Skip to content
CICD

OPT input control issue fix and improvements (#1180) #1605

Sign in to view logs

OPT input control issue fix and improvements (#1180)

OPT input control issue fix and improvements (#1180) #1605

Workflow file for this run

.github/workflows/cicd.yml at 15f3586
name: CICD
on:
workflow_dispatch:
inputs:
reset-deployments:
description: "Reset deployment: Clean start"
required: false
default: false
type: boolean
push:
branches:
- master
pull_request:
branches:
- master
release:
types:
- released
env:
REGISTRY: ghcr.io/${{ github.repository_owner }}
jobs:
lint:
name: Lint
permissions:
checks: write
contents: write
runs-on: ubuntu-latest
concurrency:
group: ${{ github.workflow }}-lint-${{ matrix.project }}-${{ github.ref }}
cancel-in-progress: true
strategy:
fail-fast: false
matrix:
project:
- api
- web
include:
- project: api
dir: ./src/api
lang: cs
config:
auto_fix: false
continue_on_error: false
check_name: "Dotnet Format (${dir})"
dotnet_format: true
dotnet_format_dir: ./src/api
env: {}
- project: web
dir: ./src/web
lang: js
config:
auto_fix: false
continue_on_error: false
check_name: "${linter} (${dir})"
# ESLint
eslint: true
eslint_dir: ./src/web
eslint_extensions: js,ts,tsx
eslint_args: --ignore-path ../../.gitignore --config .eslintrc.cjs
# Prettier
prettier: true
prettier_dir: ./src/web
prettier_extensions: js,ts,tsx
prettier_args: --ignore-path ../../.gitignore --config prettier.config.cjs
env:
SKIP_ENV_VALIDATION: true
# outputs: # https://github.com/actions/runner/pull/2477
# ${{ matrix.project }}-changes: ${{ steps.filter.outputs.changes }}
steps:
- uses: actions/checkout@v4
- uses: dorny/paths-filter@v3
id: filter
with:
base: master
filters: |-
changes:
- '${{ matrix.dir }}/**'
- uses: actions/setup-node@v4
if: (steps.filter.outputs.changes == 'true' || github.event_name == 'workflow_dispatch') && matrix.lang == 'js'
with:
node-version: 20
cache: yarn
cache-dependency-path: ${{ matrix.dir }}/yarn.lock
- uses: actions/cache@v4
if: (steps.filter.outputs.changes == 'true' || github.event_name == 'workflow_dispatch') && matrix.lang == 'js'
with:
path: ${{ matrix.dir }}/node_modules
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
- run: yarn install --frozen-lockfile
if: (steps.filter.outputs.changes == 'true' || github.event_name == 'workflow_dispatch') && matrix.lang == 'js'
working-directory: ${{ matrix.dir }}
- uses: actions/setup-dotnet@v4
if: (steps.filter.outputs.changes == 'true' || github.event_name == 'workflow_dispatch') && matrix.lang == 'cs'
with:
dotnet-version: 8.x
- uses: wearerequired/lint-action@v2
if: steps.filter.outputs.changes == 'true' || github.event_name == 'workflow_dispatch'
with: ${{ matrix.config }}
env: ${{ matrix.env }}
build:
name: Build and push
permissions:
contents: read
packages: write
runs-on: ubuntu-latest
concurrency:
group: ${{ github.workflow }}-build-${{ matrix.image }}-${{ github.ref }}
cancel-in-progress: true
needs:
- lint
outputs:
image_version: ${{ steps.meta.outputs.version }}
strategy:
matrix:
image:
- yoma-api
- yoma-web
include:
- image: yoma-api
context: ./src/api
helm: ./helm/yoma-api
file: ./src/api/Dockerfile
buildArgs: ""
- image: yoma-web
context: ./src/web
helm: ./helm/yoma-web
file: ./src/web/Dockerfile
buildArgs: |-
NEXT_PUBLIC_ENVIRONMENT=production
steps:
- uses: actions/checkout@v4
- uses: dorny/paths-filter@v3 # https://github.com/actions/runner/pull/2477
id: filter
with:
base: master
filters: |-
changes:
- '${{ matrix.context }}/**'
- '${{ matrix.helm }}/**'
- name: Should build?
