sandbox.yml

name: Sandbox

on:
  workflow_dispatch:
  pull_request:
    types: [opened, synchronize]
    paths-ignore:
      - "**.md"

permissions:
  contents: read
  id-token: write

jobs:
  build_and_push:
    name: Build and push
    runs-on: ubuntu-latest

    steps:
      # GitHub - Checkout
      # https://github.com/marketplace/actions/checkout

      - name: Checkout
        uses: actions/checkout@v4.2.2

      # Setup Node
      # https://github.com/marketplace/actions/setup-node-js-environment

      - name: Setup Node
        uses: actions/setup-node@v4.1.0
        with:
          node-version: 20.x

      - name: Yarn install
        working-directory: app
        run: |
          yarn install --immutable
          yarn tsc
          yarn build:backend

      # Google Cloud Platform - Create Credentials
      # https://github.com/marketplace/actions/authenticate-to-google-cloud

      - name: Create credentials
        id: create_credentials
        uses: google-github-actions/auth@v2.1.7
        with:
          token_format: access_token
          service_account: plt-backstage-github@plt-lz-terraform-tf00-sb.iam.gserviceaccount.com
          workload_identity_provider: projects/746490462722/locations/global/workloadIdentityPools/github-actions/providers/github-actions-oidc
          access_token_lifetime: 300s

      # Docker Buildx
      # https://github.com/marketplace/actions/docker-setup-buildx

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3.8.0

      # Docker Login
      # https://github.com/marketplace/actions/docker-login

      - name: Login to Google Artifact Registry
        uses: docker/login-action@v3.3.0
        with:
          registry: us-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.create_credentials.outputs.access_token }}


      # Build and Push Docker to Google Artifact Registry
      # https://github.com/marketplace/actions/build-and-push-docker-images

      - name: Build and push to Google Artifact Registry
        uses: docker/build-push-action@v6.10.0
        with:
          tags: us-docker.pkg.dev/plt-lz-services-tf7f-sb/plt-docker-standard/backstage:${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          context: ./app
          file: ./app/packages/backend/Dockerfile
          build-args: |
            DD_GIT_REPOSITORY_URL=https://github.com/${{ github.repository }}
            DD_GIT_COMMIT_SHA=${{ github.sha }}
          push: true

  main:
    name: "Main"
    uses: osinfra-io/github-terraform-gcp-called-workflows/.github/workflows/plan-and-apply.yml@v0.2.5
    if: github.actor != 'dependabot[bot]'
    needs: build_and_push
    with:
      checkout_ref: ${{ github.ref }}
      environment: sandbox
      github_environment: "Sandbox: Main"
      service_account: plt-backstage-github@plt-lz-terraform-tf00-sb.iam.gserviceaccount.com
      terraform_plan_args: -var-file=tfvars/sandbox.tfvars
      terraform_state_bucket: plt-backstage-4312-sb
      terraform_version: ${{ vars.TERRAFORM_VERSION }}
      terraform_workspace: main-sandbox
      working_directory: deployments
      workload_identity_provider: projects/746490462722/locations/global/workloadIdentityPools/github-actions/providers/github-actions-oidc
    secrets:
      gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
      infracost_api_key: ${{ secrets.INFRACOST_API_KEY }}
      terraform_plan_secret_args: >-
        -var=datadog_api_key=${{ secrets.DATADOG_API_KEY }}
        -var=datadog_app_key=${{ secrets.DATADOG_APP_KEY }}

  us_east1_b:
    name: "Sandbox Regional: us-east1-b"
    uses: osinfra-io/github-terraform-gcp-called-workflows/.github/workflows/plan-and-apply.yml@v0.2.5
    if: github.actor != 'dependabot[bot]'
    needs: main
    with:
      checkout_ref: ${{ github.ref }}
      environment: us-east1-b-sandbox
      github_environment: "Sandbox: Regional - us-east1-b"
      service_account: plt-backstage-github@plt-lz-terraform-tf00-sb.iam.gserviceaccount.com
      terraform_plan_args: -var-file=tfvars/us-east1-b-sandbox.tfvars -var=backstage_version=${{ github.sha }}
      terraform_state_bucket: plt-backstage-4312-sb
      terraform_version: ${{ vars.TERRAFORM_VERSION }}
      terraform_workspace: us-east1-b-sandbox
      working_directory: deployments/regional
      workload_identity_provider: projects/746490462722/locations/global/workloadIdentityPools/github-actions/providers/github-actions-oidc
    secrets:
      gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
      infracost_api_key: ${{ secrets.INFRACOST_API_KEY }}
      terraform_plan_secret_args: >-
        -var=datadog_api_key=${{ secrets.DATADOG_API_KEY }}
        -var=datadog_app_key=${{ secrets.DATADOG_APP_KEY }}

  datadog_synthetic_tests:
    name: "Sandbox: Datadog synthetic tests"
    runs-on: ubuntu-latest
    needs: us_east1_b
    steps:

      # Datadog Synthetics CI
      # https://github.com/marketplace/actions/datadog-synthetics-ci

      - name: Run Datadog synthetic tests
        uses: datadog/synthetics-ci-github-action@v1.15.0
        with:
          api_key: ${{ secrets.DATADOG_API_KEY }}
          app_key: ${{ secrets.DATADOG_APP_KEY }}
          fail_on_critical_errors: true
          test_search_query: "env:sandbox service:backstage team:platform-backstage state:live"