 | |
| with: | |
| node-version: 16 | |
| - name: Update themes | |
| run: git submodule update --init --recursive | |
| - name: npm install | |
| run: npm install | |
| - name: npm run build | |
| run: npm run build | |
| - name: Authenticate to Google Cloud | |
| id: auth | |
| uses: google-github-actions/auth@ceee102ec2387dd9e844e01b530ccd4ec87ce955 # v0 | |
| with: | |
| token_format: 'access_token' | |
| project_id: '${{ secrets.PROJECT_ID }}' | |
| workload_identity_provider: '${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}' | |
| service_account: '${{ secrets.GCP_SERVICE_ACCOUNT }}' | |
| - name: Docker Auth | |
| id: docker-auth | |
| uses: 'docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a' # v2 | |
| with: | |
| username: 'oauth2accesstoken' | |
| password: '${{ steps.auth.outputs.access_token }}' | |
| registry: '${{ secrets.REGISTRY_URL }}' | |
| - name: Build and push | |
| uses: 'docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5' # v3 | |
| with: | |
| context: . | |
| push: true | |
| tags: '${{ secrets.REGISTRY_URL }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ secrets.SERVICE }}:${{ github.sha }}' | |
| # Attempt to deploy the terraform configuration | |
| - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v2.0.0 | |
| with: | |
| terraform_version: 1.6 | |
| - env: | |
| TF_VAR_image: '${{ secrets.REGISTRY_URL }}/${{ secrets.PROJECT_ID }}/${{ secrets.REPOSITORY }}/${{ secrets.SERVICE }}:${{ github.sha }}' | |
| TF_VAR_project_id: ${{ secrets.PROJECT_ID }} | |
| working-directory: ./iac | |
| run: | | |
| terraform init | |
| terraform plan | |
| terraform apply -auto-approve |