id: should-run
run: |-
if [ "${{ github.event_name }}" = "release" ] || \
[ "${{ steps.filter.outputs.changes }}" = "true" ] || \
[ "${{ github.event_name }}" = "workflow_dispatch" ]; then
echo run=true >> $GITHUB_OUTPUT
else
echo run=false >> $GITHUB_OUTPUT
fi
- uses: docker/setup-buildx-action@v3
if: steps.should-run.outputs.run == 'true'
- uses: docker/login-action@v3
if: steps.should-run.outputs.run == 'true'
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ github.token }}
- uses: docker/metadata-action@v5
id: meta
with:
images: ${{ env.REGISTRY }}/${{ matrix.image }}
tags: |
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
type=sha,prefix=pr-${{ github.event.pull_request.number }}-,priority=601,enable=${{ github.event_name == 'pull_request' }}
type=sha,prefix={{branch}}-,priority=601,enable=${{ github.event_name != 'pull_request' && github.event_name != 'release' }}
type=ref,event=branch,priority=600
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
- uses: docker/build-push-action@v6
if: steps.should-run.outputs.run == 'true'
with:
platforms: linux/amd64 # linux/arm64/v8 is a little too slow right now
context: ${{ matrix.context }}
file: ${{ matrix.file }}
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: |
type=gha,scope=build-${{ matrix.image }}
type=registry,ref=${{ env.REGISTRY }}/${{ matrix.image }}:latest
cache-to: type=gha,mode=max,scope=build-${{ matrix.image }}
build-args: ${{ matrix.buildArgs }}
test-e2e:
name: Test (e2e)
permissions:
id-token: write
contents: read
packages: read
needs: build
runs-on: ubuntu-latest
env:
PUBLIC_S3_ACCESS_KEY: ${{ secrets.PUBLIC_S3_ACCESS_KEY }}
PUBLIC_S3_SECRET_KEY: ${{ secrets.PUBLIC_S3_SECRET_KEY }}
PRIVATE_S3_ACCESS_KEY: ${{ secrets.PRIVATE_S3_ACCESS_KEY }}
PRIVATE_S3_SECRET_KEY: ${{ secrets.PRIVATE_S3_SECRET_KEY }}
concurrency:
group: ${{ github.workflow }}-e2e-${{ github.ref }}
cancel-in-progress: true
steps:
- uses: actions/checkout@v4
- uses: dorny/paths-filter@v3 # https://github.com/actions/runner/pull/2477
id: filter
with:
base: master
filters: |-
api:
- './src/api/**'
web:
- './src/web/**'
keycloak:
- './src/keycloak/**'
cypress:
- './cypress/**'
- name: Should e2e run?
id: should-run
run: |-
if [ "${{ github.event_name }}" = "release" ] || \
[ "${{ steps.filter.outputs.api }}" = "true" ] || \
[ "${{ steps.filter.outputs.web }}" = "true" ] || \
[ "${{ steps.filter.outputs.keycloak }}" = "true" ] || \
[ "${{ steps.filter.outputs.cypress }}" = "true" ] || \
[ "${{ github.event_name }}" = "workflow_dispatch" ]; then
echo run=true >> $GITHUB_OUTPUT
else
echo run=false >> $GITHUB_OUTPUT
fi
- uses: docker/login-action@v3
if: steps.should-run.outputs.run == 'true'
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ github.token }}
- name: Create env file
if: steps.should-run.outputs.run == 'true'
run: |
echo "AWSS3__Buckets__Public__AccessKey=${{ secrets.PUBLIC_S3_ACCESS_KEY }}" >> src/api/env.secrets
echo "AWSS3__Buckets__Public__SecretKey=${{ secrets.PUBLIC_S3_SECRET_KEY }}" >> src/api/env.secrets
echo "AWSS3__Buckets__Public__BucketName=yoma-v3-public-storage" >> src/api/env.secrets
echo "AWSS3__Buckets__Private__AccessKey=${{ secrets.PRIVATE_S3_ACCESS_KEY }}" >> src/api/env.secrets
echo "AWSS3__Buckets__Private__SecretKey=${{ secrets.PRIVATE_S3_SECRET_KEY }}" >> src/api/env.secrets
echo "AWSS3__Buckets__Private__BucketName=yoma-v3-private-storage" >> src/api/env.secrets
echo "AriesCloudAPI__BaseUri=${{ secrets.ARIESCLOUDAPI_BASEURI }}" >> src/api/env.secrets
echo "AriesCloudAPI__GroupId=${{ secrets.ARIESCLOUDAPI_GROUPID }}" >> src/api/env.secrets
echo "AriesCloudAPI__ProtocolVersion=v2" >> src/api/env.secrets
