infra-gitops/.github/workflows/deploy.yml at main · AutoInvestor/infra-gitops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
name: Deploy
concurrency:
  group: ${{ github.workflow_ref }}
  cancel-in-progress: false

on:
  pull_request:
    types: [ opened, synchronize ]
    branches:
      - main
    paths:
      - helm/**
      - .github/workflows/deploy.yml
  push:
    branches:
      - main
    paths:
      - helm/**
      - .github/workflows/deploy.yml
  workflow_dispatch:

permissions:
  id-token: write

jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    env:
      HELM_REPO: "oci://${{ vars.GCP_REGION }}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID }}/helm-charts"
    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: GCP Auth
        if: steps.version_increment.outputs.bump != 'none'
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ vars.WIF_PROVIDER }}
          service_account: ${{ vars.DEPLOYER_SA_EMAIL }}

      - name: Set up Cloud SDK
        uses: google-github-actions/setup-gcloud@v2
        with:
          project_id: ${{ vars.GCP_PROJECT_ID }}
          install_components: 'kubectl'

      - name: Get GKE Credentials
        uses: google-github-actions/get-gke-credentials@v2
        with:
          cluster_name: ${{ vars.GCP_GKE_CLUSTER_NAME }}
          location: ${{ vars.GCP_GKE_CLUSTER_ZONE }}
          project_id: ${{ vars.GCP_PROJECT_ID }}

      - name: Install Helm
        uses: azure/setup-helm@v3
        with:
          version: v3.12.0

      - name: Helm lint
        run: helm lint ./helm

      - name: Get GSM Secrets
        id: secrets
        uses: google-github-actions/get-secretmanager-secrets@v2
        with:
          secrets: |-
            mongodb-uri:${{ vars.GCP_PROJECT_ID }}/mongodb-uri
            okta-client-secret:${{ vars.GCP_PROJECT_ID }}/okta-client-secret

      - name: Deploy all to GKE (dry run)
        if: github.event_name == 'pull_request'
        run: |
          helm upgrade --install autoinvestor ./helm \
            --namespace autoinvestor \
            --create-namespace \
            --force \
            --dry-run \
            --set gcpProject="${{ vars.GCP_PROJECT_ID }}" \
            --set mongodbUri="${{ steps.secrets.outputs.mongodb-uri }}" \
            --set okta.clientSecret="${{ steps.secrets.outputs.okta-client-secret }}"

      - name: Package & push helm chart
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        run: |
          cd helm
          echo -e "\033[32mBuilding helm chart\033[0m"
          helm package .
          echo -e "\033[32mConfiguring helm registry\033[0m"
          gcloud auth print-access-token | helm registry login ${{ vars.DOCKER_ARTIFACT_REGISTRY }} -u oauth2accesstoken --password-stdin
          echo -e "\033[32mPushing helm chart\033[0m"
          current_version=$(sed -n 's/^version: \([0-9]*\.[0-9]*\.[0-9]*\)/\1/p' Chart.yaml)
          helm push "autoinvestor-${current_version}.tgz" "${HELM_REPO}"

      - name: Deploy all to GKE
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        run: |
          current_version=$(sed -n 's/^version: \([0-9]*\.[0-9]*\.[0-9]*\)/\1/p' helm/Chart.yaml)

          helm pull "${HELM_REPO}/autoinvestor" --version "${current_version}"

          helm upgrade --install autoinvestor "autoinvestor-${current_version}.tgz" \
            --namespace autoinvestor \
            --create-namespace \
            --version "${current_version}" \
            --set gcpProject="${{ vars.GCP_PROJECT_ID }}" \
            --set mongodbUri="${{ steps.secrets.outputs.mongodb-uri }}" \
            --set okta.clientSecret="${{ steps.secrets.outputs.okta-client-secret }}"