Merge pull request #809 from fermyon/tpmccallum-patch-20 #325
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Developer Docs | |
| on: | |
| push: | |
| branches: | |
| - 'main' | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: 'Git ref to deploy from (refs/tags/v* for tag)' | |
| default: 'refs/heads/main' | |
| commit: | |
| description: 'Commit SHA to deploy from (optional)' | |
| environment: | |
| type: choice | |
| description: 'Environment to deploy to (Default: canary)' | |
| options: | |
| - canary | |
| - prod | |
| # Construct a concurrency group to be shared across workflow runs. | |
| # The default behavior ensures that only one is running at a time, with | |
| # all others queuing and thus not interrupting runs that are in-flight. | |
| concurrency: ${{ github.workflow }} | |
| permissions: | |
| contents: read | |
| id-token: write # Allow the workflow to create a JWT for AWS auth | |
| env: | |
| OCI_REGISTRY: index.docker.io | |
| OCI_IMAGE_NAME: fermyon/developer | |
| jobs: | |
| echo-inputs: | |
| runs-on: ubuntu-latest | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| steps: | |
| - name: Echo Inputs | |
| run: | | |
| echo ref: ${{ inputs.ref }} | |
| echo commit: ${{ inputs.commit }} | |
| echo environment: ${{ inputs.environment }} | |
| publish: | |
| runs-on: ubuntu-latest | |
| if: ${{ github.repository_owner == 'fermyon' }} | |
| outputs: | |
| oci_ref: ${{ env.OCI_REGISTRY }}/${{ env.OCI_IMAGE_NAME }}@${{ steps.push.outputs.digest }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Check out specific ref | |
| if: ${{ github.event_name == 'workflow_dispatch' }} && ${{ inputs.ref != ''}} | |
| run: git checkout ${{ inputs.ref }} | |
| - name: Check out specific commit | |
| if: ${{ github.event_name == 'workflow_dispatch' }} && ${{ inputs.commit != ''}} | |
| run: git checkout ${{ inputs.commit }} | |
| - name: Setup Node | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 16 | |
| - name: Setup Spin | |
| uses: fermyon/actions/spin/setup@v1 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| version: v1.2.1 | |
| - name: Install npm packages | |
| run: | | |
| npm ci | |
| - name: Build app | |
| run: | | |
| spin build | |
| - name: Construct OCI image tag | |
| shell: bash | |
| run: | | |
| [[ "${{ github.event_name }}" == "push" ]] && \ | |
| echo "IMAGE_TAG=latest" >> $GITHUB_ENV || \ | |
| echo "IMAGE_TAG=canary" >> $GITHUB_ENV | |
| - name: Login and Publish Spin app | |
| id: push | |
| uses: fermyon/actions/spin/push@v1 | |
| with: | |
| registry: ${{ env.OCI_REGISTRY }} | |
| registry_username: fermyon | |
| registry_password: ${{ secrets.DOCKERHUB_PAT }} | |
| registry_reference: ${{ env.OCI_REGISTRY }}/${{ env.OCI_IMAGE_NAME }}:${{ env.IMAGE_TAG }} | |
| - name: Cleanup login | |
| if: ${{ always() }} | |
| run: | | |
| rm -rf /home/runner/fermyon | |
| deploy: | |
| runs-on: ubuntu-latest | |
| needs: publish | |
| if: ${{ github.repository_owner == 'fermyon' }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Install Nomad | |
| env: | |
| NOMAD_VERSION: "1.4.3" | |
| run: | | |
| curl -Os https://releases.hashicorp.com/nomad/${NOMAD_VERSION}/nomad_${NOMAD_VERSION}_linux_$(dpkg --print-architecture).zip | |
| unzip nomad_${NOMAD_VERSION}_linux_$(dpkg --print-architecture).zip -d /usr/local/bin | |
| chmod +x /usr/local/bin/nomad | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v2 | |
| with: | |
| role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.INFRA_NAMESPACE }}-${{ secrets.AWS_REGION }}-gha-certs | |
| role-session-name: fermyon-developer-deploy | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| - name: Fetch Nomad Certs from S3 | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| for cert in infra_ca \ | |
| api_client_cert_private_key \ | |
| api_client_cert_public_key; do | |
| aws s3api get-object \ | |
| --bucket "infra-certs-${{ secrets.INFRA_NAMESPACE }}-${{ secrets.AWS_REGION }}" \ | |
| --key "${cert}" \ | |
| "/tmp/${cert}" | |
| done | |
| - name: Configure Nomad | |
| shell: bash | |
| run: | | |
| echo "NOMAD_CACERT=/tmp/infra_ca" >> $GITHUB_ENV | |
| echo "NOMAD_CLIENT_CERT=/tmp/api_client_cert_public_key" >> $GITHUB_ENV | |
| echo "NOMAD_CLIENT_KEY=/tmp/api_client_cert_private_key" >> $GITHUB_ENV | |
| echo "NOMAD_ADDR=https://nomad.${{ secrets.INFRA_NAMESPACE }}.${{ secrets.AWS_REGION }}.fermyon.link:4646" >> $GITHUB_ENV | |
| - name: Configure manual deploy | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| shell: bash | |
| run: | | |
| if [[ "${{ inputs.environment }}" == "prod" ]]; then | |
| echo "PRODUCTION=true" >> $GITHUB_ENV | |
| echo "NOMAD_NAMESPACE=prod" >> $GITHUB_ENV | |
| else | |
| echo "PRODUCTION=false" >> $GITHUB_ENV | |
| echo "NOMAD_NAMESPACE=staging" >> $GITHUB_ENV | |
| fi | |
| - name: Configure auto-deploy | |
| if: ${{ github.event_name == 'push' }} | |
| shell: bash | |
| run: | | |
| echo "PRODUCTION=true" >> $GITHUB_ENV | |
| echo "NOMAD_NAMESPACE=prod" >> $GITHUB_ENV | |
| - name: Deploy | |
| shell: bash | |
| run: | | |
| nomad run \ | |
| -var "region=${{ secrets.AWS_REGION }}" \ | |
| -var "production=${{ env.PRODUCTION }}" \ | |
| -var "commit_sha=$(git rev-parse HEAD)" \ | |
| -var "oci_ref=${{ needs.publish.outputs.oci_ref }}" \ | |
| deploy/fermyon-developer.nomad |