# Set up CI/CD for `dev`

<!-- prettier-ignore-start -->
!!! example "Reference implementation"
    See the [`pirates-app-hello-world`](https://github.com/oslokommune/pirates-app-hello-world) repository for a working example built by following this guide.
<!-- prettier-ignore-end -->

Set up branch rulesets, and manual deployment approval for your application repository.

## Step 1: Protect your default branch

Your repository automatically inherits a set of branch rulesets from the GitHub organization when you add a specific
custom property to it. These rulesets add a set of required guardrails to your repository.
These are **required** to protect your default branch (typically `main`).

1. In your repository, go to **Settings > Custom properties** and set `gp-repository-type` to `app`.
1. After setting the custom property, verify that **Settings > Rulesets** have at least 1 ruleset inherited from the organization.

## Step 2: Add configuration files

### Step 2.1: Add `.gp.cicd.json`

Download [.gp.cicd.json](https://github.com/oslokommune/golden-path-templates/blob/main/templates/gh-cicd-app/.gp.cicd.json){:target="_blank"} to the repository root:

```bash title="hello-world/"
gh api repos/oslokommune/golden-path-templates/contents/templates/gh-cicd-app/.gp.cicd.dev-only.json \
  --jq '.content' | base64 -d > .gp.cicd.json
```

Update the values referenced in the table below. You can find them in `common-config.yml` in your IaC repository's
`dev` environment directory, such as `repo-iac/environments/dev/common-config.yml`.

| Field                    | Description                                             | Example        |
| ------------------------ | ------------------------------------------------------- | -------------- |
| `<team-name>`            | Your team name                                          | `pirates`      |
| `<repo-iac>`             | Infrastructure-as-code repository name                  | `pirates-iac`  |
| `<dev-aws-account-id>`   | AWS account ID for `dev`                                | `123456789012` |
| `<dev-environment-name>` | Name of your `dev` AWS environment                      | `pirates-dev`  |
| `<dev-iac-directory>`    | The directory containing IaC for your `dev` environment | `stacks/dev`   |
| `<aws-region>`           | Your AWS region                                         | `eu-west-1`    |

### Step 2.2: Add CODEOWNERS

Add a `CODEOWNERS` file to define who owns the repository and approves PRs:

```text title="hello-world/.github/CODEOWNERS"
* @oslokommune/<github-team-name>
```

| Field                | Description                                                               | Example        |
| -------------------- | ------------------------------------------------------------------------- | -------------- |
| `<github-team-name>` | The name of your [GitHub team](https://github.com/orgs/oslokommune/teams) | `utviklerflyt` |

### Step 2.3: Add Renovate configuration

Download [renovate.json5](https://github.com/oslokommune/golden-path-templates/blob/main/templates/gh-cicd-app/renovate.json5){:target="_blank"} to the repository root:

```bash title="hello-world/"
gh api repos/oslokommune/golden-path-templates/contents/templates/gh-cicd-app/renovate.json5 \
  --jq '.content' | base64 -d > renovate.json5
```

<!-- prettier-ignore-start -->
!!! info "What is Renovate?"
    Renovate automatically creates pull requests to keep your dependencies up to date. Think of it as a better Dependabot. Learn more in the [Renovate reference documentation](../../terraform-automation/renovate.md).
<!-- prettier-ignore-end -->

## Step 3: Add and configure workflow

### Step 3.1: Download workflow

Download the [reference workflow](https://github.com/oslokommune/pirates-apps/blob/main/.github/workflows/too-tikki_deployment.yml) and address the few `TODO` comments:

```bash title="hello-world/"
gh api repos/oslokommune/pirates-apps/contents/.github/workflows/too-tikki_deployment.yml \
  --jq '.content' | base64 -d > .github/workflows/hello-world_deployment.yml
```

The main adaptation is in the `build-and-upload-artifact` job, where you customize the build and test steps to match
your application.

### Step 3.2: Disable production deployment

This guide only sets up deployment to `dev`. Comment out everything below these lines:

<!-- The indentation shows where the lines sit in the workflow file. -->
<!-- prettier-ignore -->
```yaml
  ################################################################################
  # Job: Deploy to prod
  ################################################################################
```

## Step 4: Create a pull request

Push the branch and create a pull request.

Verify that the build job succeeds and that no deployment occurs.

## Step 5: Merge and deploy

Merge the pull request.

## Step 6: Verify

When merging, the CI/CD workflow should deploy your app to your `dev` environment.

## Next steps

To delete parts of what you created, see the [guide for deleting environments](../../terraform/delete/delete-environment.md). You can also [delete a remote state bucket](../../terraform/delete/delete-remote-state-bucket.md).

### Before you go to production

The team that owns the application needs to do a risk assessment analysis (ROS) before going to production. [Read more on how to do that at the risk assessment reference page.](../../aws-account/risk-assessment-ros.md)

To make the CI/CD workflow deploy your app to production, see [Set up CI/CD for `prod`](set-up-cicd-for-prod.md).