Skip to content
2 [on_schedule] deploy main and pro

2 [on_schedule] deploy main and pro #2128

Sign in to view logs

2 [on_schedule] deploy main and pro

2 [on_schedule] deploy main and pro #2128

Workflow file for this run

.github/workflows/dev_on_schedule_deploy_main_and_pro.yml at 6b79585
name: "2 [on_schedule] deploy main and pro"
on:
workflow_dispatch:
schedule:
# This cron is defined in UTC timezone. It means that it will run:
# - during summer hours between 8:28am - 7:28pm
# - during winter hours between 7:28am - 6:28pm
# we cannot yet specify timezone :
# https://github.com/orgs/community/discussions/13454
# Why 27? Choosing an exact hour or half-hour is discouraged by GitHub due to high load.
# Cron jobs might be delayed or even completely skipped.
- cron: "27 6-17 * * 1-5"
permissions: write-all
env:
docker_registry: "europe-west1-docker.pkg.dev/passculture-infra-prod/pass-culture-artifact-registry"
GIT_CONFIG_EMAIL: [email protected]
GIT_CONFIG_NAME: scheduled-testing-deployment
jobs:
pcapi-init-job:
runs-on: ubuntu-latest
outputs:
checksum-tag: ${{ steps.pcapi-tags.outputs.checksum-tag }}
pcapi-exists: ${{ steps.check-checksum-tag.outputs.tag-exists }}
pcapi-console-exists: ${{ steps.check-console-checksum-tag.outputs.tag-exists }}
steps:
- uses: actions/checkout@v6
with:
fetch-tags: false
ref: "master"
- name: "Define pcapi image tags."
id: pcapi-tags
run: |
DOCKER_IMAGE="${{ env.docker_registry }}/pcapi"
API_CHECKSUM=`tar --sort=name --owner=0 --group=0 --mtime='UTC 2019-01-01' -cf - api | sha1sum | awk '{ print $1 }'`
PUSH_TAGS="push-tags=$DOCKER_IMAGE:${{ github.sha }},$DOCKER_IMAGE:$API_CHECKSUM,$DOCKER_IMAGE:latest"
API_TAG="checksum-tag=$API_CHECKSUM"
echo "PUSH_TAGS=$PUSH_TAGS"
echo "API_TAG=$API_TAG"
echo $PUSH_TAGS >> "$GITHUB_OUTPUT"
echo $API_TAG >> "$GITHUB_OUTPUT"
- name: "Authentification to Google"
uses: "google-github-actions/auth@v3"
with:
workload_identity_provider: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}
- name: "Get Secret"
id: secrets
uses: "google-github-actions/get-secretmanager-secrets@v3"
with:
secrets: |-
SLACK_BOT_TOKEN:passculture-metier-ehp/passculture-ci-slack-bot-token
ARTIFACT_REGISTRY_WORKLOAD_IDENTITY_PROVIDER:passculture-metier-ehp/infra-prod-gcp-workload-identity-provider
ARTIFACT_REGISTRY_SERVICE_ACCOUNT:passculture-metier-ehp/passculture-main-artifact-registry-service-account
- name: "OpenID Connect Authentication"
id: "openid-auth"
uses: "google-github-actions/auth@v3"
with:
create_credentials_file: false
token_format: "access_token"
workload_identity_provider: ${{ steps.secrets.outputs.ARTIFACT_REGISTRY_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ steps.secrets.outputs.ARTIFACT_REGISTRY_SERVICE_ACCOUNT }}
- name: "Docker login"
id: "docker-login"
uses: "docker/login-action@v3"
with:
registry: "europe-west1-docker.pkg.dev"
username: "oauth2accesstoken"
password: "${{ steps.openid-auth.outputs.access_token }}"
- name: "check pcapi-console image exists"
id: check-console-checksum-tag
run: ./.github/workflows/scripts/check-image-tag-exists.sh
env:
image: pcapi-console
tag: ${{ github.sha }}
token: ${{ steps.openid-auth.outputs.access_token }}
- name: "check pcapi image exists"
id: check-checksum-tag
run: ./.github/workflows/scripts/check-image-tag-exists.sh
env:
image: pcapi
tag: ${{ github.sha }}
token: ${{ steps.openid-auth.outputs.access_token }}
- name: "Summary"
run: |
echo "[pcapi] push-tags : ${{ steps.pcapi-tags.outputs.push-tags }}"
echo "[pcapi] checksum-tag : ${{ steps.pcapi-tags.outputs.checksum-tag }}"
echo "[pcapi] image tag ${{ steps.pcapi-tags.outputs.checksum-tag }} exists : ${{ steps.check-checksum-tag.outputs.tag-exists }}"
echo "[pcapi-console] image tag ${{ steps.pcapi-tags.outputs.checksum-tag }} exists : ${{ steps.check-console-checksum-tag.outputs.tag-exists }}"
# Theses steps builds pcapi and pcapi-console image, tags them with the last commit sha then
# pushes them to the registry
build-pcapi:
name: "[pcapi] build docker image."
needs: [pcapi-init-job]
if: needs.pcapi-init-job.outputs.pcapi-exists == 'false'
uses: ./.github/workflows/dev_on_workflow_build_docker_image.yml
with:
image: pcapi
tag: ${{ github.sha }}
build-pcapi-console:
name: "[pcapi-console] build docker image."
needs: [pcapi-init-job]
if: needs.pcapi-init-job.outputs.pcapi-console-exists == 'false'
uses: ./.github/workflows/dev_on_workflow_build_docker_image.yml
with:
image: pcapi-console
tag: ${{ github.sha }}
push-pcapi:
