action.yml

name: "Deploy Staging Setup"
description: "Sets the environment for deploying to staging"
inputs:
  environment:
    description: "Target environment for deployment, e.g. staging"
    required: true
  infisical_client_id:
    description: "Infisical client ID for accessing secrets"
    required: true
  infisical_client_secret:
    description: "Infisical client secret for accessing secrets"
    required: true
  install_gcloud:
    description: "Whether to install the gcloud CLI (needed for gsutil/docker auth)"
    required: false
    default: "false"

runs:
  using: "composite"
  steps:
    - uses: Infisical/secrets-action@v1.0.9
      with:
        client-id: ${{ inputs.infisical_client_id }}
        client-secret: ${{ inputs.infisical_client_secret }}
        env-slug: ${{ inputs.environment }}
        project-slug: "infra-deployment"
        export-type: "file"
        file-output-path: "/.env.infisical"

    - name: Load Environment Variables
      id: load-env
      run: |
        echo ${{ inputs.environment }} > .last_used_env
        cat .env.infisical | sed "s/='\(.*\)'$/=\1/g" > .env.${{ inputs.environment }}

        # Load environment variables from .env
        set -a
        . .env.${{ inputs.environment }}
        set +a

        echo "GCP_REGION=${GCP_REGION}" >> $GITHUB_ENV
        echo "GCP_PROJECT_ID=${GCP_PROJECT_ID}" >> $GITHUB_ENV
        echo "TERRAFORM_STATE_BUCKET=${TERRAFORM_STATE_BUCKET}" >> $GITHUB_ENV
        echo "GH_WORKLOAD_IDENTITY_PROVIDER=${GH_WORKLOAD_IDENTITY_PROVIDER}" >> $GITHUB_ENV
      shell: bash

    - name: Setup Service Account
      uses: google-github-actions/auth@v2
      with:
        project_id: ${{ env.GCP_PROJECT_ID }}
        workload_identity_provider: ${{ env.GH_WORKLOAD_IDENTITY_PROVIDER }}

    - name: Set up Cloud SDK
      if: inputs.install_gcloud == 'true'
      uses: google-github-actions/setup-gcloud@v2

    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v4
      with:
        terraform_version: 1.5.7

    - name: Cache Terraform providers
      uses: actions/cache@v5
      with:
        path: ~/.terraform.d/plugin-cache
        key: terraform-providers-${{ hashFiles('iac/provider-gcp/.terraform.lock.hcl') }}
        restore-keys: |
          terraform-providers-

    - name: Terraform init
      working-directory: iac/provider-gcp
      run: |
        mkdir -p ~/.terraform.d/plugin-cache
        export TF_PLUGIN_CACHE_DIR=~/.terraform.d/plugin-cache
        terraform init -input=false -reconfigure -backend-config="bucket=${TERRAFORM_STATE_BUCKET}"
      shell: bash