chore(j-s): Security&Integrity #111497
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Monorepo pipeline - build and deploy | |
| on: | |
| push: | |
| branches: | |
| - 'main' | |
| - 'release/**' | |
| - 'pre-release/**' | |
| paths-ignore: | |
| - '**/*.md' | |
| tags: | |
| - docker-build-* | |
| workflow_dispatch: | |
| create: | |
| pull_request: | |
| types: | |
| - opened | |
| - synchronize | |
| - labeled | |
| defaults: | |
| run: | |
| shell: bash | |
| concurrency: | |
| # See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-a-fallback-value | |
| group: push-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| env: | |
| DOCKER_REGISTRY: 821090935708.dkr.ecr.eu-west-1.amazonaws.com/ | |
| DOCKER_BASE_IMAGE_REGISTRY: 821090935708.dkr.ecr.eu-west-1.amazonaws.com/ecr-public | |
| SPINNAKER_URL: https://spinnaker-gate.shared.devland.is | |
| COMPOSE_HTTP_TIMEOUT: 180 | |
| GITHUB_ACTIONS_CACHE_URL: https://cache.dev01.devland.is/ | |
| SKIP_GENERATED_CACHE: ${{ contains(github.event.pull_request.labels.*.name, 'skip-generated-cache') }} | |
| NX_AFFECTED_ALL: ${{ contains(github.event.pull_request.labels.*.name, 'nx-affected-all') }} | |
| CONFIGCAT_MAIN_CONFIG_ID: 08d8c761-021c-46f0-8671-6244663a372f | |
| CONFIGCAT_MOBILE_APP_CONFIG_ID: 08daf234-7573-4b3b-85f6-189fc7502542 | |
| jobs: | |
| pre-checks: | |
| name: Check if job should run | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| env: | |
| CREATE_PATTERNS: ^release/ | |
| PRE_RELEASE_PATTERN: ^pre-release/ | |
| outputs: | |
| NODE_IMAGE_TAG: ${{ steps.git-branch.outputs.NODE_IMAGE_TAG }} | |
| GIT_BRANCH: ${{ steps.git-branch.outputs.GIT_BRANCH }} | |
| GIT_BRANCH_DEPLOY: ${{ steps.git-branch-deploy.outputs.GIT_BRANCH_DEPLOY }} | |
| FEATURE_NAME: ${{ steps.git-branch-deploy.outputs.FEATURE_NAME }} | |
| PRE_CHECK: ${{ steps.should-run.outputs.PRE_CHECK }} | |
| PRE_RELEASE: ${{ steps.should-run.outputs.PRE_RELEASE }} | |
| steps: | |
| - name: Get git branch | |
| id: git-branch | |
| run: | | |
| set -euo pipefail | |
| GIT_BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF/refs\/heads\//}}" | |
| echo GIT_BRANCH="${GIT_BRANCH}" >> "$GITHUB_OUTPUT" | |
| echo GIT_BRANCH="$GIT_BRANCH" >> "$GITHUB_ENV" | |
| - name: Generate deployment branch name | |
| id: git-branch-deploy | |
| run: | | |
| set -euo pipefail | |
| export GIT_BRANCH_DEPLOY="$GIT_BRANCH" | |
| if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then | |
| if [[ ! ("$GIT_BRANCH_DEPLOY" =~ "feature/") ]]; then | |
| # If event is pull request but branch is not prefixed with feature/ | |
| GIT_BRANCH_DEPLOY="feature/$GIT_BRANCH_DEPLOY" | |
| fi | |
| # Avoid too long resource names | |
| GIT_BRANCH_DEPLOY="${GIT_BRANCH_DEPLOY:0:50}" | |
| fi | |
| echo GIT_BRANCH_DEPLOY="${GIT_BRANCH_DEPLOY}" >> "$GITHUB_OUTPUT" | |
| echo GIT_BRANCH_DEPLOY="$GIT_BRANCH_DEPLOY" >> "$GITHUB_ENV" | |
| echo FEATURE_NAME="$(echo "$GIT_BRANCH_DEPLOY" | cut -d"/" -f2- | tr -cd '[:alnum:]-' | tr '[:upper:]' '[:lower:]' | cut -c1-50)" >> "$GITHUB_OUTPUT" | |
| - name: Check if we want to run workflow | |
| id: should-run | |
| env: | |
| SPINNAKER_WEBHOOK_TOKEN: ${{ secrets.SPINNAKER_WEBHOOK_TOKEN }} | |
| run: | | |
| echo "GITHUB_EVENT_NAME is '$GITHUB_EVENT_NAME'" | |
| echo "PRE_RELEASE=false" >> "$GITHUB_OUTPUT" | |
| if [[ "$GITHUB_EVENT_NAME" == "create" ]]; then | |
| echo "Workflow was created because of branch creation. Branch name is '$GIT_BRANCH'" | |
| for pre_pattern in $(echo "$PRE_RELEASE_PATTERN" | sed "s/,/ /g") | |
| do | |
| echo "Checking branch against pre_release_pattern '$pre_pattern'" | |
| echo "Check if this is a pre-release and if it should generate a feature-deploy" | |
| if [[ "$GIT_BRANCH" =~ $pre_pattern ]]; then | |
| echo "'$GIT_BRANCH' matches 'pre_$pattern', continuing with build" | |
| echo "PRE_CHECK=feature-deploy" >> "$GITHUB_OUTPUT" | |
