release-production.yml

name: Release Production

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

defaults:
  run:
    shell: bash

env:
  LC_ALL: C.UTF-8

jobs:
  image:
    strategy:
      matrix:
        project:
          - graphql
          - grpc
          - importer
          - monitor
          - rest
          - rest-java
          - rest-monitor
          - rosetta
          - test
          - web3
    env:
      CONTEXT: hedera-mirror-${{ matrix.project }}
      IMAGE: gcr.io/mirrornode/hedera-mirror-${{ matrix.project }}
    name: Publish images
    runs-on: mirror-node-linux-large
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - name: Get tag
        run: echo "TAG=${GITHUB_REF#refs/*/v}" >> $GITHUB_ENV

      - name: Custom monitor path
        if: matrix.project == 'rest-monitor'
        run: echo "CONTEXT=hedera-mirror-rest/monitoring" >> $GITHUB_ENV

      - name: Install JDK
        uses: actions/setup-java@b36c23c0d998641eff861008f374ee103c25ac73 # v4.4.0
        with:
          distribution: "temurin"
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@d156388eb19639ec20ade50009f3d199ce1e2808 # v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2.1.6
        with:
          credentials_json: "${{ secrets.GCR_KEY }}"

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@f0990588f1e5b5af6827153b93673613abdc6ec7 # v2.1.1

      - name: Configure Docker
        run: gcloud auth configure-docker gcr.io,marketplace.gcr.io

      - name: Build
        if: matrix.project != 'rest' && matrix.project != 'rest-monitor' && matrix.project != 'rosetta'
        run: ./gradlew :${{matrix.project}}:build -x test

      - name: Setup QEMU
        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1

      - name: Build and push images
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:
          build-args: VERSION=${{env.TAG}}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          context: ${{env.CONTEXT}}
          platforms: linux/amd64, linux/arm64
          provenance: false
          push: true
          tags: "${{env.IMAGE}}:${{env.TAG}},${{env.IMAGE}}:latest"

  chart:
    name: Publish charts
    needs: image
    runs-on: mirror-node-linux-medium
    permissions:
      contents: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - name: Publish helm chart
        uses: step-security/helm-gh-pages@6a390e89293c1ec8bc5120f6692f3b8a313a9a3d # v1.7.0
        with:
          target_dir: charts
          token: ${{ secrets.GITHUB_TOKEN }}

  marketplace:
    name: GCP Marketplace release
    needs: chart
    if: "!contains(github.ref, '-')"
    permissions:
      id-token: write
      contents: read
    runs-on: mirror-node-linux-large
    timeout-minutes: 15
    env:
      MPDEV: "/home/runner/mpdev"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - name: Authenticate to Google Cloud
        id: google-auth
        uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2.1.6
        with:
          workload_identity_provider: "projects/798248771094/locations/global/workloadIdentityPools/default-pool/providers/gh-provider"
          service_account: "container-publisher@mirror-node-public.iam.gserviceaccount.com"

      - name: Set GCloud CLI
        uses: google-github-actions/setup-gcloud@f0990588f1e5b5af6827153b93673613abdc6ec7 # v2.1.1

      - name: Authorize Docker
        run: gcloud auth configure-docker

      - name: Install k3d
        run: curl --retry 3 -fsL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash

      - name: Create k3d cluster
        run: k3d cluster create mirror --agents 1 --wait --image rancher/k3s:v1.29.3-k3s1

      - name: Get tag
        run: echo "TAG=${GITHUB_REF#refs/*/v}" >> $GITHUB_ENV

      - name: Install kubectl
        run: |
          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x ./kubectl

      - name: Install mpdev
        run:
          docker run gcr.io/cloud-marketplace-tools/k8s/dev cat /scripts/dev > ${MPDEV}
          && chmod +x ${MPDEV}

      - name: Install application
        run: ./kubectl apply -f "https://raw.githubusercontent.com/GoogleCloudPlatform/marketplace-k8s-app-tools/master/crd/app-crd.yaml"

      - name: Build images
        run: ./release.sh "${TAG}"
        working-directory: charts/marketplace/gcp

      - name: Install marketplace app
        run: ${MPDEV} verify --deployer=gcr.io/mirror-node-public/hedera-mirror-node/deployer:${TAG}