Merge pull request #8 from openfoodfacts/dependabot/github_actions/to… #3
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Container Image Deployment CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - deploy-* | |
| # only staging for now, not prod | |
| # tags: | |
| # - v*.*.* | |
| # Note on secrets used for connection | |
| # They are configured as environment secrets | |
| # HOST is the internal ip of VM containing docker | |
| # PROXY_HOST is the host of VMs | |
| # USERNAME is the user used for operations | |
| # SSH_PRIVATE_KEY is the private key (shared between VM and host) | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| env: | |
| # only stagging for now | |
| # Note: env is also the name of the directory on the server | |
| - nutripatrol-net | |
| environment: ${{ matrix.env }} | |
| concurrency: ${{ matrix.env }} | |
| steps: | |
| - name: Set various variable for staging (net) deployment | |
| if: matrix.env == 'nutripatrol-net' | |
| run: | | |
| # direct container access | |
| echo "OPENFOODFACTS_API_URL=https://off:[email protected]" >> $GITHUB_ENV | |
| # deploy target | |
| echo "SSH_HOST=10.1.0.200" >> $GITHUB_ENV | |
| echo "SSH_PROXY_HOST=ovh1.openfoodfacts.org" >> $GITHUB_ENV | |
| echo "SSH_USERNAME=off" >> $GITHUB_ENV | |
| - name: Wait for docker image container build workflow | |
| uses: tomchv/[email protected] | |
| id: wait-build | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| checkName: build (api) | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| intervalSeconds: 10 | |
| timeoutSeconds: 600 # 10m | |
| - name: Do something if build isn't launch | |
| if: steps.wait-build.outputs.conclusion == 'does not exist' | |
| run: echo job does not exist && true | |
| - name: Do something if build fail | |
| if: steps.wait-build.outputs.conclusion == 'failure' | |
| run: echo fail && false # fail if build fail | |
| - name: Do something if build timeout | |
| if: steps.wait-build.outputs.conclusion == 'timed_out' | |
| run: echo Timeout && false # fail if build time out | |
| - name: Checkout git repository | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| # Clone Git repository if not already there | |
| [ ! -d '${{ matrix.env }}' ] && git clone --depth 1 https://github.com/${{ github.repository }} ${{ matrix.env }} --no-single-branch 2>&1 | |
| # Go to repository directory | |
| cd ${{ matrix.env }} | |
| # Fetch newest commits (in case it wasn't freshly cloned) | |
| git fetch --depth 1 | |
| # Checkout current commit SHA | |
| git checkout -qf ${{ github.sha }} | |
| - name: Set environment variables | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| # Go to repository directory | |
| cd ${{ matrix.env }} | |
| mv .env .env-dev | |
| # init .env | |
| echo "# Env file generated by container-deploy action"> .env | |
| # Set Docker Compose variables | |
| echo "DOCKER_CLIENT_TIMEOUT=180" >> .env | |
| echo "COMPOSE_HTTP_TIMEOUT=180" >> .env | |
| echo "COMPOSE_PROJECT_NAME=nutripatrol" >> .env | |
| echo "COMPOSE_PATH_SEPARATOR=;" >> .env | |
| echo "COMPOSE_FILE=docker-compose.yml;docker/prod.yml" >> .env | |
| # Copy variables that are same as dev | |
| grep '\(STACK_VERSION\|ES_PORT\)' .env-dev >> .env | |
| # Set docker variables | |
| echo "TAG=sha-${{ github.sha }}" >> .env | |
| echo "RESTART_POLICY=always" >> .env | |
| # Set App variables | |
| echo "CLUSTER_NAME=${{ matrix.env }}-es-cluster" >> .env | |
| echo "SEARCH_PORT=8180" >> .env | |
| echo "ES_VUE_PORT=8181" >> .env | |
| echo "REDIS_PORT=8182" >> .env | |
| echo "MEM_LIMIT=4294967296" >> .env | |
| # this is the network shared with productopener | |
| echo "COMMON_NET_NAME=po_webnet">> .env | |
| echo "OPENFOODFACTS_API_URL=${{ env.OPENFOODFACTS_API_URL }}" >> .env | |
| # This secret is to be generated using htpasswd, see .env file | |
| # use simple quotes to avoid interpolation of $apr1$ ! | |
| echo 'NGINX_BASIC_AUTH_USER_PASSWD=${{ secrets.NGINX_BASIC_AUTH_USER_PASSWD }}' >> .env | |
| echo "SENTRY_DNS=${{ secrets.SENTRY_DSN }}" >> .env | |
| echo "CONFIG_PATH=data/config/openfoodfacts.yml" >> .env | |
| - name: Create Docker volumes | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| cd ${{ matrix.env }} | |
| make create_external_volumes | |
| - name: Start services | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| cd ${{ matrix.env }} | |
| docker-compose down | |
| docker-compose up -d --remove-orphans 2>&1 | |
| - name: Check services are up | |
| uses: appleboy/ssh-action@master | |
| if: ${{ always() }} | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| cd ${{ matrix.env }} | |
| make livecheck | |
| - name: Cleanup obsolete Docker objects | |
| uses: appleboy/ssh-action@master | |
| if: ${{ always() }} | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| cd ${{ matrix.env }} | |
| docker system prune -af | |
| - uses: frankie567/[email protected] | |
| if: ${{ always() }} | |
| with: | |
| apiHost: https://grafana.openfoodfacts.org | |
| apiToken: ${{ secrets.GRAFANA_API_TOKEN }} | |
| text: <a href="https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}">Deployment ${{ steps.livecheck.outcome }} on ${{ matrix.env }}</a> | |
| tags: type:deployment,origin:github,status:${{ steps.livecheck.outcome }},repo:${{ github.repository }},sha:${{ github.sha }},app:robotoff,env:${{ matrix.env }} |