| echo "PRE_RELEASE=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| done | |
| for pattern in $(echo "$CREATE_PATTERNS" | sed "s/,/ /g") | |
| do | |
| echo "Checking branch against pattern '$pattern'" | |
| if [[ "$GIT_BRANCH" =~ $pattern ]]; then | |
| echo "'$GIT_BRANCH' matches '$pattern', continuing with build" | |
| echo "PRE_CHECK=push" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| done | |
| echo "No pattern matches '$GIT_BRANCH', exiting." | |
| exit 0 | |
| fi | |
| if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then | |
| if [[ "${{ github.event.action }}" == "labeled" ]]; then | |
| echo "Action is labeled, using label that was applied: '${{ github.event.label.name }}'" | |
| deployFeature="$([[ "${{ github.event.label.name }}" == "deploy-feature" ]] && echo true || echo false )" | |
| else | |
| echo "Action is ${{ github.event.action }}, using labels on PR" | |
| deployFeature=${{ contains(github.event.pull_request.labels.*.name, 'deploy-feature') }} | |
| fi | |
| if [[ "$deployFeature" == "true" ]]; then | |
| echo "Pull request contains deploy-feature label, continuing with feature deployment" | |
| echo "PRE_CHECK=feature-deploy" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "Pull request does not have deploy-feature label, exiting..." | |
| exit 0 | |
| fi | |
| for pre_pattern in $(echo "$PRE_RELEASE_PATTERN" | sed "s/,/ /g") | |
| do | |
| echo "Checking branch against pre_release_pattern '$pre_pattern'" | |
| echo "Check if this is a pre-release and if it should generate a feature-deploy" | |
| if [[ "$GIT_BRANCH" =~ $pre_pattern ]]; then | |
| echo "'$GIT_BRANCH' matches 'pre_$pattern', continuing with build" | |
| echo "PRE_CHECK=feature-deploy" >> "$GITHUB_OUTPUT" | |
| echo "PRE_RELEASE=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| done | |
| echo "PRE_CHECK=push" >> "$GITHUB_OUTPUT" | |
| prepare: | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| timeout-minutes: 90 | |
| if: needs.pre-checks.outputs.PRE_CHECK | |
| needs: | |
| - pre-checks | |
| env: | |
| AFFECTED_ALL: ${{ secrets.AFFECTED_ALL }} | |
| GIT_BRANCH: ${{ needs.pre-checks.outputs.GIT_BRANCH }} | |
| SERVERSIDE_FEATURES_ON: '' | |
| outputs: | |
| CACHE_KEYS: ${{ steps.get-cache.outputs.keys }} | |
| TEST_CHUNKS: ${{ steps.test_projects.outputs.CHUNKS }} | |
| DOCKER_TAG: ${{ steps.docker_tags.outputs.DOCKER_TAG }} | |
| NODE_IMAGE_TAG: ${{ steps.nodejs_image.outputs.NODE_IMAGE_TAG }} | |
| LAST_GOOD_BUILD_DOCKER_TAG: ${{ steps.git_nx_base.outputs.LAST_GOOD_BUILD_DOCKER_TAG }} | |
| UNAFFECTED: ${{ steps.unaffected.outputs.UNAFFECTED }} | |
| BUILD_CHUNKS: ${{ steps.build_map.outputs.BUILD_CHUNKS }} | |
| IMAGES: ${{ steps.deploy_map.outputs.IMAGES }} | |
| node-modules-hash: ${{ steps.calculate_node_modules_hash.outputs.node-modules-hash }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: 'package.json' | |
| - name: Setup yarn | |
| run: corepack enable | |
| - name: Check node version | |
| run: | | |
| set -euo pipefail | |
| node -v | |
| ls -l `which node` | |
| - name: Git refs | |
| id: git_refs | |
| run: | | |
| set -euo pipefail | |
| if [[ -n "$GITHUB_BASE_REF" ]] | |
| then | |
| # a PR | |
| GIT_BASE_BRANCH="$GITHUB_BASE_REF" | |
| else | |
| # on main | |
| GIT_BASE_BRANCH=main | |
| fi | |
| echo GIT_BRANCH="$GIT_BRANCH" >> "$GITHUB_ENV" | |
| echo GIT_BASE_BRANCH="$GIT_BASE_BRANCH" >> "$GITHUB_ENV" | |
| echo "Base branch is '${GIT_BASE_BRANCH}'" | |
| echo "Branch is '${GIT_BRANCH}'" | |
| - name: Checking out relevant branches for a pre-release | |
| if: needs.pre-checks.outputs.PRE_CHECK && needs.pre-checks.outputs.PRE_RELEASE == 'true' | |
| run: | | |
| echo "Feature Name: '$FEATURE_NAME'" | |
| git checkout main | |
| git checkout "$GITHUB_SHA" | |
| git config --global user.email "ci@island.is" | |
