infra-main-apply.yml

name: Apply changes

permissions:
  id-token: write
  contents: read
  pull-requests: write

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - resources/**
      - Pulumi.*
      - pnpm-lock.yaml
      - package.json
      - .github/workflows/*.yml

run-name: Apply branches/branches-main/main by @${{ github.actor }}

jobs:
  pulumi:
    name: Pulumi
    runs-on: ubuntu-latest
    concurrency: pulumi-main-up

    steps:
      - name: Checkout 🛎️
        uses: actions/checkout@v4

      - uses: pnpm/action-setup@v2

      - name: Use Node LTS ✨
        uses: actions/setup-node@v3
        with:
          node-version: lts/*
          cache: pnpm

      - name: Install dependencies 📦️
        run: pnpm install --frozen-lockfile

      - name: Authenticate to GCP 🔒
        uses: google-github-actions/auth@v1
        with:
          workload_identity_provider: ${{ secrets.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: conf-deployer@bjerk-core.iam.gserviceaccount.com

      - uses: simenandre/setup-gke-gcloud-auth-plugin@v1

      - name: Running Pulumi 🚀
        uses: pulumi/actions@v4
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
        with:
          command: up
          comment-on-pr: true
          stack-name: branches/branches-main/main