From bff9af059281a68a4d6a02609c560da9986b98a1 Mon Sep 17 00:00:00 2001 From: Phil Varner Date: Fri, 17 May 2024 16:53:03 -0400 Subject: [PATCH] rework ci deploy --- .github/workflows/ci.yaml | 200 ++++++++++++++++++++++++- .github/workflows/deploy-reusable.yaml | 107 ------------- 2 files changed, 193 insertions(+), 114 deletions(-) delete mode 100644 .github/workflows/deploy-reusable.yaml diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index b7db9bd..1cbbf23 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1,15 +1,201 @@ name: Release CI +env: + project-name: mmw + fd-aws-tf-modules-version: v2.23.0 + on: push: branches: ["main"] tags: ["v*.*.*"] jobs: - deploy: - uses: ./.github/workflows/deploy-reusable.yaml - secrets: inherit - with: - project-name: mmw - stage: ${{ vars.STAGE }} - fd-aws-tf-modules-version: v2.23.0 + deploy-staging: + environment: + name: staging + url: https://console.staging.modelmywatershed.org + permissions: + id-token: write + contents: read + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + + - uses: hashicorp/setup-terraform@v3 + with: + terraform_version: "1.7.5" + + - name: Preparing Environment + id: prep_env + run: | + echo "Creating terraform backend file ..." + echo '' > config.s3.backend.tf + echo 'terraform {' >> config.s3.backend.tf + echo ' backend "s3" {' >> config.s3.backend.tf + echo ' encrypt = true' >> config.s3.backend.tf + echo " bucket = \"${{ secrets.TF_STATE_BUCKET }}\"" >> config.s3.backend.tf + echo " dynamodb_table = \"${{ secrets.TF_STATE_LOCK_TABLE }}\"" >> config.s3.backend.tf + echo " key = \"${{ env.project-name }}-${{ env.stage }}.tfstate\"" >> config.s3.backend.tf + echo " region = \"${{ secrets.AWS_REGION }}\"" >> config.s3.backend.tf + echo ' }' >> config.s3.backend.tf + echo '}' >> config.s3.backend.tf + cat config.s3.backend.tf + echo "Using FilmDrop Terraform ${{ env.fd-aws-tf-modules-version }} release..." + ./scripts/retrieve_tf_modules.sh ${{ env.fd-aws-tf-modules-version }} + + - name: Configure Terraform Init Credentials + id: init_creds + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-region: ${{ secrets.AWS_REGION }} + role-to-assume: ${{ secrets.AWS_ROLE }} + role-session-name: GitHubReleaseInit + + - name: Terraform Init + id: tf_init + run: terraform init + + - name: Terraform Validate + id: tf_validate + run: terraform validate + + - name: Configure Terraform Plan Credentials + id: plan_creds + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-region: ${{ secrets.AWS_REGION }} + role-to-assume: ${{ secrets.AWS_ROLE }} + role-session-name: GitHubReleasePlan + + - name: Terraform Plan + id: tf_plan + run: terraform plan -var-file="${{ env.stage }}.tfvars" -out ${{ env.stage }}.tfplan -lock=false + + - name: Configure Terraform Apply Credentials + id: apply_creds + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-region: ${{ secrets.AWS_REGION }} + role-to-assume: ${{ secrets.AWS_ROLE }} + role-session-name: GitHubReleaseApply + + - name: Terraform Apply + id: tf_apply + run: terraform apply -lock=false -input=false ${{ env.stage }}.tfplan + + - name: Post status to Slack channel + id: tf_apply_successs + if: steps.tf_apply.outcome == 'success' + continue-on-error: true + uses: slackapi/slack-github-action@v1.26.0 + with: + channel-id: ${{ secrets.SLACK_CHANNEL_ID }} + slack-message: ":badger_dance: ${{ env.project-name }}-${{ env.stage }}-titiler ${{ github.ref_name }} terraform apply job has succeeded!