| git config --global user.name "CI Bot" | |
| - name: Checking out relevant branches for a PR | |
| if: needs.pre-checks.outputs.PRE_CHECK && needs.pre-checks.outputs.PRE_CHECK == 'feature-deploy' && !(needs.pre-checks.outputs.PRE_RELEASE == 'true') | |
| run: | | |
| set -euo pipefail | |
| git checkout "$GITHUB_HEAD_REF" | |
| git checkout "$GITHUB_BASE_REF" | |
| git checkout "$GITHUB_SHA" | |
| git config --global user.email "ci@island.is" | |
| git config --global user.name "CI Bot" | |
| BASE_SHA="$(git merge-base HEAD "$GITHUB_BASE_REF")" | |
| HEAD_SHA="$(git merge-base HEAD "$GITHUB_HEAD_REF")" | |
| echo "Current base SHA is '$BASE_SHA' and head SHA is '$HEAD_SHA'" | |
| echo "{\"base_sha\": \"$BASE_SHA\", \"head_sha\":\"$HEAD_SHA\"}" > event.json | |
| - name: Checking out relevant branches for a branch build | |
| if: ${{ !(needs.pre-checks.outputs.PRE_CHECK && needs.pre-checks.outputs.PRE_CHECK == 'feature-deploy') }} | |
| run: | | |
| set -euo pipefail | |
| git checkout main | |
| git checkout "$GITHUB_SHA" | |
| # This is to increase the retention days for our GitHub Actions run events | |
| # See this for more information: | |
| # https://github.blog/changelog/2020-10-08-github-actions-ability-to-change-retention-days-for-artifacts-and-logs/ | |
| - name: Keep PR run event | |
| uses: actions/upload-artifact@b18b1d32f3f31abcdc29dee3f2484801fe7822f4 | |
| if: needs.pre-checks.outputs.PRE_CHECK && needs.pre-checks.outputs.PRE_CHECK == 'feature-deploy' && !(needs.pre-checks.outputs.PRE_RELEASE == 'true') | |
| with: | |
| name: pr-event | |
| path: event.json | |
| retention-days: 90 | |
| include-hidden-files: true | |
| if-no-files-found: error | |
| - name: Generate nodejs image tag | |
| id: nodejs_image | |
| continue-on-error: false | |
| run: | | |
| set -euo pipefail | |
| export NODE_IMAGE_TAG="$(./scripts/ci/get-node-version.mjs)" | |
| echo "NODE_IMAGE_TAG: '${NODE_IMAGE_TAG}'" | |
| echo NODE_IMAGE_TAG="${NODE_IMAGE_TAG}" >> "$GITHUB_OUTPUT" | |
| echo NODE_IMAGE_TAG="${NODE_IMAGE_TAG}" >> "$GITHUB_ENV" | |
| echo "**NODE_IMAGE_TAG** '${NODE_IMAGE_TAG}'" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Generate docker image tag | |
| id: docker_tags | |
| run: | | |
| set -euo pipefail | |
| export DOCKER_BRANCH_TAG="$(echo "${GIT_BRANCH:0:45}" | tr "/." "-" )" | |
| SHA="${{ github.event.pull_request.head.sha }}" | |
| echo "SHA='$SHA' retrieved from event" | |
| if [[ "$SHA" == "" ]]; then | |
| SHA="$GITHUB_SHA" | |
| echo "SHA='$SHA', retrived from action environment" | |
| fi | |
| echo "Using SHA='$SHA' as docker tag SHA" | |
| export DOCKER_TAG="${DOCKER_BRANCH_TAG}_${SHA:0:10}_${GITHUB_RUN_NUMBER}" | |
| echo "Docker tag will be '${DOCKER_TAG}'" | |
| echo DOCKER_TAG="${DOCKER_TAG}" >> "$GITHUB_OUTPUT" | |
| echo DOCKER_TAG="$DOCKER_TAG" >> "$GITHUB_ENV" | |
| echo "**Monorepo tag:** '${DOCKER_TAG}'" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Send Slack notification | |
| id: slack | |
| if: ${{ startsWith( github.env.GIT_BASE_BRANCH, 'release/' ) }} | |
| uses: 8398a7/action-slack@v3 | |
| with: | |
| status: custom | |
| fields: repo,message # selectable (default: repo,message) | |
| custom_payload: | | |
| { | |
| attachments: [{ | |
| color: 'good', | |
| text: `Monorepo Release Tag is: ${process.env.DOCKER_TAG}`, | |
| }] | |
| } | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_RELEASE_WEBHOOK_URL }} # required | |
| - run: | | |
| echo HEAD="$GITHUB_SHA" >> "$GITHUB_ENV" | |
| id: git_nx_head | |
| name: Preparing HEAD tag | |
| - name: Get cache | |
| id: get-cache | |
| uses: ./.github/actions/get-cache | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| enable-cache: 'node_modules,generated-files' | |
| - name: Set Test Everything true | |
| run: | | |
| echo "TEST_EVERYTHING=true" >> "$GITHUB_ENV" | |
