trigger_schema_updater.yaml

name: Trigger Schema Updater

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment (prod or dev)'
        required: true
        default: 'dev'
        type: choice
        options:
          - prod
          - dev

permissions:
  contents: 'read'
  id-token: 'write'

jobs:
  invoke-cloud-run:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - id: "branch-check"
        name: Fail if branch is not main or dev
        if: github.event_name == 'workflow_dispatch' && (github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev')
        run: |
          echo "This workflow should not be triggered with workflow_dispatch on a branch other than main or dev"
          exit 1

      - id: "google-cloud-auth"
        name: "Authenticate to Google Cloud"
        uses: "google-github-actions/auth@v2"
        with:
          workload_identity_provider: "projects/774248915715/locations/global/workloadIdentityPools/gh-deploy-pool/providers/gh-provider"
          service_account: "sample-metadata-deploy@sample-metadata.iam.gserviceaccount.com"

      - id: "google-cloud-sdk-setup"
        name: "Set up Cloud SDK"
        uses: google-github-actions/setup-gcloud@v2

      - id: "invoke-cloud-run"
        name: "Invoke Cloud Run"
        run: |
          CLOUD_RUN_URL=$(gcloud run services describe schema-updater --region australia-southeast1 --format 'value(status.url)')/execute-liquibase?environment=${{ github.event.inputs.environment }}
          TOKEN=$(gcloud auth print-identity-token --impersonate-service-account="sample-metadata-deploy@sample-metadata.iam.gserviceaccount.com" --audiences="$CLOUD_RUN_URL" --include-email)
            curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/xml" --data-binary "@db/project.xml" $CLOUD_RUN_URL