Skip to content

Commit 5c8af71

Browse files
JeromeBuJeromeBu
committed
ci: ci for deployement of SILL and add workflow to update the project from upstream every day
1 parent fb5846c commit 5c8af71

File tree

2 files changed

+107
-74
lines changed

2 files changed

+107
-74
lines changed

‎.github/workflows/ci.yaml

Lines changed: 72 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -40,94 +40,92 @@ jobs:
4040
runs-on: ubuntu-latest
4141
needs: validations
4242
outputs:
43-
from_version: ${{ steps.step1.outputs.from_version }}
44-
to_version: ${{ steps.step1.outputs.to_version }}
45-
is_upgraded_version: ${{ steps.step1.outputs.is_upgraded_version }}
43+
is_upgraded_in_preprod: ${{ steps.check_version.outputs.is_upgraded_in_preprod }}
44+
is_upgraded_version: ${{ steps.check_version.outputs.is_upgraded_version }}
45+
to_version: ${{ steps.check_version.outputs.to_version }}
46+
from_version: ${{ steps.check_version.outputs.from_version }}
4647
steps:
47-
- uses: garronej/[email protected]
48-
id: step1
49-
with:
50-
action_name: is_package_json_version_upgraded
51-
- run: |
52-
echo "from_version=${{ steps.step1.outputs.from_version }}"
53-
echo "to_version=${{ steps.step1.outputs.to_version }}"
54-
echo "is_upgraded_version=${{ steps.step1.outputs.is_upgraded_version }}"
48+
- uses: actions/checkout@v4
49+
- name: Check version upgrade
50+
id: check_version
51+
run: |
52+
# Get current version from package.json
53+
CURRENT_VERSION=$(jq -r '.version' package.json)
54+
echo "Version in package.json: $CURRENT_VERSION"
5555
56-
create_tag:
57-
name: Create version tag
56+
# Get deployed version from preprod API
57+
PRE_PROD_DEPLOYED_VERSION=$(curl -s "https://code.gouv.fr/sill-preprod/api/getApiVersion" | jq -r '.result.data.json')
58+
PROD_DEPLOYED_VERSION=$(curl -s "https://code.gouv.fr/sill/api/getApiVersion" | jq -r '.result.data.json')
59+
echo "Deployed version in preprod: $PRE_PROD_DEPLOYED_VERSION"
60+
echo "Deployed version in prod: $PROD_DEPLOYED_VERSION"
61+
62+
# Simple comparison: check if versions are different
63+
if [ "$CURRENT_VERSION" != "$PRE_PROD_DEPLOYED_VERSION" ]; then
64+
IS_UPGRADED_IN_PRE_PROD="true"
65+
IS_UPGRADED="true"
66+
echo "✅ Version different from preprod ($PRE_PROD_DEPLOYED_VERSION) and prod ($PROD_DEPLOYED_VERSION), should deploy: $CURRENT_VERSION"
67+
elif [ "$CURRENT_VERSION" != "$PROD_DEPLOYED_VERSION" ]; then
68+
IS_UPGRADED="true"
69+
echo "✅ Version different from prod ($PROD_DEPLOYED_VERSION), should deploy: $CURRENT_VERSION"
70+
else
71+
IS_UPGRADED="false"
72+
echo "ℹ️ Version unchanged: $CURRENT_VERSION"
73+
fi
74+
75+
echo "Is version upgraded: $IS_UPGRADED"
76+
77+
# Set outputs
78+
echo "is_upgraded_version=$IS_UPGRADED" >> $GITHUB_OUTPUT
79+
echo "is_upgraded_in_preprod=$IS_UPGRADED_IN_PRE_PROD" >> $GITHUB_OUTPUT
80+
echo "to_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
81+
echo "from_version=$PRE_PROD_DEPLOYED_VERSION" >> $GITHUB_OUTPUT
82+
83+
trigger_pre_production_deploy:
84+
name: "Trigger pre-production deploy"
5885
runs-on: ubuntu-latest
86+
concurrency:
87+
group: deploy-to-pre-production
88+
cancel-in-progress: true
5989
needs:
6090
- check_if_version_upgraded
61-
if: needs.check_if_version_upgraded.outputs.is_upgraded_version == 'true'
91+
if: needs.check_if_version_upgraded.outputs.is_upgraded_in_preprod == 'true'
6292
env:
6393
TO_VERSION: ${{ needs.check_if_version_upgraded.outputs.to_version }}
6494
steps:
65-
- name: Checkout repository
66-
uses: actions/checkout@v4
67-
- name: Create tag
95+
- run: echo "Triggering production deploy"
96+
- name: Set up SSH
6897
run: |
69-
git config --local user.email "[email protected]"
70-
git config --local user.name "GitHub Actions"
71-
git tag -a v${{ env.TO_VERSION }} -m "Deployment tag for v${{ env.TO_VERSION }}"
72-
git push --tags
98+
mkdir -p ~/.ssh
99+
echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
100+
chmod 600 ~/.ssh/id_ed25519
101+
ssh-keyscan code.gouv.fr >> ~/.ssh/known_hosts
102+
ssh -o StrictHostKeyChecking=no [email protected] "bash -c 'eval \"\$(ssh-agent -s)\" && ssh-add ~/.ssh/sill-data && ./update-sill-preprod.sh v${{ env.TO_VERSION }}'"
103+
env:
104+
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
73105

