Skip to content

Commit 5e8328d

Browse files
Yam1xYam1x
authored
ci: #35: migrate workflow for deploy to prod and run e2e tests from items-api to sync and use the actual version
2 parents b31210a + f71916d commit 5e8328d

14 files changed

Lines changed: 346 additions & 175 deletions

‎.devcontainer/devcontainer.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,10 @@
2020
}
2121
},
2222
"containerEnv": {
23-
"AUTH_API_ROOT_URL": "http://localhost:8504/api",
24-
"API_ROOT_URL": "http://localhost:6504",
23+
"AUTH_FIRST_TENANT_LOGIN_WITH_ALL_PERMISSIONS": "first-tenant-login-with-all-permissions",
24+
"AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS": "first-tenant-password-with-all-permissions",
25+
"AUTH_API_ROOT_URL": "http://localhost:8504/api/auth",
26+
"API_ROOT_URL": "http://localhost:6504/api/documents",
2527
"SHOULD_USE_FAKE_EXTERNAL_DEPENDENCIES": "true"
2628
}
2729
}

‎.dockerignore‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,44 @@
2323
**/values.dev.yaml
2424
LICENSE
2525
README.md
26-
target/
26+
!**/.gitignore
27+
!.git/HEAD
28+
!.git/config
29+
!.git/packed-refs
30+
!.git/refs/heads/**
31+
32+
# we don't need tests and their related code in production
33+
**/*Tests.cs
34+
**/*TestsRelated.cs
35+
36+
**/bin/*
37+
**/obj/*
38+
**/.vs/*
39+
**/.vscode/*
40+
**.user
41+
**.http
42+
43+
**/appsettings.**
44+
# need to include these files for tests execution in docker compose even though these maigh not be used in prod
45+
!**/appsettings.json
46+
!**/appsettings.MockForPullRequest.json
47+
48+
**/Dockerfile
49+
**/lib/*
50+
51+
.devcontainer/
52+
.github/
53+
target/
54+
ci/
55+
e2e/
56+
57+
.dockerignore
58+
.editorconfig
59+
.gitattributes
60+
.gitignore
61+
docker-compose.yml
62+
LICENSE
63+
pgAdmin.json
64+
README.md
65+
release.config.cjs
66+
release.rules.cjs

