ci-cd-python-app.yml

# This workflow will install Python dependencies, run tests and lint with a single version of Python
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: CI/CD Workflow

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  build:

    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ./app

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3
      
    - name: Set up Python 3.10
      uses: actions/setup-python@v2
      with:
        python-version: "3.10"
        
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install flake8 pytest
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
    
    - name: Lint with flake8
      run: |
        # stop the build if there are Python syntax errors or undefined names
        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
    
    - name: Test with pytest
      run: |
        pytest

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
      
    - name: Set up Docker Buildx
      id: buildx
      uses: docker/setup-buildx-action@v2
      
    - name: Cache Docker layers
      uses: actions/cache@v3
      with:
        path: /tmp/.buildx-cache
        key: ${{ runner.os }}-buildx-${{ github.sha }}
        restore-keys: |
          ${{ runner.os }}-buildx-
    
    - uses: docker/login-action@v2 
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
      
    - name: Build and push
      uses: docker/build-push-action@v5
      with:
        context: ./app 
        file: ./app/Dockerfile
        builder: ${{ steps.buildx.outputs.name }}
        push: true
        tags: ${{ secrets.DOCKER_USERNAME }}/hello-gitops:${{ github.sha }}, ${{ secrets.DOCKER_USERNAME }}/hello-gitops:latest
        platforms: linux/amd64,linux/arm64
        cache-from: type=local,src=/tmp/.buildx-cache
        cache-to: type=local,dest=/tmp/.buildx-cache

  deploy: 
    name: Deploy
    runs-on: ubuntu-latest
    needs: build
    
    env:
      PROJECT_ID: ${{ secrets.GKE_PROJECT }}
      GKE_CLUSTER: hello-gitops
      GKE_REGION: us-east1

    steps:
    - name: Check out code
      uses: actions/checkout@v2

    - name: Setup Kustomize
      uses: imranismail/setup-kustomize@v1
      with:
        kustomize-version: "3.6.1"

    # Alternative option - authentication via credentials json
    - name: Authenticate to Google Cloud
      uses: 'google-github-actions/auth@v3'
      with:
        credentials_json: '${{ secrets.GCP_CREDENTIALS }}'

    - name: Set up Cloud SDK
      uses: google-github-actions/setup-gcloud@v3

    - name: Get the GKE credentials so we can deploy to the cluster
      run: |
        gcloud components install gke-gcloud-auth-plugin
        gcloud container clusters get-credentials "$GKE_CLUSTER" --region "$GKE_REGION"

    - name: Create namespace & set in Kustomize
      run: |
          namespacePresentBlue=`kubectl get ns | grep python-app-blue | wc -l`
          namespacePresentGreen=`kubectl get ns | grep python-app-green | wc -l`
          if [ $namespacePresentBlue -eq 0 ]
          then
              kubectl create ns python-app-blue
              cd k8s
              kustomize edit set namespace python-app-blue
              echo "NEW_NAMESPACE=python-app-blue" >> $GITHUB_ENV
              echo "OLD_NAMESPACE=python-app-green" >> $GITHUB_ENV
          elif [ $namespacePresentGreen -eq 0 ]
          then
              kubectl create ns python-app-green
              cd k8s
              kustomize edit set namespace python-app-green
              echo "NEW_NAMESPACE=python-app-green" >> $GITHUB_ENV
              echo "OLD_NAMESPACE=python-app-blue" >> $GITHUB_ENV
          else
              echo "Both Blue and Green namespaces are present! Exiting"
              exit 1
          fi

    - name: Update Kubernetes resources
      env:
        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
      run: |
        cd k8s
        kustomize edit set image hello-gitops=$DOCKER_USERNAME/hello-gitops:$GITHUB_SHA
        cat kustomization.yaml
    
    - name: Deploy updated Kubernetes resources
      run: |
        kubectl apply -k k8s/ 
   
    - name: Wait for rollout success
      run: |
        kubectl rollout status deployment/hello-gitops -n ${{ env.NEW_NAMESPACE }} --timeout=120s

    - name: Route traffic to new namespace
      run: |
        kubectl patch service hello-gitops \
          -p '{"spec":{"selector":{"app":"hello-gitops","namespace":"'"${{ env.NEW_NAMESPACE }}"'"}}}' \
          -n ${{ env.NEW_NAMESPACE }}

    - name: Test the new deployment
      run: |
        kubectl -n ${{ env.NEW_NAMESPACE }} port-forward $(kubectl -n ${{ env.NEW_NAMESPACE }} get po -o name | tail -n 1) 8050:8050 &
        PF_PID=$!
        sleep 5
        for i in {1..30}; do
          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8050)
          if [ "$HTTP_CODE" = "200" ]; then
            kill $PF_PID
            exit 0
          else
            echo "Waiting for service to respond (attempt $i), got HTTP $HTTP_CODE"
            sleep 10
          fi
        done
        echo "Service did not respond with 200 after 5 minutes — rolling back"
        kill $PF_PID
        kubectl patch service hello-gitops \
          -p '{"spec":{"selector":{"app":"hello-gitops","namespace":"'"${{ env.OLD_NAMESPACE }}"'"}}}' \
          -n ${{ env.OLD_NAMESPACE }}
        exit 1

    - name: Remove old namespace
      run: |
        namespacePresentOld=`kubectl get ns | grep ${{ env.OLD_NAMESPACE }} | wc -l`
        if [ $namespacePresentOld -eq 1 ]
        then
          kubectl delete ns ${{ env.OLD_NAMESPACE }} --wait=true
        fi
  
    - name: Commit files
      run: |
        git config --local user.email "action@github.com"
        git config --local user.name "GitHub Action"
        git config pull.rebase false
        git commit -am "Bump docker tag"
        git pull origin main
        
    - name: Push changes
      uses: ad-m/github-push-action@master
      with:
        github_token: ${{ secrets.GITHUB_TOKEN }}