Déploiement continu

resource "google_iam_workload_identity_pool" "github" {
  workload_identity_pool_id = "github"
}

resource "google_iam_workload_identity_pool_provider" "github" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-oidc"
  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.repository" = "assertion.repository"
  }
  attribute_condition = "assertion.repository == \"novagen/agent-adk\""
  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

name: deploy
on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write

env:
  REGION: europe-west1
  IMAGE: europe-west1-docker.pkg.dev/second-project-511608/agents/assistant:${{ github.sha }}

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123456789/locations/global/workloadIdentityPools/github/providers/github-oidc
          service_account: deployer@second-project-511608.iam.gserviceaccount.com
      - uses: google-github-actions/setup-gcloud@v2
      - run: gcloud auth configure-docker $REGION-docker.pkg.dev --quiet
      - run: docker build -t $IMAGE . && docker push $IMAGE
      - uses: hashicorp/setup-terraform@v3
      - working-directory: infra
        run: |
          terraform init
          terraform apply -auto-approve -var project_id=second-project-511608 -var image=$IMAGE

URL=$(gcloud run services describe assistant-cloud --region europe-west1 --format 'value(status.url)')
curl -s -H "Authorization: Bearer $(gcloud auth print-identity-token)" "$URL/list-apps"