deploy.yml

name: Deploy
on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write
  attestations: write

env:
  PROJECT_ID: casecomp-495718
  SERVICE: casecomp-api
  IMAGE: us-docker.pkg.dev/casecomp-495718/casecomp-api/app

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.digest.outputs.digest }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
        with:
          workload_identity_provider: projects/129850122606/locations/global/workloadIdentityPools/github-pool/providers/github-provider
          service_account: casecomp-deploy@casecomp-495718.iam.gserviceaccount.com

      - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3

      - name: Build and push
        run: |
          BUILD_ID=$(gcloud builds submit \
            --config=cloudbuild.yml \
            --project ${{ env.PROJECT_ID }} \
            --async \
            --format='value(id)' .)
          echo "Waiting for build $BUILD_ID..."
          while true; do
            STATUS=$(gcloud builds describe $BUILD_ID --project ${{ env.PROJECT_ID }} --format='value(status)' 2>/dev/null)
            echo "  status: $STATUS"
            case "$STATUS" in
              SUCCESS) break ;;
              FAILURE|TIMEOUT|CANCELLED|INTERNAL_ERROR) echo "Build failed: $STATUS"; exit 1 ;;
              *) sleep 15 ;;
            esac
          done

      - name: Get image digest
        id: digest
        run: |
          DIGEST=$(gcloud artifacts docker images describe ${{ env.IMAGE }}:latest \
            --project ${{ env.PROJECT_ID }} \
            --format='value(image_summary.digest)')
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
          echo "Image digest: $DIGEST"

      - name: Configure Docker auth for Artifact Registry
        run: gcloud auth configure-docker us-docker.pkg.dev --quiet

      - uses: sigstore/cosign-installer@f713795cb21599bc4e5c4b58cbad1da852d7eeb9 # v3

      - name: Sign image (keyless)
        run: |
          cosign sign --yes \
            --oidc-issuer=https://token.actions.githubusercontent.com \
            "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}"

      - name: Verify signature
        run: |
          cosign verify \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            --certificate-identity-regexp="github.com/Pyronewbic/casecomp" \
            "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}"

      - name: Create Binary Auth attestation
        run: |
          gcloud --quiet beta container binauthz attestations sign-and-create \
            --artifact-url="${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}" \
            --attestor="projects/${{ env.PROJECT_ID }}/attestors/deploy-attestor" \
            --keyversion="projects/${{ env.PROJECT_ID }}/locations/global/keyRings/binary-auth/cryptoKeys/attestor-key/cryptoKeyVersions/1"

      - name: Generate container SBOM (Syft)
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
        with:
          image: "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}"
          format: spdx-json
          output-file: /tmp/sbom.spdx.json
          upload-artifact: false

      - name: Attest SBOM to image
        run: |
          cosign attest --yes \
            --oidc-issuer=https://token.actions.githubusercontent.com \
            --predicate /tmp/sbom.spdx.json \
            --type spdxjson \
            "${{ env.IMAGE }}@${{ steps.digest.outputs.digest }}"

      - name: Attest build provenance
        uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2
        with:
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ steps.digest.outputs.digest }}
          push-to-registry: false

  deploy:
    needs: build
    runs-on: ubuntu-latest
    strategy:
      matrix:
        region: [asia-south1, us-central1]
      fail-fast: false
    steps:
      - uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
        with:
          workload_identity_provider: projects/129850122606/locations/global/workloadIdentityPools/github-pool/providers/github-provider
          service_account: casecomp-deploy@casecomp-495718.iam.gserviceaccount.com

      - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3

      - name: Deploy to Cloud Run (${{ matrix.region }})
        run: |
          gcloud run deploy ${{ env.SERVICE }} \
            --image "${{ env.IMAGE }}@${{ needs.build.outputs.digest }}" \
            --region ${{ matrix.region }} \
            --project ${{ env.PROJECT_ID }} \
            --port 3000 \
            --allow-unauthenticated

      - name: Health check (${{ matrix.region }})
        run: |
          URL=$(gcloud run services describe ${{ env.SERVICE }} \
            --region ${{ matrix.region }} \
            --project ${{ env.PROJECT_ID }} \
            --format='value(status.url)')
          echo "Checking $URL/api/health..."
          for i in $(seq 1 10); do
            STATUS=$(curl -sf "$URL/api/health" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))" 2>/dev/null)
            if [ "$STATUS" = "ok" ]; then
              echo "Healthy (attempt $i)"
              exit 0
            fi
            echo "  attempt $i: $STATUS"
            sleep 5
          done
          echo "Health check failed after 10 attempts"
          exit 1

  dast:
    needs: deploy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - name: ZAP API Scan
        uses: zaproxy/action-api-scan@a9a916402665623ce9d37a6998d7b48e6b35dd6c # v0.9.0
        with:
          target: https://api.casecomp.xyz/docs/spec.json
          format: openapi
          fail_action: false
          allow_issue_writing: false
          cmd_options: '-a'
      - name: Upload DAST report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: zap-report-${{ github.sha }}
          path: report_html.html
          retention-days: 30