release-integration.yml

name: Release Integration

on:
  push:
    branches:
      - "main"

permissions:
  contents: write

defaults:
  run:
    shell: bash

env:
  LC_ALL: C.UTF-8

jobs:
  publish:
    strategy:
      matrix:
        project:
          - graphql
          - grpc
          - importer
          - monitor
          - rest
          - rest-java
          - rest-monitor
          - rosetta
          - test
          - web3
    env:
      CONTEXT: hedera-mirror-${{ matrix.project }}
      IMAGE: gcr.io/mirrornode/hedera-mirror-${{ matrix.project }}
    runs-on: mirror-node-linux-large
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Get version
        run: echo "VERSION=$(grep -oP 'version=\K.+' gradle.properties)" >> $GITHUB_ENV

      - name: Custom monitor path
        if: matrix.project == 'rest-monitor'
        run: echo "CONTEXT=hedera-mirror-rest/monitoring" >> $GITHUB_ENV

      - name: Install JDK
        uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
        with:
          distribution: "temurin"
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
        with:
          credentials_json: "${{ secrets.GCR_KEY }}"

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2.1.2

      - name: Configure Docker
        run: gcloud auth configure-docker gcr.io,marketplace.gcr.io

      - name: Build
        if: matrix.project != 'rest' && matrix.project != 'rest-monitor' && matrix.project != 'rosetta'
        run: ./gradlew :${{matrix.project}}:build -x test

      - name: Setup QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Build and push images
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          build-args: VERSION=${{env.VERSION}}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          context: ${{env.CONTEXT}}
          platforms: linux/amd64, linux/arm64
          provenance: false
          push: true
          tags: "${{env.IMAGE}}:${{env.VERSION}},${{env.IMAGE}}:main,${{env.IMAGE}}:main-${{ github.sha }}"

  deploy:
    needs: publish
    runs-on: mirror-node-linux-medium
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: deploy
          token: ${{ secrets.HEDERA_BOT_TOKEN }}

      - name: Import GPG Key
        id: gpg_importer
        uses: step-security/ghaction-import-gpg@6c8fe4d0126a59d57c21f87c9ae5dd3451fa3cca # v6.1.0
        with:
          git_commit_gpgsign: true
          git_tag_gpgsign: true
          git_user_signingkey: true
          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PASSPHRASE }}

      - name: Update integration deployment configuration
        run: 'sed -i "s/git.commit: .*/git.commit: ${GITHUB_SHA}/" clusters/preprod/integration/helmrelease.yaml'

      - name: Auto-Commit
        uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
        with:
          commit_author: ${{ steps.gpg_importer.outputs.name }} <${{ steps.gpg_importer.outputs.email }}>
          commit_message: Upgrade integration to main ${{ github.sha }}
          commit_options: "--no-verify --signoff"
          commit_user_email: ${{ steps.gpg_importer.outputs.email }}
          commit_user_name: ${{ steps.gpg_importer.outputs.name }}