REopt_API/.github/workflows/deploy.yml at master · NatLabRockies/REopt_API · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
name: Deploy

on:
  push:
    branches: "**"
  pull_request:
    types:
      - closed
      - labeled
      - reopened
      - unlabeled
  workflow_dispatch:
    inputs:
      db-sync-restore:
        description: "Staging Only: Restore this branch's database with a recent snapshot from production."
        type: boolean

concurrency:
  # Concurrency group is more complicated in this case because:
  # 1. This gets triggered by both `push` and `pull_request` label events, so
  #    both should use the same git head ref (and not `github.ref`, which may
  #    be different for PRs).
  # 2. Our own deploy process may trigger an `unlabeled` event for removing the
  #    db-restore label, so separate that so that doesn't cause the previous
  #    deploy that was finishing up to be canceled.
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}${{ github.event.action == 'unlabeled' && github.event.label.name == 'deploy-db-restore' && '-removing-ephemeral-label' || '' }}
  cancel-in-progress: true

jobs:
  deploy-metadata:
    name: Deploy Metadata
    runs-on: self-hosted
    outputs:
      staging-perform-deploy: ${{ steps.staging-metadata.outputs.perform-deploy }}
      staging-perform-undeploy: ${{ steps.staging-metadata.outputs.perform-undeploy }}
      staging-metadata: ${{ toJSON(steps.staging-metadata.outputs) }}
      production-perform-deploy: ${{ steps.production-metadata.outputs.perform-deploy }}
      production-metadata: ${{ toJSON(steps.production-metadata.outputs) }}
    steps:
      - name: Import vault nonsensitive secrets
        id: vault-nonsensitive-secrets
        uses: TADA/vault-action/nonsensitive-secrets@v1
        with:
          template: |
            {{ with (datasource "vault" "reopt-api/ci/deploy").data }}
              {{ $secrets = coll.Merge (coll.Dict
                "container_registry" .container_registry
                "production_rancher_project_id" .production_rancher_project_id
                "production_url_host" .production_url_host
                "staging_rancher_project_id" .staging_rancher_project_id
                "staging_url_host_base" .staging_url_host_base
              ) $secrets }}
            {{ end }}
          vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
          vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}

      - name: Staging Metadata
        id: staging-metadata
        uses: TADA/deploy-action/metadata@v2
        with:
          deploy-env: staging
          app-name: reopt-api
          rancher-project-id: ${{ fromJSON(steps.vault-nonsensitive-secrets.outputs.nonsensitive-secrets).staging_rancher_project_id }}
          registry: ${{ fromJSON(steps.vault-nonsensitive-secrets.outputs.nonsensitive-secrets).container_registry }}
          branch-url-host-base: ${{ fromJSON(steps.vault-nonsensitive-secrets.outputs.nonsensitive-secrets).staging_url_host_base }}
          branch-db-name-base: reopt_api_staging

      - name: Production Metadata
        id: production-metadata
        uses: TADA/deploy-action/metadata@v2
        with:
          deploy-env: production
          app-name: reopt-api
          rancher-project-id: ${{ fromJSON(steps.vault-nonsensitive-secrets.outputs.nonsensitive-secrets).production_rancher_project_id }}
          registry: ${{ fromJSON(steps.vault-nonsensitive-secrets.outputs.nonsensitive-secrets).container_registry }}
          url-host: ${{ fromJSON(steps.vault-nonsensitive-secrets.outputs.nonsensitive-secrets).production_url_host }}

  undeploy-staging:
    name: Undeploy Staging
    needs:
      - deploy-metadata
    if: ${{ needs.deploy-metadata.outputs.staging-perform-undeploy == 'true' }}
    uses: TADA/deploy-action/.github/workflows/undeploy-branch.yml@v2
    with:
      metadata: ${{ needs.deploy-metadata.outputs.staging-metadata }}
      vault-kubeconfig-path: secret/data/deploy/staging/on-prem-rancher-test-ponderosa-cluster-test-reopt
      vault-db-superuser-path: secret/data/reopt-db/staging/db-superuser
    secrets:
      vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
      vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}

  deploy-staging:
    name: Deploy Staging
    needs:
      - deploy-metadata
    if: ${{ needs.deploy-metadata.outputs.staging-perform-deploy == 'true' }}
    uses: TADA/deploy-action/.github/workflows/deploy.yml@v2
    with:
      metadata: ${{ needs.deploy-metadata.outputs.staging-metadata }}
      vault-registry-credentials-path: secret/data/deploy/common/aws-ecr
      vault-kubeconfig-path: secret/data/deploy/staging/on-prem-rancher-test-ponderosa-cluster-test-reopt
    secrets:
      vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
      vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}

  deploy-production:
    name: Deploy Production
    needs:
      - deploy-metadata
      - deploy-staging
    if: ${{ needs.deploy-metadata.outputs.production-perform-deploy == 'true' }}
    uses: TADA/deploy-action/.github/workflows/deploy.yml@v2
    with:
      metadata: ${{ needs.deploy-metadata.outputs.production-metadata }}
      vault-registry-credentials-path: secret/data/deploy/common/aws-ecr
      vault-kubeconfig-path: secret/data/deploy/production/on-prem-rancher-ponderosa-cluster-reopt
    secrets:
      vault-role-id: ${{ secrets.VAULT_ROLE_ID }}
      vault-secret-id: ${{ secrets.VAULT_SECRET_ID }}