echo "AriesCloudAPI__GovernanceAdmin__ClientId=${{ secrets.ARIESCLOUDAPI_GOVERNANCEADMIN_CLIENTID }}" >> src/api/env.secrets
echo "AriesCloudAPI__GovernanceAdmin__ClientSecret=${{ secrets.ARIESCLOUDAPI_GOVERNANCEADMIN_CLIENTSECRET }}" >> src/api/env.secrets
echo "AriesCloudAPI__Customer__ClientId=${{ secrets.ARIESCLOUDAPI_CUSTOMER_CLIENTID }}" >> src/api/env.secrets
echo "AriesCloudAPI__Customer__ClientSecret=${{ secrets.ARIESCLOUDAPI_CUSTOMER_CLIENTSECRET }}" >> src/api/env.secrets
echo "Zlto__Username=${{ secrets.ZLTO_USERNAME }}" >> src/api/env.secrets
echo "Zlto__Password=${{ secrets.ZLTO_PASSWORD }}" >> src/api/env.secrets
echo "AppSettings__SSIIssuerNameYomaOrganization=${{ secrets.APPSETTINGS_SSIISSUERNAMEYOMAORGANIZATION }}" >> src/api/env.secrets
echo "AppSettings__SSISchemaFullNameYoID=${{ secrets.APPSETTINGS_SSISCHEMAFULLNAMEYOID }}" >> src/api/env.secrets
- name: Pre-pull images
if: steps.should-run.outputs.run == 'true'
run: |-
docker compose -f ./src/api/docker-compose.yml pull
docker compose -f ./src/web/docker-compose.yml pull
env:
API_TAG: ${{ steps.filter.outputs.api == 'true' && needs.build.outputs.image_version || 'latest' }}
YOUTH_TAG: ${{ steps.filter.outputs.web == 'true' && needs.build.outputs.image_version || 'latest' }}
continue-on-error: true
- name: Start services
if: steps.should-run.outputs.run == 'true'
run: |-
docker compose -f ./src/api/docker-compose.yml up -d
docker compose -f ./src/web/docker-compose.yml up -d
env:
API_TAG: ${{ steps.filter.outputs.api == 'true' && needs.build.outputs.image_version || 'latest' }}
YOUTH_TAG: ${{ steps.filter.outputs.web == 'true' && needs.build.outputs.image_version || 'latest' }}
- uses: actions/setup-node@v4
if: steps.should-run.outputs.run == 'true'
with:
node-version: 20
cache: yarn
- uses: cypress-io/github-action@v6
if: steps.should-run.outputs.run == 'true'
- name: Upload Cypress Screenshots
uses: actions/upload-artifact@v4
if: always()
with:
name: cypress-screenshots
path: cypress/screenshots
if-no-files-found: ignore
- name: Upload Cypress Recording
uses: actions/upload-artifact@v4
if: always()
with:
name: cypress-videos
path: cypress/videos
if-no-files-found: ignore
- name: Keycloak Config logs
if: always() && steps.should-run.outputs.run == 'true'
run: docker logs keycloak-config
- name: Keycloak logs
if: always() && steps.should-run.outputs.run == 'true'
run: docker logs keycloak
- name: Yoma API logs
if: always() && steps.should-run.outputs.run == 'true'
run: docker logs yoma-api
- name: Yoma Web logs
if: always() && steps.should-run.outputs.run == 'true'
run: docker logs yoma-web
- run: docker compose down -v
deploy:
name: Deploy
permissions:
id-token: write
contents: write
packages: read
needs: [test-e2e, build]
runs-on: ubuntu-latest
env:
TAILSCALE_VERSION: 1.72.1
HELMFILE_VERSION: v0.167.1
HELM_VERSION: v3.15.4
TAG: ${{ needs.build.outputs.image_version }}
concurrency:
group: ${{ github.workflow }}-deploy-${{ github.event_name == 'release' && 'prod' || (github.event_name == 'push' && github.event.repository.default_branch == github.ref_name) && 'stage' || 'dev' }}
cancel-in-progress: false
environment:
name: ${{
github.event.inputs.reset-deployments == 'true' && 'dev' ||
github.event_name == 'release' && 'prod' ||
(github.event_name == 'push' && github.event.repository.default_branch == github.ref_name) && 'stage' ||
'dev'
}}
url: ${{ vars.PUBLIC_URL }}
if: github.triggering_actor != 'dependabot[bot]'
steps:
- uses: actions/checkout@v4
- uses: dorny/paths-filter@v3 # https://github.com/actions/runner/pull/2477
id: filter
with:
base: master
filters: |-
api:
- './src/api/**'
- './helm/yoma-api/**'
web:
- './src/web/**'
- './helm/yoma-web/**'
keycloak:
- './src/keycloak/**'
- './helm/keycloak/**'
- name: Should deploy?