| if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'test everything') | |
| - name: Set Test Everything false | |
| run: echo "TEST_EVERYTHING=false" >> "$GITHUB_ENV" | |
| if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'test everything') | |
| - name: Preparing BASE tags | |
| id: git_nx_base | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| HTML_URL: ${{ github.event.pull_request.html_url }} | |
| ISSUE_REPORTING_SLACK_WEBHOOK_URL: ${{ secrets.SLACK_BUILD_ISSUES_REPORTING_WEBHOOK_URL }} | |
| run: | | |
| set -euo pipefail | |
| if [[ "${{needs.pre-checks.outputs.PRE_CHECK}}" == 'feature-deploy' && "${{needs.pre-checks.outputs.PRE_RELEASE}}" == 'false' ]]; then | |
| export HEAD_REF="$GITHUB_HEAD_REF" | |
| export BASE_REF="$GITHUB_BASE_REF" | |
| export PR_REF="$GITHUB_SHA" | |
| else | |
| export HEAD_REF="$GIT_BRANCH" | |
| export BASE_REF="$GIT_BASE_BRANCH" | |
| export PR_REF="not used" | |
| fi | |
| export WORKFLOW_ID=push | |
| export SHELL=/usr/bin/bash | |
| source ./scripts/ci/00_prepare-base-tags.sh $(git merge-base HEAD "$GITHUB_BASE_REF") | |
| git checkout "$GITHUB_SHA" | |
| echo BASE="$BASE" >> "$GITHUB_ENV" | |
| echo LAST_GOOD_BUILD_DOCKER_TAG="${LAST_GOOD_BUILD_DOCKER_TAG}" >> "$GITHUB_OUTPUT" | |
| - name: Docker login to ECR repo | |
| run: ./scripts/ci/docker-login-ecr.sh | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| with: | |
| image: '${{ env.DOCKER_BASE_IMAGE_REGISTRY }}/eks-distro-build-tooling/binfmt-misc:qemu-v6.1.0' | |
| - name: Check if cached buildx image exists | |
| id: cache-check | |
| run: | | |
| if ! docker pull ${{vars.AWS_ECR_REPO_BASE}}/moby/buildkit:buildx-stable-1 ; then | |
| docker pull docker.io/moby/buildkit:buildx-stable-1 | |
| docker tag docker.io/moby/buildkit:buildx-stable-1 ${{vars.AWS_ECR_REPO_BASE}}/moby/buildkit:buildx-stable-1 | |
| docker push ${{vars.AWS_ECR_REPO_BASE}}/moby/buildkit:buildx-stable-1 | |
| fi | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| driver-opts: | | |
| image=${{vars.AWS_ECR_REPO_BASE}}/moby/buildkit:buildx-stable-1 | |
| - name: Get node hash | |
| uses: actions/github-script@v7 | |
| id: calculate_node_modules_hash | |
| env: | |
| _CACHE_KEY: ${{ steps.get-cache.outputs.keys }} | |
| with: | |
| script: | | |
| const CACHE_KEYS = JSON.parse(process.env._CACHE_KEY) | |
| core.setOutput('node-modules-hash', CACHE_KEYS["node_modules"]) | |
| - name: Cache for NodeJS dependencies - Docker layer | |
| id: cache-deps | |
| continue-on-error: true | |
| uses: ./.github/actions/cache | |
| with: | |
| path: cache | |
| key: ${{ steps.calculate_node_modules_hash.outputs.node-modules-hash }}-docker-deps-1 | |
| - name: Check cache success | |
| run: '[[ "${{ steps.cache-deps.outputs.success }}" != "false" ]] || exit 1' | |
| - name: Cache for NodeJS dependencies - Docker layer | |
| id: cache-deps-base | |
| continue-on-error: true | |
| uses: ./.github/actions/cache | |
| with: | |
| path: cache_output | |
| key: ${{ steps.calculate_node_modules_hash.outputs.node-modules-hash }}-docker-output-base-1 | |
| - name: Check cache success | |
| run: '[[ "${{ steps.cache-deps-base.outputs.success }}" != "false" ]] || exit 1' | |
| - name: set BRANCH env var | |
| run: echo BRANCH="$GIT_BRANCH" >> "$GITHUB_ENV" | |
| - name: Prepare test targets | |
| id: test_projects | |
| run: | | |
| set -euo pipefail | |
| CHUNKS="$(./scripts/ci/generate-chunks.sh test)" | |
| if [[ "$CHUNKS" != "[]" ]]; then | |
| echo CHUNKS="{\"projects\":$CHUNKS}" >> "$GITHUB_OUTPUT" | |
| fi | |
| env: | |
| SKIP_TESTS_ON_BRANCH: ${{ secrets.SKIP_TESTS_ON_BRANCH }} | |
| - name: Prepare docker build targets | |
| id: build_map | |
| run: | | |
| set -euo pipefail | |
| CHUNKS="$(./scripts/ci/generate-build-chunks.sh docker-express docker-next docker-static docker-playwright docker-jest)" | |
| echo "CHUNKS: '$CHUNKS'" | |
