feat: git push support

[neurosnap]

FEAT

• Using pre-built image for faster deploys
• Added support for Dockerfile Deploy using git push

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - name: Deploy to Aptible
      uses: aptible/aptible-deploy-action@v2
      with:
        type: git
        app: <app name>
        environment: <environment name>
        username: ${{ secrets.APTIBLE_USERNAME }}
        password: ${{ secrets.APTIBLE_PASSWORD }}

BREAKING CHANGES

• type is now required (choices: git or docker)

Approach

We tried to make this as congruent as possible with the current Direct Docker Image Deploy strategy. In that effort, we wanted to support git push without requiring yet another authentication secret -- the SSH private key -- so we had to jump through some hoops to use our Aptible access token for pushing to our git remote.

Security Considerations

We are interfacing directly with primetime in order to perform a git push using just an Aptible token. This makes this paradigm more visible to the outside world, something to think about.

[neurosnap]

"main:$BRANCH" needs to change to whatever branch is currently checked out.

[joshraker]

Future Improvement: It may be useful to provide an example of how to build and push to the repo's GitHub packages registry since my understanding is it should "just work" without any external setup.

[neurosnap]

I think you are right, but can we look into this after this is deployed?

[joshraker]

Yeah, that's why I marked it as "Future Improvement".

[aguilinger]

Looks good to me, just one nit but not critical. I'll leave Josh to give the 'Approve' but has my 👍

[aguilinger]

Why use the internal domain and not either git.aptible.com or beta.aptible.com since those are much more likely to stay static?

[joshraker]

That's my bad. Eric asked me what the hostname for primetime was and I didn't see a user domain on it so I just gave him the internal hostname. I overlooked the possibility of using a custom cert which would cause the endpoint to not have user domain. We should use git.aptible.com.

[UserNotFound]

We should use primetime.aptible.com, since it's a different service than Megatron (git.aptible.com).

[joshraker]

Or no certificate because it's using ssh not http 🤦

[joshraker]

primetime.aptible.com ?

Is that what we should use for a git push?

[joshraker]

We should use primetime.aptible.com, since it's a different service than Megatron (git.aptible.com).

Is that the right service to push to? Normally a user would push to beta.aptible.com or git.aptible.com which both point to megatron, right?

[aguilinger]

We are interfacing directly with primetime in order to perform a git push using just an Aptible token. This makes this paradigm more visible to the outside world, something to think about.

Alex is right I glossed over that

[UserNotFound]

StrictHostKeyChecking=no
We should not skip hostkey checking from a location outside of our control, eg GHA runners. (this will necessitate persisting it between deployments of Primetime with a PersistentDisk)

[neurosnap]

Updated. Will have to re-test this to make sure it all works still

[joe-herman]

Slack thread

[aguilinger]

We might add an extra note about 'Breaking changes' in the release notes and call out that existing users need to add the 'type: docker' option