name: Push pcapi docker image to artifact registry
needs:
- build-pcapi
- pcapi-init-job
if: needs.pcapi-init-job.outputs.pcapi-exists == 'false'
uses: ./.github/workflows/dev_on_workflow_push_docker_image.yml
with:
image: pcapi
tag: ${{ github.sha }}
tag_latest: true
secrets:
WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}
push-pcapi-console:
name: Push pcapi-console docker image to artifact registry
needs:
- build-pcapi-console
- pcapi-init-job
uses: ./.github/workflows/dev_on_workflow_push_docker_image.yml
if: needs.pcapi-init-job.outputs.pcapi-console-exists == 'false'
with:
image: pcapi-console
tag: ${{ github.sha }}
tag_latest: true
secrets:
WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}
deploy-to-testing:
name: Deploy to testing
needs:
- pcapi-init-job
- push-pcapi
- push-pcapi-console
if: always() && !failure() && !cancelled()
uses: ./.github/workflows/dev_on_workflow_deploy.yml
with:
environment: testing
app_version: ${{ github.sha }}
cluster_scope: metier
cluster_environment: ehp
workload_identity_provider_secret_name: gcp_metier_ehp_workload_identity_provider
apply_algolia_config: true
deploy_api: true
deploy_pro: true
secrets:
GCP_EHP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
GCP_EHP_SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}
PASSCULTURE_GITHUB_ACTION_APP_ID: ${{ secrets.PASSCULTURE_GITHUB_ACTION_APP_ID }}
PASSCULTURE_GITHUB_ACTION_APP_PRIVATE_KEY: ${{ secrets.PASSCULTURE_GITHUB_ACTION_APP_PRIVATE_KEY }}
deploy-to-testing-new-infra:
name: Deploy to testing new infra
needs:
- pcapi-init-job
- push-pcapi
- push-pcapi-console
if: always() && !failure() && !cancelled()
uses: ./.github/workflows/dev_on_workflow_deploy.yml
with:
environment: testing
environment_short_name: tst
app_version: ${{ github.sha }}
workflow_cluster_name: gke-infra-prd-eu9
workflow_project_id: pc-infra-prd
app_cluster_name: gke-backend-tst-eu9
app_project_id: pc-backend-tst
location: europe-west9
is_new_infra: true
workload_identity_provider_secret_name: gcp_metier_ehp_workload_identity_provider
apply_algolia_config: true
deploy_api: true
deploy_pro: true
secrets:
GCP_EHP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
GCP_EHP_SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}
NEW_INFRA_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.WORKLOAD_IDENTITY_PRD }}
NEW_INFRA_PCAPI_DEPLOYER_SERVICE_ACCOUNT: ${{ secrets.PCAPI_CI_SERVICE_ACCOUNT_TST }}
PASSCULTURE_GITHUB_ACTION_APP_ID: ${{ secrets.PASSCULTURE_GITHUB_ACTION_APP_ID }}
PASSCULTURE_GITHUB_ACTION_APP_PRIVATE_KEY: ${{ secrets.PASSCULTURE_GITHUB_ACTION_APP_PRIVATE_KEY }}
deploy-to-ops:
name: "Deploy to ops"
needs:
- pcapi-init-job
- push-pcapi
- push-pcapi-console
- deploy-to-testing
- deploy-to-testing-new-infra
if: always() && !failure() && !cancelled()
uses: ./.github/workflows/dev_on_workflow_deploy.yml
with:
environment: opsv2
environment_short_name: opsv2
app_version: ${{ github.sha }}
workload_identity_provider_secret_name: gcp_metier_ops_workload_identity_provider # to delete after migration
workflow_cluster_name: gke-infra-prd-eu9
workflow_project_id: pc-infra-prd
app_cluster_name: gke-backend-tst-eu9
app_project_id: pc-backend-tst
location: europe-west9
is_new_infra: true
deploy_api: true
secrets:
GCP_EHP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
GCP_EHP_SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}
NEW_INFRA_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.WORKLOAD_IDENTITY_PRD }}
NEW_INFRA_PCAPI_DEPLOYER_SERVICE_ACCOUNT: ${{ secrets.PCAPI_CI_SERVICE_ACCOUNT_OPSV2 }}
PASSCULTURE_GITHUB_ACTION_APP_ID: ${{ secrets.PASSCULTURE_GITHUB_ACTION_APP_ID }}
PASSCULTURE_GITHUB_ACTION_APP_PRIVATE_KEY: ${{ secrets.PASSCULTURE_GITHUB_ACTION_APP_PRIVATE_KEY }}
slack-notify:
name: "Post failure notification on #alertes-deploiement"
needs:
- deploy-to-testing
# TODO : make a second PR to be notified when deploy-to-testing-new-infra fails
# for now we don't want to send false alarms
if: ${{ always() && needs.deploy-to-testing.result == 'failure' }}
uses: ./.github/workflows/dev_on_workflow_post_slack_message.yml
with:
channel: ${{vars.SLACK_ALERTES_DEPLOIEMENT_CHANNEL_ID}}
color: "#A30002"
message: ":github-failure: Le <https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}|déploiement> de `master` sur `testing` a échoué"
secrets:
GCP_EHP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_EHP_WORKLOAD_IDENTITY_PROVIDER }}
GCP_EHP_SERVICE_ACCOUNT: ${{ secrets.GCP_EHP_SERVICE_ACCOUNT }}