OracleDesk-Backend/.github/workflows/cd.yml at develop · OracleDesk/OracleDesk-Backend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: CD

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read
  packages: write
  id-token: write
  pull-requests: read

concurrency:
  group: cd-main
  cancel-in-progress: false

jobs:
  verify:
    name: Verify release commit
    uses: ./.github/workflows/ci.yml

  image:
    name: Build, sign and attest image
    needs: verify
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
      tag: ${{ steps.meta.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        run: echo "tag=ghcr.io/${GITHUB_REPOSITORY,,}:${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
      - id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tag }}
          provenance: true
          sbom: true
      - name: Install cosign
        uses: sigstore/cosign-installer@v3
      - name: Sign image
        run: cosign sign --yes "${{ steps.meta.outputs.tag }}@${{ steps.build.outputs.digest }}"
      - name: SBOM (SPDX)
        uses: anchore/sbom-action@v0
        with:
          image: ${{ steps.meta.outputs.tag }}@${{ steps.build.outputs.digest }}
          format: spdx-json
          output-file: sbom.spdx.json
      - uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.spdx.json

  staging:
    name: Deploy staging
    needs: image
    uses: ./.github/workflows/deploy-env.yml
    with:
      environment: staging
      namespace: oracledesk-staging
      image: ghcr.io/${{ github.repository }}@${{ needs.image.outputs.digest }}
      digest: ${{ needs.image.outputs.digest }}
      values_file: values-staging.yaml
    secrets: inherit

  staging-checks:
    name: Staging post-deploy checks
    needs: [image, staging]
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-kubectl@v4
      - name: Checks
        env:
          API_URL: ${{ vars.API_URL }}
          READY_CHECKS: "3"
          INDEXER_STATUS_URL: ${{ vars.INDEXER_STATUS_URL }}
          MAX_INDEXER_LAG_LEDGERS: "120"
          PROMETHEUS_URL: ${{ vars.PROMETHEUS_URL }}
          KUBE_NAMESPACE: oracledesk-staging
          DEPLOYMENTS: api indexer worker
          DIGEST: ${{ needs.image.outputs.digest }}
          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG }}
        run: |
          echo "$KUBECONFIG_DATA" > "$RUNNER_TEMP/kubeconfig"
          export KUBECONFIG="$RUNNER_TEMP/kubeconfig"
          ./scripts/post-deploy-checks.sh

  production:
    name: Deploy production
    needs: [image, staging-checks]
    uses: ./.github/workflows/deploy-env.yml
    with:
      environment: production
      namespace: oracledesk
      image: ghcr.io/${{ github.repository }}@${{ needs.image.outputs.digest }}
      digest: ${{ needs.image.outputs.digest }}
      values_file: values-production.yaml
    secrets: inherit

  production-checks:
    name: Production post-deploy checks
    needs: [image, production]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-kubectl@v4
      - name: Checks
        env:
          API_URL: ${{ vars.API_URL }}
          READY_CHECKS: "5"
          INDEXER_STATUS_URL: ${{ vars.INDEXER_STATUS_URL }}
          MAX_INDEXER_LAG_LEDGERS: "120"
          PROMETHEUS_URL: ${{ vars.PROMETHEUS_URL }}
          KUBE_NAMESPACE: oracledesk
          DEPLOYMENTS: api indexer worker
          DIGEST: ${{ needs.image.outputs.digest }}
          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG }}
        run: |
          echo "$KUBECONFIG_DATA" > "$RUNNER_TEMP/kubeconfig"
          export KUBECONFIG="$RUNNER_TEMP/kubeconfig"
          ./scripts/post-deploy-checks.sh