‎.github/workflows/.reusable-docker-build-and-push.yml‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
name: Publish Docker image
2+
3+
# !!! NEVER add on push when there is on workflow_call
4+
# if you do that the workflow can run multiple times
5+
# for instance if you re-use this docker build workflow for prod deployment and for local-env in PR
6+
# it will build the docker image it twice
7+
# if you build => deploy => run e2e against prod it will build the image 3 times!
8+
on:
9+
# to allow to wait for a docker image to be published to proceed in another workflow
10+
workflow_call:
11+
12+
jobs:
13+
build-amd64:
14+
runs-on: ubuntu-24.04
15+
steps:
16+
- name: Check out the repo
17+
uses: actions/checkout@v4
18+
19+
# this is needed to address this issue according to the comment https://github.com/devcontainers/ci/issues/271#issuecomment-2301764487
20+
# otherwise our TourmalineCore org name cannot be used in docker image names, only tourmalinecore
21+
- name: Add Registry Image Env Var With Lowercase Organization and Repo Name
22+
run: |
23+
echo "REGISTRY_IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV}
24+
- name: Prepare
25+
run: |
26+
platform=linux/amd64
27+
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
28+
- name: Docker meta
29+
id: meta
30+
uses: docker/metadata-action@v5
31+
with:
32+
images: ${{ env.REGISTRY_IMAGE }}
33+
34+
- name: Log in to GitHub Container Registry
35+
uses: docker/login-action@v3
36+
with:
37+
registry: ghcr.io
38+
username: ${{ github.actor }}
39+
password: ${{ secrets.GITHUB_TOKEN }}
40+
41+
- name: Set up Docker Buildx
42+
uses: docker/setup-buildx-action@v3
43+
44+
- name: Build and push by digest
45+
id: build
46+
uses: docker/build-push-action@v6
47+
with:
48+
platforms: linux/amd64
49+
context: .
50+
file: ./Api/Dockerfile
51+
build-args: |
52+
EXCLUDE_UNIT_TESTS_FROM_BUILD=true
53+
labels: ${{ steps.meta.outputs.labels }}
54+
tags: ${{ env.REGISTRY_IMAGE }}
55+
outputs: type=image,push-by-digest=true,name-canonical=true,push=true
56+
57+
- name: Export digest
58+
run: |
59+
mkdir -p ${{ runner.temp }}/digests
60+
digest="${{ steps.build.outputs.digest }}"
61+
touch "${{ runner.temp }}/digests/${digest#sha256:}"
62+
- name: Upload digest
63+
uses: actions/upload-artifact@v4
64+
with:
65+
name: digests-${{ env.PLATFORM_PAIR }}
66+
path: ${{ runner.temp }}/digests/*
67+
if-no-files-found: error
68+
retention-days: 1
69+
70+
build-arm64:
71+
runs-on: ubuntu-24.04-arm
72+
steps:
73+
- name: Check out the repo
74+
uses: actions/checkout@v4
75+
76+
# this is needed to address this issue according to the comment https://github.com/devcontainers/ci/issues/271#issuecomment-2301764487
77+
# otherwise our TourmalineCore org name cannot be used in docker image names, only tourmalinecore
78+
- name: Add Registry Image Env Var With Lowercase Organization and Repo Name
79+
run: |
80+
echo "REGISTRY_IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV}
81+
- name: Prepare
82+
run: |
83+
platform=linux/arm64
84+
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
85+
- name: Docker meta
86+
id: meta
87+
uses: docker/metadata-action@v5
88+
with:
89+
images: ${{ env.REGISTRY_IMAGE }}
90+
91+
- name: Log in to GitHub Container Registry
92+
uses: docker/login-action@v3
93+
with:
94+
registry: ghcr.io
95+
username: ${{ github.actor }}
96+
password: ${{ secrets.GITHUB_TOKEN }}
97+
98+
- name: Set up Docker Buildx
99+
uses: docker/setup-buildx-action@v3
100+
101+
- name: Build and push by digest
102+
id: build
103+
uses: docker/build-push-action@v6
104+
with:
105+
platforms: linux/arm64
106+
context: .
107+
file: ./Api/Dockerfile
108+
build-args: |
109+
EXCLUDE_UNIT_TESTS_FROM_BUILD=true
110+
labels: ${{ steps.meta.outputs.labels }}
111+
tags: ${{ env.REGISTRY_IMAGE }}
112+
outputs: type=image,push-by-digest=true,name-canonical=true,push=true
113+
114+
- name: Export digest
115+
run: |
116+
mkdir -p ${{ runner.temp }}/digests
117+
digest="${{ steps.build.outputs.digest }}"
118+
touch "${{ runner.temp }}/digests/${digest#sha256:}"
119+
- name: Upload digest
120+
uses: actions/upload-artifact@v4
121+
with:
122+
name: digests-${{ env.PLATFORM_PAIR }}
123+
path: ${{ runner.temp }}/digests/*
124+
if-no-files-found: error
125+
retention-days: 1
126+
merge:
127+
runs-on: ubuntu-24.04
128+
needs:
129+
- build-amd64
130+
- build-arm64
131+
steps:
132+
# this is needed to address this issue according to the comment https://github.com/devcontainers/ci/issues/271#issuecomment-2301764487
133+
# otherwise our TourmalineCore org name cannot be used in docker image names, only tourmalinecore
134+
- name: Add Registry Image Env Var With Lowercase Organization and Repo Name
135+
run: |
136+
echo "REGISTRY_IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >>${GITHUB_ENV}
137+
- name: Download digests
138+
uses: actions/download-artifact@v4
139+
with:
140+
path: ${{ runner.temp }}/digests
141+
pattern: digests-*
142+
merge-multiple: true
143+
144+
- name: Log in to GitHub Container Registry
145+
uses: docker/login-action@v3
146+
with:
147+
registry: ghcr.io
148+
username: ${{ github.actor }}
149+
password: ${{ secrets.GITHUB_TOKEN }}
150+
151+
- name: Set up Docker Buildx
152+
uses: docker/setup-buildx-action@v3
153+
154+
- name: Extract metadata (tags, labels) for Docker
155+
id: meta
156+
uses: docker/metadata-action@v5
157+
with:
158+
images: ${{ env.REGISTRY_IMAGE }}
159+
tags: |
160+
# minimal (short sha)
161+
type=sha
162+
# full length sha
163+
type=sha,format=long
164+
# set latest tag for default branch
165+
# https://github.com/docker/metadata-action/issues/171 explains how to tag latest only on default branch
166+
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
167+
env:
168+
# https://github.com/docker/metadata-action/issues/283
169+
# without this flag it won't tag the image using the commit SHA
170+
# for non push events like pull_request ones it requires this :(
171+
DOCKER_METADATA_PR_HEAD_SHA: true
172+
173+
- name: Create manifest list and push
174+
working-directory: ${{ runner.temp }}/digests
175+
run: |
176+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
177+
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
178+
- name: Inspect image
179+
run: |
180+
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}