74-
create_github_release:
75-
name: "Create release notes"
76-
runs-on: ubuntu-latest
77-
needs:
78-
- check_if_version_upgraded
79-
- create_tag
80-
if: |
81-
needs.check_if_version_upgraded.outputs.is_upgraded_version == 'true' && github.event_name == 'push'
82-
env:
83-
RELEASE_TAG: v${{ needs.check_if_version_upgraded.outputs.to_version }}
84-
steps:
85-
- name: "Generate release on github"
86-
uses: softprops/action-gh-release@v2
87-
with:
88-
name: Release ${{ env.RELEASE_TAG }}
89-
prerelease: false
90-
tag_name: ${{ env.RELEASE_TAG }}
91-
generate_release_notes: true
92-
token: ${{ secrets.GITHUB_TOKEN }}
93106

94-
docker:
95-
name: Build and push Docker images
107+
trigger_production_deploy:
108+
name: "Trigger production deploy"
96109
runs-on: ubuntu-latest
110+
environment: production
111+
concurrency:
112+
group: deploy-to-production
113+
cancel-in-progress: true
97114
needs:
115+
- trigger_pre_production_deploy
98116
- check_if_version_upgraded
99-
if: needs.check_if_version_upgraded.outputs.is_upgraded_version == 'true'
117+
if: always() && needs.check_if_version_upgraded.outputs.is_upgraded_version == 'true' && (needs.trigger_pre_production_deploy.result == 'success' || needs.trigger_pre_production_deploy.result == 'skipped')
118+
env:
119+
TO_VERSION: ${{ needs.check_if_version_upgraded.outputs.to_version }}
100120
steps:
101-
- uses: actions/checkout@v4
102-
- uses: docker/setup-qemu-action@v3
103-
- uses: docker/setup-buildx-action@v3
104-
- uses: docker/login-action@v3
105-
with:
106-
username: ${{ secrets.DOCKERHUB_USERNAME }}
107-
password: ${{ secrets.DOCKERHUB_TOKEN }}
108-
- name: Computing Docker image tags
109-
id: step1
110-
env:
111-
TO_VERSION: ${{ needs.check_if_version_upgraded.outputs.to_version }}
121+
- run: echo "Triggering production deploy"
122+
- name: Set up SSH
112123
run: |
113-
OUT_API=$GITHUB_REPOSITORY-api:$TO_VERSION,$GITHUB_REPOSITORY-api:latest
114-
OUT_API=$(echo "$OUT_API" | awk '{print tolower($0)}')
115-
echo ::set-output name=docker_api_tags::$OUT_API
116-
117-
OUT_WEB=$GITHUB_REPOSITORY-web:$TO_VERSION,$GITHUB_REPOSITORY-web:latest
118-
OUT_WEB=$(echo "$OUT_WEB" | awk '{print tolower($0)}')
119-
echo ::set-output name=docker_web_tags::$OUT_WEB
120-
121-
- uses: docker/build-push-action@v5
122-
with:
123-
push: true
124-
context: .
125-
file: ./Dockerfile.api
126-
tags: ${{ steps.step1.outputs.docker_api_tags }}
127-
- uses: docker/build-push-action@v5
128-
with:
129-
push: true
130-
context: .
131-
file: ./Dockerfile.web
132-
tags: ${{ steps.step1.outputs.docker_web_tags }}
124+
mkdir -p ~/.ssh
125+
echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
126+
chmod 600 ~/.ssh/id_ed25519
127+
ssh-keyscan code.gouv.fr >> ~/.ssh/known_hosts
128+
ssh -o StrictHostKeyChecking=no [email protected] "bash -c 'eval \"\$(ssh-agent -s)\" && ssh-add ~/.ssh/sill-data && ./update-sill-docker-compose.sh v${{ env.TO_VERSION }}'"
129+
env:
130+
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
133131

‎.github/workflows/sync-upstream.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Sync upstream
2+
3+
on:
4+
schedule:
5+
- cron: '0 7 * * *' # every day at 7 AM UTC
6+
workflow_dispatch:
7+
8+
jobs:
9+
sync:
10+
name: Sync repository with upstream repository
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout fork
14+
uses: actions/checkout@v4
15+
with:
16+
token: ${{ secrets.PAT_FOR_UPSTREAM_SYNC }}
17+
fetch-depth: 0
18+
19+
- name: Configure Git
20+
run: |
21+
git config user.name "github-actions[bot]"
22+
git config user.email "github-actions[bot]@users.noreply.github.com"
23+
24+
- name: Add upstream remote
25+
run: |
26+
git remote add upstream https://github.com/codegouvfr/sill.git
27+
git fetch upstream
28+
29+
- name: Sync with upstream/main
30+
run: |
31+
git checkout main
32+
git rebase upstream/main
33+
34+
- name: Push to origin
35+
run: git push origin main --force-with-lease --no-verify

0 commit comments

Comments
 (0)