release-production.yml

# SPDX-License-Identifier: Apache-2.0

name: Release Production

on:
  push:
    tags:
      - "v*"

permissions:
  contents: read

defaults:
  run:
    shell: bash

env:
  LC_ALL: C.UTF-8

jobs:
  image:
    strategy:
      fail-fast: false
      matrix:
        project:
          - graphql
          - grpc
          - importer
          - monitor
          - rest
          - rest-java
          - rest-monitor
          - rosetta
          - test
          - web3
    env:
      CONTEXT: ${{ matrix.project }}
      IMAGE: gcr.io/mirrornode/hedera-mirror-${{ matrix.project }}
    name: Publish images
    permissions:
      contents: "read"
      id-token: "write"
    runs-on: hiero-mirror-node-linux-large
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Get tag
        run: echo "TAG=${GITHUB_REF#refs/*/v}" >> $GITHUB_ENV

      - name: Custom monitor path
        if: matrix.project == 'rest-monitor'
        run: echo "CONTEXT=rest/monitoring" >> $GITHUB_ENV

      - name: Install JDK
        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          distribution: "temurin"
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v4

      - name: Authenticate to Google Cloud
        uses: step-security/google-github-auth@190f7ef9b7a34cc0dfd0c11f0e327365f70071d6 # v2.1.12
        with:
          service_account: "mirrornode-gh-actions-sa@mirrornode.iam.gserviceaccount.com"
          workload_identity_provider: "projects/521285740332/locations/global/workloadIdentityPools/mirrornode-gh-actions/providers/mirrornode-gh-actions"

      - name: Setup gcloud
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
        with:
          cache: true

      - name: Configure Docker
        run: gcloud auth configure-docker gcr.io,marketplace.gcr.io

      - name: Build
        if: matrix.project != 'rest' && matrix.project != 'rest-monitor' && matrix.project != 'rosetta'
        run: ./gradlew :${{matrix.project}}:build -x test

      - name: Setup QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
        with:
          driver-opts: network=host
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["https://hub.mirror.docker.lat.ope.eng.hashgraph.io"]
          version: latest

      - name: Build and push images
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          annotations: "index,manifest,manifest-descriptor:com.googleapis.cloudmarketplace.product.service.name=services/hedera-mirror-node-mirror-node-public.cloudpartnerservices.goog"
          build-args: VERSION=${{env.TAG}}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          context: ${{env.CONTEXT}}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          platforms: linux/amd64, linux/arm64
          provenance: false
          push: true
          tags: "${{env.IMAGE}}:${{env.TAG}},${{env.IMAGE}}:latest"

  chart:
    name: Publish charts
    needs: image
    runs-on: hiero-mirror-node-linux-medium
    permissions:
      contents: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Publish helm chart
        uses: step-security/helm-gh-pages@193f06cc02866ad07b39a035d2be93835912b1f4 # v1.7.3
        with:
          target_dir: charts
          token: ${{ secrets.GITHUB_TOKEN }}

  marketplace:
    name: GCP Marketplace release
    needs: chart
    if: "!contains(github.ref, '-')"
    permissions:
      id-token: write
      contents: read
    runs-on: hiero-mirror-node-linux-large
    timeout-minutes: 15
    env:
      MPDEV: "/home/runner/mpdev"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Authenticate to Google Cloud
        id: google-auth
        uses: step-security/google-github-auth@190f7ef9b7a34cc0dfd0c11f0e327365f70071d6 # v2.1.12
        with:
          workload_identity_provider: "projects/798248771094/locations/global/workloadIdentityPools/default-pool/providers/gh-provider"
          service_account: "container-publisher@mirror-node-public.iam.gserviceaccount.com"

      - name: Set GCloud CLI
        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
        with:
          cache: true

      - name: Authorize Docker
        run: gcloud auth configure-docker

      - name: Install k3d
        run: curl --retry 3 -fsL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash

      - name: Create k3d cluster
        run: k3d cluster create mirror --agents 1 --wait --image rancher/k3s:v1.32.3-k3s1

      - name: Get tag
        run: echo "TAG=${GITHUB_REF#refs/*/v}" >> $GITHUB_ENV

      - name: Install kubectl
        run: |
          curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
          chmod +x ./kubectl

      - name: Install mpdev
        run:
          docker run gcr.io/cloud-marketplace-tools/k8s/dev cat /scripts/dev > ${MPDEV}
          && chmod +x ${MPDEV}

      - name: Install application
        run: ./kubectl apply -f "https://raw.githubusercontent.com/GoogleCloudPlatform/marketplace-k8s-app-tools/master/crd/app-crd.yaml"

      - name: Setup QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
        with:
          driver-opts: network=host
          buildkitd-config-inline: |
            [registry."docker.io"]
              mirrors = ["https://hub.mirror.docker.lat.ope.eng.hashgraph.io"]

      - name: Build images
        run: ./release.sh "${TAG}"
        working-directory: charts/marketplace/gcp

      - name: Install marketplace app
        run: ${MPDEV} verify --deployer=gcr.io/mirror-node-public/hedera-mirror-node/deployer:${TAG}