\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}" + env: + SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} + + - name: Post status to Slack channel + id: tf_apply_failure + if: steps.tf_apply.outcome != 'success' + continue-on-error: true + uses: slackapi/slack-github-action@v1.26.0 + with: + channel-id: ${{ secrets.SLACK_CHANNEL_ID }} + slack-message: ":sadpanda: ${{ env.project-name }}-${{ env.stage }}-titiler ${{ github.ref_name }} terraform apply has failed!\n:alert: make sure cleanup job deletes all AWS resources!\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}" + env: + SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} + + deploy-prod: + environment: + name: prod + url: https://console.modelmywatershed.org + permissions: + id-token: write + contents: read + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + + - uses: hashicorp/setup-terraform@v3 + with: + terraform_version: "1.7.5" + + - name: Preparing Environment + id: prep_env + run: | + echo "Creating terraform backend file ..." + echo '' > config.s3.backend.tf + echo 'terraform {' >> config.s3.backend.tf + echo ' backend "s3" {' >> config.s3.backend.tf + echo ' encrypt = true' >> config.s3.backend.tf + echo " bucket = \"${{ secrets.TF_STATE_BUCKET }}\"" >> config.s3.backend.tf + echo " dynamodb_table = \"${{ secrets.TF_STATE_LOCK_TABLE }}\"" >> config.s3.backend.tf + echo " key = \"${{ env.project-name }}-${{ env.stage }}.tfstate\"" >> config.s3.backend.tf + echo " region = \"${{ secrets.AWS_REGION }}\"" >> config.s3.backend.tf + echo ' }' >> config.s3.backend.tf + echo '}' >> config.s3.backend.tf + cat config.s3.backend.tf + echo "Using FilmDrop Terraform ${{ env.fd-aws-tf-modules-version }} release..." + ./scripts/retrieve_tf_modules.sh ${{ env.fd-aws-tf-modules-version }} + + - name: Configure Terraform Init Credentials + id: init_creds + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-region: ${{ secrets.AWS_REGION }} + role-to-assume: ${{ secrets.AWS_ROLE }} + role-session-name: GitHubReleaseInit + + - name: Terraform Init + id: tf_init + run: terraform init + + - name: Terraform Validate + id: tf_validate + run: terraform validate + + - name: Configure Terraform Plan Credentials + id: plan_creds + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-region: ${{ secrets.AWS_REGION }} + role-to-assume: ${{ secrets.AWS_ROLE }} + role-session-name: GitHubReleasePlan + + - name: Terraform Plan + id: tf_plan + run: terraform plan -var-file="${{ env.stage }}.tfvars" -out ${{ env.stage }}.tfplan -lock=false + + - name: Configure Terraform Apply Credentials + id: apply_creds + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-region: ${{ secrets.AWS_REGION }} + role-to-assume: ${{ secrets.AWS_ROLE }} + role-session-name: GitHubReleaseApply + + - name: Terraform Apply + id: tf_apply + run: terraform apply -lock=false -input=false ${{ env.stage }}.tfplan + + - name: Post status to Slack channel + id: tf_apply_successs + if: steps.tf_apply.outcome == 'success' + continue-on-error: true + uses: slackapi/slack-github-action@v1.26.0 + with: + channel-id: ${{ secrets.SLACK_CHANNEL_ID }} + slack-message: ":badger_dance: ${{ env.project-name }}-${{ env.stage }}-titiler ${{ github.ref_name }} terraform apply job has succeeded!\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}" + env: + SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} + + - name: Post status to Slack channel + id: tf_apply_failure + if: steps.tf_apply.outcome != 'success' + continue-on-error: true + uses: slackapi/slack-github-action@v1.26.0 + with: + channel-id: ${{ secrets.SLACK_CHANNEL_ID }} + slack-message: ":sadpanda: ${{ env.project-name }}-${{ env.stage }}-titiler ${{ github.ref_name }} terraform apply has failed!\n:alert: make sure cleanup job deletes all AWS resources!