Skip to content

Build 'n Deploy

Build 'n Deploy #42

Workflow file for this run

name: Build 'n Deploy
on:
push:
branches:
- '*'
tags-ignore:
- '*'
paths-ignore:
- 'pyproject.toml'
- 'bumpver.toml'
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
inputs:
venue:
type: choice
description: Venue to deploy to
options:
- SIT
- UAT
jobs:
build:
name: build, lint, and test ingest-to-sds
runs-on: ubuntu-latest
outputs:
deploy_env: ${{ steps.package-build.outputs.deploy_env }}
steps:
# -- Setup --
- uses: getsentry/action-github-app-token@v2
name: my-app-install token
id: podaac-cicd
with:
app_id: ${{ secrets.CICD_APP_ID }}
private_key: ${{ secrets.CICD_APP_PRIVATE_KEY }}
- uses: hashicorp/[email protected]
with:
terraform_version: 1.3.7
- uses: actions/checkout@v3
with:
repository: ${{ github.repository }}
token: ${{ steps.podaac-cicd.outputs.token }}
- uses: actions/setup-python@v4
with:
python-version: '3.9'
- name: Install bumpver & poetry
run: pip3 install bumpver poetry poetry-plugin-bundle
- name: Setup git user
run: |
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
git config user.name "github-actions[bot]"
- name: Install dependencies
run: poetry install
# -- Testing & Linting --
- name: Lint
run: |
poetry run flake8 podaac/ tests/
poetry run pylint podaac/ tests/
- name: Test
run: poetry run pytest
- name: Validate Terraform
run: terraform validate -no-color
- name: No version bump
# If triggered by workflow dispatch, no version bump
if: ${{ github.event_name == 'workflow_dispatch' }}
run: |
echo "TARGET_ENV=${{ github.event.inputs.venue }}" >> $GITHUB_ENV
# -- Version Bumping --
- name: Bump alpha version
if: github.ref == 'refs/heads/develop'
run: |
TAG=$(bumpver show -e | awk -F= '$1 == "TAG" {print $2};')
if [ $TAG == 'final' ]; then
# Bump patch version first then append tag
bumpver update --patch --tag alpha --tag-num
else
bumpver update --tag alpha --tag-num
fi
- name: Bump rc version
if: startsWith(github.ref, 'refs/heads/release/')
run: bumpver --tag rc --tag-num
- name: Release version
if: github.ref == 'refs/heads/main'
run: bumpver --tag final
# -- Build --
- name: Build lambda package
id: package-build
run: ./build.sh
- name: Upload packaged zip
uses: actions/[email protected]
with:
name: dist
path: dist/*.zip
# # -- Terraform --
# - name: Deploy to SIT
# if: github.ref == 'refs/heads/develop'
# working-directory: terraform/
# env:
# AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID_SERVICES_SIT }}
# AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY_SERVICES_SIT }}
# AWS_DEFAULT_REGION: us-west-2
# TF_VAR_sds_ca_cert_path: ${{ runner.temp }}/JPLICA.pem
# TF_VAR_sds_host: ${{ secrets.SDS_HOST }}
# TF_VAR_sds_username: ${{ secrets.SDS_USERNAME }}
# TF_VAR_sds_password: ${{ secrets.SDS_PASSWORD }}
# run: |
# echo "${{ secrets.JPLICA_CERT }}" >> ${{ runner.temp }}/JPLICA.pem
# source bin/config.sh sit
# terraform apply -auto-approve
deploy:
name: Deploy
needs: build
# The type of runner that the job will run on
runs-on: ubuntu-latest
environment:
name: ${{ needs.build.outputs.deploy_env }}
if: |
github.ref == 'refs/heads/develop' ||
github.ref == 'refs/heads/main' ||
startsWith(github.ref, 'refs/heads/release') ||
github.event_name == 'workflow_dispatch'
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-region: us-west-2
role-session-name: GitHubActions
aws-access-key-id: ${{ secrets[vars.AWS_ACCESS_KEY_ID_SECRET_NAME] }}
aws-secret-access-key: ${{ secrets[vars.AWS_SECRET_ACCESS_KEY_SECRET_NAME] }}
mask-aws-account-id: true
- uses: actions/checkout@v3
with:
repository: ${{ github.repository }}
- uses: hashicorp/setup-terraform@v2
with:
terraform_version: ${{ env.TERRAFORM_VERSION }}
terraform_wrapper: false
- name: Retrieve artifact from build step
uses: actions/download-artifact@v3
with:
name: dist
path: dist/
- name: Deploy to venue
id: terraform-deploy
working-directory: terraform/
env:
AWS_DEFAULT_REGION: us-west-2
TF_VAR_edl_base_url: ${{ secrets.EDL_BASE_URL }}
TF_VAR_edl_client_id: ${{ secrets.EDL_CLIENT_ID }}
TF_VAR_edl_client_secret: ${{ secrets.EDL_CLIENT_SECRET }}
TF_VAR_session_encryption_key: ${{ secrets.SESSION_ENCRYPTION_KEY }}
TF_VAR_ingest_aws_account: ${{ secrets.INGEST_AWS_ACCOUNT }}
TF_VAR_ingest_aws_role: ${{ secrets.INGEST_AWS_ROLE }}
run: |
echo "${{ secrets.JPLICA_CERT }}" >> ${{ runner.temp }}/JPLICA.pem
source bin/config.sh ${{ vars.TF_VENUE }}
terraform apply -auto-approve