| if [[ "$CHUNKS" != "[]" ]]; then | |
| echo BUILD_CHUNKS="$CHUNKS" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Gather unaffected docker images | |
| id: unaffected | |
| run: | | |
| set -euo pipefail | |
| UNAFFECTED="$(./scripts/ci/list-unaffected.sh docker-next docker-express docker-static docker-playwright docker-jest)" | |
| echo UNAFFECTED="$UNAFFECTED" >> "$GITHUB_OUTPUT" | |
| - name: check pre-release | |
| if: needs.pre-checks.outputs.PRE_RELEASE == 'true' | |
| run: | | |
| echo "AFFECTED_ALL=7913-$GIT_BRANCH" >> "$GITHUB_ENV" | |
| - name: Prepare deployment targets | |
| id: deploy_map | |
| if: needs.pre-checks.outputs.PRE_CHECK != 'push' | |
| run: | | |
| set -euo pipefail | |
| export BASE="$(git merge-base HEAD "$GITHUB_BASE_REF")" | |
| CHUNKS="$(./scripts/ci/generate-build-chunks.sh docker-express docker-next docker-static docker-playwright docker-jest)" | |
| echo "CHUNKS: '$CHUNKS'" | |
| if [[ "$CHUNKS" != "[]" ]]; then | |
| echo "IMAGES="$(echo "$CHUNKS" | jq '.[] | fromjson | .projects' -r | tr '\n' ',')"" >> "$GITHUB_OUTPUT" | |
| fi | |
| tests: | |
| needs: | |
| - prepare | |
| if: needs.prepare.outputs.TEST_CHUNKS | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| timeout-minutes: 35 | |
| env: | |
| AFFECTED_PROJECTS: ${{ matrix.projects }} | |
| MAX_JOBS: 1 | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJson(needs.prepare.outputs.TEST_CHUNKS) }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: 'package.json' | |
| - name: Setup yarn | |
| run: corepack enable | |
| - name: Get cache | |
| id: get-cache | |
| uses: ./.github/actions/get-cache | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| keys: ${{ needs.prepare.outputs.CACHE_KEYS }} | |
| enable-cache: 'node_modules,generated-files' | |
| - uses: ./.github/actions/unit-test | |
| with: | |
| dd-api-key: '${{ secrets.DD_API_KEY }}' | |
| codecov-token: ${{ secrets.CODECOV_TOKEN }} | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| docker-registry: ${{ env.DOCKER_REGISTRY}} | |
| docker-build: | |
| needs: | |
| - pre-checks | |
| - prepare | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| timeout-minutes: 35 | |
| if: needs.prepare.outputs.BUILD_CHUNKS | |
| env: | |
| AFFECTED_ALL: ${{ secrets.AFFECTED_ALL }} | |
| GIT_BRANCH: ${{ needs.pre-checks.outputs.GIT_BRANCH}} | |
| DOCKER_TAG: ${{ needs.prepare.outputs.DOCKER_TAG}} | |
| NODE_IMAGE_TAG: ${{ needs.prepare.outputs.NODE_IMAGE_TAG}} | |
| PUBLISH: true | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| chunk: ${{ fromJson(needs.prepare.outputs.BUILD_CHUNKS) }} | |
| steps: | |
| - name: Gather apps | |
| id: gather | |
| run: | | |
| set -euo pipefail | |
| AFFECTED_PROJECTS="$(echo '${{ matrix.chunk }}' | jq -r '.projects')" | |
| DOCKER_TYPE="$(echo '${{ matrix.chunk }}' | jq -r '.docker_type')" | |
| echo AFFECTED_PROJECTS="$AFFECTED_PROJECTS" >> "$GITHUB_ENV" | |
| echo DOCKER_TYPE="$DOCKER_TYPE" >> "$GITHUB_ENV" | |
| continue-on-error: true | |
| - uses: actions/checkout@v3 | |
| if: steps.gather.outcome == 'success' | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: 'package.json' | |
| if: steps.gather.outcome == 'success' | |
| - name: Setup yarn | |
| run: corepack enable | |
| if: steps.gather.outcome == 'success' | |
| - name: Get cache | |
| id: get-cache | |
| uses: ./.github/actions/get-cache | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| keys: ${{ needs.prepare.outputs.CACHE_KEYS }} | |
| enable-cache: 'node_modules,generated-files' | |
| - name: Cache for dependencies Docker layer | |
| if: steps.gather.outcome == 'success' | |
| id: cache-deps-base | |
| continue-on-error: true | |
| uses: ./.github/actions/cache | |
| with: | |
| path: cache_output | |
| key: ${{ needs.prepare.outputs.node-modules-hash }}-docker-output-base-1 | |
| - name: Check cache success | |