\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}" + env: + SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/deploy-reusable.yaml b/.github/workflows/deploy-reusable.yaml deleted file mode 100644 index 1de3cc2..0000000 --- a/.github/workflows/deploy-reusable.yaml +++ /dev/null @@ -1,107 +0,0 @@ -name: Deploy Workflow - -on: - workflow_call: - inputs: - project-name: - required: true - type: string - stage: - required: true - type: string - fd-aws-tf-modules-version: - required: true - type: string - -jobs: - deploy: - permissions: - id-token: write - contents: read - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - - uses: hashicorp/setup-terraform@v3 - with: - terraform_version: "1.7.5" - - - name: Preparing Environment - id: prep_env - run: | - echo "Creating terraform backend file ..." - echo '' > config.s3.backend.tf - echo 'terraform {' >> config.s3.backend.tf - echo ' backend "s3" {' >> config.s3.backend.tf - echo ' encrypt = true' >> config.s3.backend.tf - echo " bucket = \"${{ secrets.TF_STATE_BUCKET }}\"" >> config.s3.backend.tf - echo " dynamodb_table = \"${{ secrets.TF_STATE_LOCK_TABLE }}\"" >> config.s3.backend.tf - echo " key = \"${{ inputs.project-name }}-${{ inputs.stage }}.tfstate\"" >> config.s3.backend.tf - echo " region = \"${{ secrets.AWS_REGION }}\"" >> config.s3.backend.tf - echo ' }' >> config.s3.backend.tf - echo '}' >> config.s3.backend.tf - cat config.s3.backend.tf - echo "Using FilmDrop Terraform ${{ inputs.fd-aws-tf-modules-version }} release..." - ./scripts/retrieve_tf_modules.sh ${{ inputs.fd-aws-tf-modules-version }} - - - name: Configure Terraform Init Credentials - id: init_creds - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: ${{ secrets.AWS_REGION }} - role-to-assume: ${{ secrets.AWS_ROLE }} - role-session-name: GitHubReleaseInit - - - name: Terraform Init - id: tf_init - run: terraform init - - - name: Terraform Validate - id: tf_validate - run: terraform validate - - - name: Configure Terraform Plan Credentials - id: plan_creds - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: ${{ secrets.AWS_REGION }} - role-to-assume: ${{ secrets.AWS_ROLE }} - role-session-name: GitHubReleasePlan - - - name: Terraform Plan - id: tf_plan - run: terraform plan -var-file="${{ inputs.stage }}.tfvars" -out ${{ inputs.stage }}.tfplan -lock=false - - - name: Configure Terraform Apply Credentials - id: apply_creds - uses: aws-actions/configure-aws-credentials@v4 - with: - aws-region: ${{ secrets.AWS_REGION }} - role-to-assume: ${{ secrets.AWS_ROLE }} - role-session-name: GitHubReleaseApply - - - name: Terraform Apply - id: tf_apply - run: terraform apply -lock=false -input=false ${{ inputs.stage }}.tfplan - - - name: Post status to Slack channel - id: tf_apply_successs - if: steps.tf_apply.outcome == 'success' - continue-on-error: true - uses: slackapi/slack-github-action@v1.26.0 - with: - channel-id: ${{ secrets.SLACK_CHANNEL_ID }} - slack-message: ":badger_dance: ${{ inputs.project-name }}-${{ inputs.stage }}-titiler ${{ github.ref_name }} terraform apply job has succeeded!\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}" - env: - SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} - - - name: Post status to Slack channel - id: tf_apply_failure - if: steps.tf_apply.outcome != 'success' - continue-on-error: true - uses: slackapi/slack-github-action@v1.26.0 - with: - channel-id: ${{ secrets.SLACK_CHANNEL_ID }} - slack-message: ":sadpanda: ${{ inputs.project-name }}-${{ inputs.stage }}-titiler ${{ github.ref_name }} terraform apply has failed!\n:alert: make sure cleanup job deletes all AWS resources!\n${{ github.event.pull_request.html_url || github.event.head_commit.url }}" - env: - SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }} \ No newline at end of file