id: should-run
run: |-
if [ "${{ github.event_name }}" = "release" ] || \
[ "${{ steps.filter.outputs.api }}" = "true" ] || \
[ "${{ steps.filter.outputs.web }}" = "true" ] || \
[ "${{ steps.filter.outputs.keycloak }}" = "true" ] || \
[ "${{ github.event_name }}" = "workflow_dispatch" ]; then
echo run=true >> $GITHUB_OUTPUT
else
echo run=false >> $GITHUB_OUTPUT
fi
- uses: unfor19/install-aws-cli-action@v1
if: steps.should-run.outputs.run == 'true'
- name: SOPS Binary Installer
if: steps.should-run.outputs.run == 'true'
uses: mdgreenwald/[email protected]
- uses: aws-actions/configure-aws-credentials@v4
if: steps.should-run.outputs.run == 'true'
with:
aws-region: ${{ secrets.AWS_REGION }}
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
role-session-name: github-cicd
- run: aws eks update-kubeconfig --name ${{ secrets.CLUSTER }}
if: steps.should-run.outputs.run == 'true'
- uses: tailscale/github-action@main
if: steps.should-run.outputs.run == 'true'
with:
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
version: ${{ env.TAILSCALE_VERSION }}
- name: Helmfile Destroy
if: github.event.inputs.reset-deployments == 'true'
uses: helmfile/[email protected]
with:
helmfile-args: |
destroy \
--environment dev
helm-plugins: |
https://github.com/databus23/helm-diff,
https://github.com/jkroepke/helm-secrets,
https://github.com/aslafy-z/helm-git
helmfile-version: ${{ env.HELMFILE_VERSION }}
helm-version: ${{ env.HELM_VERSION }}
- name: Delete Pods and PVCs
if: github.event.inputs.reset-deployments == 'true'
run: kubectl delete pods,pvc --all --namespace yoma-v3-dev
- name: Deploy fresh DBs
if: github.event.inputs.reset-deployments == 'true'
uses: helmfile/[email protected]
with:
helmfile-args: |
apply \
--environment dev \
--selector=app=postgresql-keycloak \
--selector=app=postgresql \
--selector=app=redis
helmfile-version: ${{ env.HELMFILE_VERSION }}
helm-version: ${{ env.HELM_VERSION }}
helm-plugins: |
https://github.com/databus23/helm-diff,
https://github.com/jkroepke/helm-secrets,
https://github.com/aslafy-z/helm-git
# Diff on PR draft, otherwise Apply
- name: Helmfile Apply/Diff Keycloak
if: (
github.event_name == 'release' ||
steps.filter.outputs.keycloak == 'true' ||
github.event_name == 'workflow_dispatch'
) && steps.should-run.outputs.run == 'true'
uses: helmfile/[email protected]
with:
helmfile-args: |
${{ (github.event_name == 'pull_request' && github.event.pull_request.draft) && 'diff' || 'apply' }} \
--environment ${{ vars.ENVIRONMENT }} \
--selector app=keycloak \
--set config-cli.init.ref=${{ github.event_name == 'release' && github.ref_name || github.sha }} \
--set keycloak.providers.ref=${{ github.event_name == 'release' && github.ref_name || github.sha }} \
--set postInstallHook.ref=${{ github.event_name == 'release' && github.ref_name || github.sha }}
helmfile-version: ${{ env.HELMFILE_VERSION }}
helm-version: ${{ env.HELM_VERSION }}
helm-plugins: |
https://github.com/databus23/helm-diff,
https://github.com/jkroepke/helm-secrets,
https://github.com/aslafy-z/helm-git
- name: Helmfile Apply/Diff API
if: (
github.event_name == 'release' ||
steps.filter.outputs.api == 'true' ||
github.event_name == 'workflow_dispatch'
) && steps.should-run.outputs.run == 'true'
uses: helmfile/[email protected]
with:
helmfile-args: |
${{ (github.event_name == 'pull_request' && github.event.pull_request.draft) && 'diff' || 'apply' }} \
--environment ${{ vars.ENVIRONMENT }} \
--selector app=yoma-api \
--set postInstallHook.ref=${{ github.event_name == 'release' && github.ref_name || github.sha }}
helmfile-version: ${{ env.HELMFILE_VERSION }}
helm-version: ${{ env.HELM_VERSION }}
helm-plugins: |
https://github.com/databus23/helm-diff,
https://github.com/jkroepke/helm-secrets,
https://github.com/aslafy-z/helm-git
- name: Trigger Vercel Production Deployment
if: github.event_name == 'release'
run: |
git branch -f vercel/prod
git push -f origin vercel/prod
- name: Helmfile Apply/Diff Web
if: (
github.event_name == 'release' ||
steps.filter.outputs.web == 'true' ||
github.event_name == 'workflow_dispatch'
) && steps.should-run.outputs.run == 'true'
uses: helmfile/[email protected]
with:
helmfile-args: |
${{ (github.event_name == 'pull_request' && github.event.pull_request.draft) && 'diff' || 'apply' }} \
--environment ${{ vars.ENVIRONMENT }} \
--selector app=yoma-web
helmfile-version: ${{ env.HELMFILE_VERSION }}
helm-version: ${{ env.HELM_VERSION }}
helm-plugins: |
https://github.com/databus23/helm-diff,
https://github.com/jkroepke/helm-secrets,
https://github.com/aslafy-z/helm-git