| run: '[[ "${{ steps.cache-deps-base.outputs.success }}" != "false" ]] || exit 1' | |
| - name: Cache for NodeJS dependencies - Docker layer | |
| id: cache-deps | |
| if: steps.gather.outcome == 'success' | |
| continue-on-error: true | |
| uses: ./.github/actions/cache | |
| with: | |
| path: cache | |
| key: ${{ needs.prepare.outputs.node-modules-hash }}-docker-deps-1 | |
| - name: Check cache success | |
| run: '[[ "${{ steps.cache-deps.outputs.success }}" != "false" ]] || exit 1' | |
| - name: Docker login to ECR repo | |
| if: steps.gather.outcome == 'success' | |
| run: ./scripts/ci/docker-login-ecr.sh | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| with: | |
| image: '${{ env.DOCKER_BASE_IMAGE_REGISTRY }}/eks-distro-build-tooling/binfmt-misc:qemu-v6.1.0' | |
| - name: Check if cached buildx image exists | |
| id: cache-check | |
| run: | | |
| if ! docker pull ${{vars.AWS_ECR_REPO_BASE}}/moby/buildkit:buildx-stable-1 ; then | |
| docker pull docker.io/moby/buildkit:buildx-stable-1 | |
| docker tag docker.io/moby/buildkit:buildx-stable-1 ${{vars.AWS_ECR_REPO_BASE}}/moby/buildkit:buildx-stable-1 | |
| docker push ${{vars.AWS_ECR_REPO_BASE}}/moby/buildkit:buildx-stable-1 | |
| fi | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| driver-opts: | | |
| image=${{vars.AWS_ECR_REPO_BASE}}/moby/buildkit:buildx-stable-1 | |
| - name: Prepare Docker build arguments | |
| id: dockerargs | |
| if: steps.gather.outcome == 'success' | |
| env: | |
| NODE_IMAGE_TAG: ${{ needs.prepare.outputs.NODE_IMAGE_TAG }} | |
| GIT_COMMIT_SHA: ${{ github.sha }} | |
| DOCKER_BASE_IMAGE_REGISTRY: ${{ env.DOCKER_BASE_IMAGE_REGISTRY }} | |
| run: | | |
| set -x | |
| # Strip protocol prefix and .git postfix | |
| SERVER_URL="${{ github.server_url }}/${{ github.repository }}" | |
| SERVER_URL="${SERVER_URL#*://}" | |
| SERVER_URL="${SERVER_URL%.git}" | |
| build_args=( | |
| --build-arg="DOCKER_IMAGE_REGISTRY=${DOCKER_BASE_IMAGE_REGISTRY}" | |
| --build-arg="NODE_IMAGE_TAG=${NODE_IMAGE_TAG}" | |
| --build-arg="GIT_BRANCH=${GIT_BRANCH}" | |
| --build-arg="GIT_COMMIT_SHA=${GIT_COMMIT_SHA}" | |
| --build-arg="GIT_REPOSITORY_URL=${SERVER_URL}" | |
| ) | |
| export EXTRA_DOCKER_BUILD_ARGS="${build_args[*]}" | |
| echo "EXTRA_DOCKER_BUILD_ARGS=${EXTRA_DOCKER_BUILD_ARGS}" >> "${GITHUB_ENV}" | |
| - name: Building Docker images | |
| continue-on-error: true | |
| id: dockerbuild | |
| if: steps.gather.outcome == 'success' | |
| env: | |
| NODE_IMAGE_TAG: ${{ needs.prepare.outputs.NODE_IMAGE_TAG }} | |
| GIT_COMMIT_SHA: ${{ github.sha }} | |
| DOCKER_BASE_IMAGE_REGISTRY: ${{ env.DOCKER_BASE_IMAGE_REGISTRY }} | |
| run: | | |
| set -x | |
| echo "Node image tag is: '${NODE_IMAGE_TAG}'" | |
| echo "Docker build args are: 'EXTRA_DOCKER_BUILD_ARGS'" | |
| export EXTRA_DOCKER_BUILD_ARGS | |
| ./scripts/ci/run-in-parallel.sh "90_${DOCKER_TYPE}" | |
| - name: Building Docker images Retry | |
| if: steps.gather.outcome == 'success' && steps.dockerbuild.outcome == 'failure' | |
| env: | |
| NODE_IMAGE_TAG: ${{ needs.prepare.outputs.NODE_IMAGE_TAG }} | |
| GIT_COMMIT_SHA: ${{ github.sha }} | |
| DOCKER_BASE_IMAGE_REGISTRY: ${{ env.DOCKER_BASE_IMAGE_REGISTRY }} | |
| run: | | |
| set -x | |
| echo "Node image tag is: '${NODE_IMAGE_TAG}'" | |
| echo "Docker build args are: 'EXTRA_DOCKER_BUILD_ARGS'" | |
| export EXTRA_DOCKER_BUILD_ARGS | |
| ./scripts/ci/run-in-parallel.sh "90_${DOCKER_TYPE}" | |
| helm-docker-build: | |
| needs: | |
| - prepare | |
| - pre-checks | |
| # if: needs.prepare.outputs.IMAGES && needs.pre-checks.outputs.PRE_CHECK != 'push' | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| timeout-minutes: 5 | |
| env: | |
| FEATURE_NAME: ${{ needs.pre-checks.outputs.FEATURE_NAME }} | |
| DOCKER_TAG: ${{ needs.prepare.outputs.DOCKER_TAG}} | |
| GIT_BRANCH: ${{ needs.pre-checks.outputs.GIT_BRANCH }} | |
