deploy.yml

name: Pulumi Deploy
on:
  push:
    branches:
      - main
jobs:
  update:
    name: Update
    runs-on: ubuntu-latest
    environment: production
    concurrency: production
    permissions:
      contents: "read"
      id-token: "write"
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
      - name: Setup uv
        id: setup-uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          enable-cache: true
      - name: python deps
        run: uv sync --frozen
      - uses: DeterminateSystems/nix-installer-action@a7ad9c4f0c65208097f4d34f3cfa1913b80cce5c # main
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: frenchroomba
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
      - name: Nix build
        env:
          NIXPKGS_ALLOW_UNFREE: 1
        run: nix build --impure .#gcp.image .#azure.archive .#aws.archive .#aws.adapter-archive .#alicloud.archive
      - uses: "google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093" # v3
        with:
          project_id: ${{ secrets.GCP_PROJECT }}
          workload_identity_provider: ${{ secrets.GCP_DEPLOY_WORKLOAD_PROVIDER }}
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
        with:
          role-to-assume: ${{ secrets.AWS_DEPLOY_ROLE_ARN }}
          aws-region: ${{ vars.AWS_REGION }}
      - uses: "mozillazg/alibabacloud-oidc-auth@d9e498456f92c4a18a9bce656f9caff1855e1a8a" # v1
        with:
          role-arn-to-assume: ${{ secrets.ALIYUN_DEPLOY_ROLE }}
          oidc-provider-arn: ${{ secrets.ALIYUN_PROVIDER }}
          audience: "github-actions"
          export-environment-variables: true
      - name: gcloud docker auth
        run: gcloud auth configure-docker --quiet $(gcloud artifacts locations list --flatten name --format json | jq -r '[.[] + "-docker.pkg.dev"] | join(",")')
      - uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d # v7.0.0
        with:
          command: up
          stack-name: dev
        env:
          ARM_USE_OIDC: "true"
          ARM_CLIENT_ID: ${{ secrets.AZURE_DEPLOY_CLIENT_ID }}
          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
          PULUMI_PYTHON_CMD: "${{ github.workspace }}/.venv/bin/python"