-
Notifications
You must be signed in to change notification settings - Fork 3
177 lines (166 loc) · 6.45 KB
/
action-deploy-apps.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
name: Deploy apps
env:
AZ_CLI_VERSION: 2.56.0
on:
workflow_call:
secrets:
AZURE_CLIENT_ID:
required: true
AZURE_TENANT_ID:
required: true
AZURE_SUBSCRIPTION_ID:
required: true
AZURE_RESOURCE_GROUP_NAME:
required: true
AZURE_ENVIRONMENT_KEY_VAULT_NAME:
required: true
AZURE_CONTAINER_APP_ENVIRONMENT_NAME:
required: true
AZURE_APP_INSIGHTS_CONNECTION_STRING:
required: true
AZURE_APP_CONFIGURATION_NAME:
required: true
inputs:
region:
required: true
type: string
environment:
required: true
type: string
dryRun:
description: "If true, the deployment will be validated but not executed."
required: false
type: boolean
default: false
version:
description: "Current version to use as tag"
required: true
type: string
runMigration:
description: "If true, the migration job will be run."
required: false
type: boolean
default: false
concurrency:
# Existing runs are cancelled if someone repeatedly commits to their own Pull Request (PR). However, it does not stop others' dry runs or actual deployments from the main branch.
# Also, the cancellation does not occur on merges to the main branch. Therefore, if multiple merges to main are performed simultaneously, they will just be queued up.
group: deploy-apps-${{ inputs.environment }}-${{ github.ref_name }}-${{ inputs.dryRun }}
# if the dryrun input is true, we want to cancel any running deployments in order to not block the pipeline e.g for environment approvals
cancel-in-progress: ${{ inputs.dryRun }}
jobs:
deploy-migration-job:
name: Deploy migration job to ${{ inputs.environment }}
runs-on: ubuntu-latest
if: ${{ inputs.runMigration }}
environment: ${{inputs.environment}}
permissions:
id-token: write
contents: read
steps:
- name: "Checkout GitHub Action"
uses: actions/checkout@v4
- name: OIDC Login to Azure Public Cloud
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: Deploy migration job (${{ inputs.environment }})
uses: azure/arm-deploy@v2
id: deploy
env:
# parameters
IMAGE_TAG: ${{ inputs.version }}
# secrets
CONTAINER_APP_ENVIRONMENT_NAME: ${{ secrets.AZURE_CONTAINER_APP_ENVIRONMENT_NAME }}
ENVIRONMENT_KEY_VAULT_NAME: ${{ secrets.AZURE_ENVIRONMENT_KEY_VAULT_NAME }}
with:
scope: resourcegroup
template: ./.azure/applications/web-api-migration-job/main.bicep
resourceGroupName: ${{ secrets.AZURE_RESOURCE_GROUP_NAME }}
deploymentMode: Incremental
deploymentName: "dp-be-${{ inputs.environment }}-web-api-migration-job-${{ inputs.version }}"
region: ${{ inputs.region }}
failOnStdErr: false
additionalArguments: "${{inputs.dryRun && '--what-if'}}"
parameters: ./.azure/applications/web-api-migration-job/${{ inputs.environment }}.bicepparam
- name: Start migration job
uses: azure/CLI@v2
if: ${{!inputs.dryRun}}
with:
azcliversion: 2.56.0
inlineScript: |
az containerapp job start -n ${{ steps.deploy.outputs.name }} -g ${{ secrets.AZURE_RESOURCE_GROUP_NAME }}
- name: Verify migration
uses: azure/CLI@v2
if: ${{!inputs.dryRun}}
id: verify-migration
timeout-minutes: 3
with:
azcliversion: ${{ env.AZ_CLI_VERSION }}
inlineScript: |
./.github/tools/containerAppJobVerifier.sh ${{ steps.deploy.outputs.name }} ${{ secrets.AZURE_RESOURCE_GROUP_NAME }} ${{ inputs.version }}
- name: Logout from azure
if: ${{failure() || success()}}
continue-on-error: true
run: az logout
deploy-apps:
name: Deploy ${{ matrix.name }} to ${{ inputs.environment }}
runs-on: ubuntu-latest
# Should run even though the migration job was skipped
if: ${{ always() && !failure() && !cancelled() }}
needs: deploy-migration-job
strategy:
fail-fast: true
matrix:
include:
- name: web-api-eu
- name: web-api-so
- name: graphql
environment: ${{ inputs.environment }}
permissions:
id-token: write
contents: read
steps:
- name: "Checkout GitHub Action"
uses: actions/checkout@v4
- name: OIDC Login to Azure Public Cloud
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
- name: Deploy app ${{ matrix.name }}(${{ inputs.environment }})
uses: azure/arm-deploy@v2
id: deploy
env:
# parameters
IMAGE_TAG: ${{ inputs.version }}
# secrets
CONTAINER_APP_ENVIRONMENT_NAME: ${{ secrets.AZURE_CONTAINER_APP_ENVIRONMENT_NAME }}
APP_INSIGHTS_CONNECTION_STRING: ${{ secrets.AZURE_APP_INSIGHTS_CONNECTION_STRING }}
APP_CONFIGURATION_NAME: ${{ secrets.AZURE_APP_CONFIGURATION_NAME }}
ENVIRONMENT_KEY_VAULT_NAME: ${{ secrets.AZURE_ENVIRONMENT_KEY_VAULT_NAME }}
with:
scope: resourcegroup
template: ./.azure/applications/${{ matrix.name }}/main.bicep
resourceGroupName: ${{ secrets.AZURE_RESOURCE_GROUP_NAME }}
deploymentMode: Incremental
deploymentName: dp-be-${{ inputs.environment }}-${{ matrix.name }}-${{ inputs.version }}
region: ${{ inputs.region }}
failOnStdErr: false
additionalArguments: "${{inputs.dryRun && '--what-if'}}"
parameters: ./.azure/applications/${{ matrix.name }}/${{ inputs.environment }}.bicepparam
- name: Verify deployment (${{ matrix.name }})
uses: azure/CLI@v2
if: ${{!inputs.dryRun}}
id: verify-deployment
timeout-minutes: 3
with:
azcliversion: ${{ env.AZ_CLI_VERSION }}
inlineScript: |
./.github/tools/revisionVerifier.sh ${{ steps.deploy.outputs.revisionName }} ${{ secrets.AZURE_RESOURCE_GROUP_NAME }}
- name: Logout from azure
if: ${{failure() || success()}}
continue-on-error: true
run: az logout