‎.github/workflows/.reusable-e2e-tests-against-prod.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: E2E Tests Against Prod
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
e2e-test-against-prod:
8+
runs-on: ubuntu-24.04
9+
steps:
10+
- uses: actions/checkout@v4
11+
12+
- name: Set up JDK 17
13+
uses: actions/setup-java@v3
14+
with:
15+
java-version: '17'
16+
distribution: 'temurin'
17+
18+
- name: Download Karate JAR
19+
run: |
20+
curl -L https://github.com/karatelabs/karate/releases/download/v1.5.1/karate-1.5.1.jar -o karate.jar
21+
22+
- name: Run E2E Tests Against Prod Env
23+
run: |
24+
# Learn more about '> /dev/null 2>&1': https://stackoverflow.com/a/42919998
25+
# In essence it merges output and error streams and doesn't show errors in the terminal to avoid leakage of secrets in the pipeline
26+
java -jar karate.jar . > /dev/null 2>&1
27+
env:
28+
"AUTH_FIRST_TENANT_LOGIN_WITH_ALL_PERMISSIONS": ${{ secrets.INNER_CIRCLE_PROD_AUTH_FIRST_TENANT_LOGIN_WITH_ALL_PERMISSIONS }}
29+
"AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS": ${{ secrets.INNER_CIRCLE_PROD_AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS }}
30+
"AUTH_API_ROOT_URL": ${{ secrets.INNER_CIRCLE_PROD_AUTH_API_ROOT_URL }}
31+
"API_ROOT_URL": ${{ secrets.INNER_CIRCLE_PROD_DOCUMENTS_API_ROOT_URL }}
32+
"SHOULD_USE_FAKE_EXTERNAL_DEPENDENCIES": "false"

‎.github/workflows/deploy-to-prod-from-default.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Deploy to Prod
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
jobs:
9+
docker-build-and-push:
10+
uses: ./.github/workflows/.reusable-docker-build-and-push.yml
11+
12+
deploy-to-prod:
13+
needs: [docker-build-and-push]
14+
runs-on: self-hosted
15+
steps:
16+
- name: Check out the repo
17+
uses: actions/checkout@v4
18+
19+
- name: Deploy
20+
env:
21+
# DB Connection String var is used as env to properly process spec symbols
22+
INNER_CIRCLE_PROD_DOCUMENTS_DB_CONNECTION_STRING: ${{ secrets.INNER_CIRCLE_PROD_DOCUMENTS_DB_CONNECTION_STRING }}
23+
run: |
24+
helmfile cache cleanup && helmfile apply --suppress-diff --namespace "${{ secrets.INNER_CIRCLE_PROD_NAMESPACE }}" -f Api/ci/helmfile.yaml \
25+
--state-values-set image.tag="sha-${{ github.sha }}" \
26+
--state-values-set ingress.hostname="${{ secrets.INNER_CIRCLE_PROD_HOSTNAME }}" \
27+
--state-values-set extraSecretEnvVars.ConnectionStrings__DefaultConnection="$INNER_CIRCLE_PROD_DOCUMENTS_DB_CONNECTION_STRING" \
28+
--state-values-set extraSecretEnvVars.AuthenticationOptions__PublicSigningKey="${{ secrets.INNER_CIRCLE_PROD_PUBLIC_SIGNING_KEY }}" \
29+
--state-values-set extraSecretEnvVars.InnerCircleServiceUrls__EmployeesServiceUrl="${{ secrets.INNER_CIRCLE_PROD_EMPLOYEES_API_ROOT_URL }}" \
30+
--state-values-set extraSecretEnvVars.InnerCircleServiceUrls__EmailSenderServiceUrl="${{ secrets.INNER_CIRCLE_PROD_EMAIL_SENDER_API_ROOT_URL }}" > /dev/null 2>&1
31+
32+
run-e2e-tests:
33+
uses: ./.github/workflows/.reusable-e2e-tests-against-prod.yml
34+
needs: [deploy-to-prod]
35+
secrets: inherit

‎.github/workflows/docker-build-and-push.yml‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

0 commit comments

Comments
 (0)