google-container-registry-2.yml

name: "google-administer-container-registry"

on:
  workflow_call:
    inputs:
      region:
        description: "The Google Cloud region where the Container Registry will be available"
        type: string
        required: true
      action:
        required: true
        type: string
        description: "Create (new) or destroy (existing)"
    secrets:
      GOOGLE_PROJECT_ID:
        required: true
      GOOGLE_SERVICE_ACCOUNT_KEY:
        required: true
      TF_BACKEND_GCS_BUCKET_NAME:
        required: true
    outputs:
      admin_username:
        description: "The username associated with the Artifact Registry admin account"
        value: ${{ jobs.terraform.outputs.admin_username }}
      admin_password:
        description: "The password associated with the Artifact Registry admin account"
        value: ${{ jobs.terraform.outputs.admin_password }}
      endpoint:
        description: "The URL that can be used to log into the container image registry (typically {region}-docker.pkg.dev)"
        value: ${{ jobs.terraform.outputs.endpoint }}

jobs:
  terraform:
    env:
      GOOGLE_SERVICE_ACCOUNT_KEY: ${{ secrets.GOOGLE_SERVICE_ACCOUNT_KEY }}
      GOOGLE_APPLICATION_CREDENTIALS: "/tmp/gcloud/sa.json"
      TF_VAR_project: ${{ secrets.GOOGLE_PROJECT_ID }}
      TF_VAR_location: "${{ inputs.region }}"
    runs-on: ubuntu-22.04

    outputs:
      endpoint: ${{ steps.set_outputs.outputs.endpoint }}
      admin_username: ${{ steps.set_outputs.outputs.admin_username }}
      admin_password: ${{ steps.set_outputs.outputs.admin_password }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-22.04, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash
        working-directory: terraform/google/registry-2

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v4

    # Install the latest version of Terraform CLI
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_wrapper: false
        terraform_version: 1.5.7

    - name: Generate backend configuration
      run: |
        cp ../backend/backend.tf .
        echo "bucket = \"${{ secrets.TF_BACKEND_GCS_BUCKET_NAME }}\"" > config.gcs.tfbackend
        echo "prefix = \"registry-2\"" >> config.gcs.tfbackend

    - name: Decrypt service account keyfile contents and write to /tmp/gcloud/sa.json
      run: |
        mkdir -p /tmp/gcloud
        echo "$GOOGLE_SERVICE_ACCOUNT_KEY" | base64 -d > /tmp/gcloud/sa.json
        chmod 600 /tmp/gcloud/sa.json

    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
    - name: Terraform Init
      run: terraform init -upgrade -backend-config=./config.gcs.tfbackend

    # Checks that all Terraform configuration files adhere to a canonical format
    - name: Terraform Format
      run: terraform fmt -check

    # Generates an execution plan for Terraform
    - name: Terraform Plan
      if: inputs.action == 'create'
      run: terraform plan

    - name: Terraform Apply
      if: inputs.action == 'create'
      run: terraform apply -auto-approve

    - name: Terraform Destroy
      if: inputs.action == 'destroy'
      run: terraform destroy -auto-approve

    - name: Set Outputs
      id: set_outputs
      if: inputs.action == 'create'
      run: |
        endpoint=$(terraform output --raw endpoint | sed 's/https\?:\/\///')
        echo "endpoint=${endpoint}" >> $GITHUB_OUTPUT
        admin_username=$(terraform output --raw admin_username)
        echo "admin_username=${admin_username}" >> $GITHUB_OUTPUT
        admin_password=$(terraform output --raw admin_password)
        echo "admin_password=${admin_password}" >> $GITHUB_OUTPUT

  container-image-cloud-storage-cleanup:
    if: inputs.action == 'destroy'
    runs-on: ubuntu-22.04

    steps:

    - name: Checkout
      uses: actions/checkout@v4

    - id: 'auth'
      uses: 'google-github-actions/auth@v1'
      with:
        credentials_json: '${{ secrets.GOOGLE_SERVICE_ACCOUNT_KEY }}'

    - name: 'Set up Cloud SDK'
      uses: 'google-github-actions/setup-gcloud@v1'
      with:
        version: "438.0.0"
        install_components: gke-gcloud-auth-plugin

    - name: 'Destroy images and bucket'
      run: |
        gsutil -m rm -r gs://${{ inputs.region }}.artifacts.${{ secrets.GOOGLE_PROJECT_ID }}.appspot.com