| NODE_IMAGE_TAG: ${{ needs.prepare.outputs.NODE_IMAGE_TAG }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Docker login | |
| run: ./scripts/ci/docker-login-ecr.sh | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.ECR_AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.ECR_AWS_SECRET_ACCESS_KEY }} | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.ECR_AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.ECR_AWS_SECRET_ACCESS_KEY }} | |
| aws-region: eu-west-1 | |
| - name: Docker build image | |
| working-directory: infra | |
| run: | | |
| echo Registry is: ${{env.DOCKER_BASE_IMAGE_REGISTRY}} | |
| echo Image tag is: ${{env.NODE_IMAGE_TAG}} | |
| export EXTRA_DOCKER_BUILD_ARGS="--build-arg DOCKER_IMAGE_REGISTRY=${{env.DOCKER_BASE_IMAGE_REGISTRY}} --build-arg NODE_IMAGE_TAG=${{env.NODE_IMAGE_TAG}}" | |
| ./scripts/build-docker-container.sh "$DOCKER_TAG" | |
| echo "COMMENT<<EOF" >> "$GITHUB_ENV" | |
| echo "Affected services are: ${{needs.prepare.outputs.IMAGES}}" >> "$GITHUB_ENV" | |
| docker run --rm "${DOCKER_REGISTRY}helm-config:$DOCKER_TAG" ingress-comment --images=${{needs.prepare.outputs.IMAGES}} --chart=islandis --feature="$FEATURE_NAME" >> "$GITHUB_ENV" | |
| echo 'EOF' >> "$GITHUB_ENV" | |
| env: | |
| PUBLISH: 'true' | |
| - name: Retag as latest | |
| if: ${{ env.GIT_BRANCH == 'main' && env.NX_AFFECTED_ALL != 'true' }} | |
| env: | |
| UNAFFECTED: helm-config | |
| LAST_GOOD_BUILD_DOCKER_TAG: ${{ env.DOCKER_TAG }} | |
| DOCKER_TAG: latest | |
| run: ./scripts/ci/retag-unaffected.sh "$UNAFFECTED" | |
| - name: Comment on PR | |
| if: needs.pre-checks.outputs.PRE_CHECK == 'feature-deploy' && !(needs.pre-checks.outputs.PRE_RELEASE == 'true') | |
| uses: actions/github-script@v7 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| const updateComment = require('./.github/actions/update-comment.js') | |
| const { COMMENT } = process.env | |
| await updateComment({github, context, comment: COMMENT}) | |
| retag-unaffected: | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| timeout-minutes: 5 | |
| if: ${{ !cancelled() && needs.pre-checks.result == 'success' && needs.prepare.result != 'skipped' }} | |
| needs: | |
| - pre-checks | |
| - docker-build | |
| - prepare | |
| env: | |
| GIT_BRANCH: ${{ needs.pre-checks.outputs.GIT_BRANCH}} | |
| DOCKER_TAG: ${{ needs.prepare.outputs.DOCKER_TAG}} | |
| LAST_GOOD_BUILD_DOCKER_TAG: ${{ needs.prepare.outputs.LAST_GOOD_BUILD_DOCKER_TAG}} | |
| UNAFFECTED: ${{ needs.prepare.outputs.UNAFFECTED}} | |
| steps: | |
| - name: Check prepare success | |
| run: '[[ ${{ needs.prepare.result }} == "success" ]] || exit 1' | |
| - name: Check docker-build success | |
| run: '[[ ${{ needs.docker-build.result }} != "failure" ]] || exit 1' | |
| - uses: actions/checkout@v3 | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: eu-west-1 | |
| - name: Retag unaffected Docker images | |
| run: ./scripts/ci/retag-unaffected.sh "$UNAFFECTED" | |
| deploy: | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| if: ${{ !cancelled() && needs.retag-unaffected.result == 'success' && needs.helm-docker-build.result != 'failure' }} | |
| needs: | |
| - retag-unaffected | |
| - pre-checks | |
| - prepare | |
| - helm-docker-build | |
| env: | |
| GIT_BRANCH_DEPLOY: ${{ needs.pre-checks.outputs.GIT_BRANCH_DEPLOY }} | |
| FEATURE_NAME: ${{ needs.pre-checks.outputs.FEATURE_NAME }} | |
| DOCKER_TAG: ${{ needs.prepare.outputs.DOCKER_TAG }} | |
| IMAGES: ${{ needs.prepare.outputs.IMAGES }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Trigger Deployment for service | |
| env: | |
| SPINNAKER_WEBHOOK_TOKEN: ${{ secrets.SPINNAKER_WEBHOOK_TOKEN }} | |
| run: | | |
| echo "Sending webhook with branch: '$GIT_BRANCH_DEPLOY'" | |
| curl "$SPINNAKER_URL/webhooks/webhook/islandis" -H "content-type: application/json" --data-binary @- <<BODY | |
| { | |
| "token": "$SPINNAKER_WEBHOOK_TOKEN", | |
| "branch": "$GIT_BRANCH_DEPLOY", | |
| "parameters": { | |
| "docker_tag": "$DOCKER_TAG", | |
| "feature_name": "$FEATURE_NAME", | |
| "images": "$IMAGES", | |
| "pull_request_number": "$(echo "$GITHUB_REF" | cut -d'/' -f3)" | |
| } | |
| } | |
| BODY | |
| - name: Trigger Deployment for IDS-Services | |
| env: | |
| DOCKER_TAG: ${{ needs.prepare.outputs.DOCKER_TAG }} | |
| GIT_BRANCH_DEPLOY: ${{ needs.pre-checks.outputs.GIT_BRANCH_DEPLOY }} | |
| SPINNAKER_WEBHOOK_TOKEN: ${{ secrets.SPINNAKER_WEBHOOK_TOKEN }} | |
| GH_PRIVATE_REPO_TOKEN: ${{secrets.GH_PRIVATE_REPO_TOKEN}} | |
| run: | | |
| set -euo pipefail | |
| if read -d "\n" IDENTITY_SERVER_HEAD_SHA IDENTITY_SERVER_RUN_NUMBER; then :; fi <<<$(curl -H "Authorization: token $GH_PRIVATE_REPO_TOKEN" -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/island-is/identity-server.web/actions/workflows/build.yml/runs\?branch\=main\&status\=success\&per_page\=1\&event\=push | jq '.workflow_runs[] | .head_sha, .run_number' | tr -d \") | |
| export IDENTITY_SERVER_DOCKER_TAG="main_${IDENTITY_SERVER_HEAD_SHA:0:10}_${IDENTITY_SERVER_RUN_NUMBER}" | |
| echo "Deploying with identity-server docker tag: '$IDENTITY_SERVER_DOCKER_TAG'" | |
| echo "Sending webhook with branch: '$GIT_BRANCH_DEPLOY'" | |
| curl "$SPINNAKER_URL/webhooks/webhook/ids-dev" -H "content-type: application/json" --data-binary @- <<BODY | |
| { | |
| "token": "$SPINNAKER_WEBHOOK_TOKEN", | |
| "branch": "$GIT_BRANCH_DEPLOY", | |
| "parameters": { | |
| "dependency_docker_tag": "$DOCKER_TAG", | |
| "docker_tag": "$IDENTITY_SERVER_DOCKER_TAG" | |
| } | |
| } | |
| BODY | |
| push-success: | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| if: ${{ !cancelled() }} | |
| needs: | |
| - pre-checks | |
| - retag-unaffected | |
| - deploy | |
| - tests | |
| steps: | |
| - name: Check retag success | |
| run: '[[ ${{ needs.retag-unaffected.result }} != "failure" ]] || exit 1' | |
| - name: Check deploy success | |
| run: '[[ ${{ needs.deploy.result }} != "failure" ]] || exit 1' | |
| - name: Check tests success | |
| run: '[[ ${{ needs.tests.result }} != "failure" ]] || exit 1' | |
| - name: Announce success | |
| if: needs.pre-checks.outputs.PRE_CHECK | |
| run: echo "Build is successful" | |
| - name: Announce skipped | |
| if: '!needs.pre-checks.outputs.PRE_CHECK' | |
| run: echo "Build was skipped" | |
| failure-notification: | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| if: failure() && needs.pre-checks.outputs.PRE_CHECK && needs.pre-checks.outputs.PRE_CHECK != 'feature-deploy' | |
| needs: | |
| - pre-checks | |
| - prepare | |
| - docker-build | |
| - retag-unaffected | |
| - deploy | |
| steps: | |
| - name: Send Slack notification | |
| uses: 8398a7/action-slack@v3 | |
| with: | |
| status: failure | |
| icon_emoji: ':broken_heart:' | |
| fields: repo,message,commit,author,action,eventName,ref,workflow,took # selectable (default: repo,message) | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # optional | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} # required | |
| scanflags: | |
| if: github.ref == 'ref/heads/main' | |
| runs-on: ec2-runners | |
| container: | |
| image: public.ecr.aws/m3u4c4h9/island-is/actions-runner-public:latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Scan & upload main config | |
| uses: configcat/scan-repository@v2 | |
| with: | |
| api-user: ${{ secrets.CONFIGCAT_API_USER }} | |
| api-pass: ${{ secrets.CONFIGCAT_API_PASS }} | |
| config-id: ${{ env.CONFIGCAT_MAIN_CONFIG_ID }} | |
| - name: Scan & upload mobile app config | |
| uses: configcat/scan-repository@v2 | |
| with: | |
| api-user: ${{ secrets.CONFIGCAT_API_USER }} | |
| api-pass: ${{ secrets.CONFIGCAT_API_PASS }} | |
| config-id: ${{ env.CONFIGCAT_MOBILE_APP_CONFIG_ID }} | |
| sub-folder: apps/native |