-
Notifications
You must be signed in to change notification settings - Fork 0
215 lines (205 loc) · 8.31 KB
/
integration-deployment.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
name: CI/CD
on:
push:
branches:
- 'main'
env:
API_ARTIFACT_REGISTRY_LOCATION: europe-west1
API_ARTIFACT_REGISTRY: endpoints-api
API_ARTIFACT_REGISTRY_CONTAINER_NAME: endpoints-runtime-serverless
API_CLOUD_RUN_LOCATION: europe-west1
API_CLOUD_RUN_SERVICE: public-api
API_ENDPOINTS_SERVICE: api.playlists.derlev.xyz
API_ESP_BASE_IMAGE: gcr.io/endpoints-release/endpoints-runtime-serverless:2
jobs:
# Path Filtering
filter-paths:
name: Filter Paths
runs-on: ubuntu-latest
outputs:
functions: ${{ steps.filter.outputs.functions }}
api: ${{ steps.filter.outputs.api }}
permissions:
contents: read
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Filter Paths
id: filter
uses: dorny/paths-filter@v3.0.2
with:
filters: |
functions:
- 'functions/**'
- '!(functions)/**/*.md'
api:
- 'public-api/**'
- '!(public-api)/**/*.md'
- '.github/workflows/integration-deployment.yml'
# START: Cloud Functions
func-lint-typecheck:
name: 'Functions: Lint & Type Check'
runs-on: ubuntu-latest
needs: filter-paths
if: needs.filter-paths.outputs.functions == 'true'
permissions:
checks: write
pull-requests: read
contents: read
defaults:
run:
working-directory: functions
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Setup Nodejs Environment
uses: actions/setup-node@v4
with:
node-version: 20
cache: yarn
cache-dependency-path: 'functions/yarn.lock'
- name: Install Dependencies
run: yarn --frozen-lockfile
- name: Lint
run: yarn lint --output-file eslint_report.json --format json
continue-on-error: true
- name: Type Check
run: yarn tsc --noEmit > typescript.log
continue-on-error: true
- name: Annotate Code
uses: DerLev/eslint-annotations@v2
with:
eslint-report: functions/eslint_report.json
typescript-log: functions/typescript.log
github-token: ${{ secrets.GITHUB_TOKEN }}
error-on-warn: true
status-check-name: 'Functions: Annotations'
fail-in-pr: false
add-notice-with-url: false
# END: Cloud Functions
# START: Public API - Cloud Endpoints
api-delete-outdated-ar:
name: "API: Delete outdated Container Images from Artifact Registry"
runs-on: ubuntu-latest
needs: filter-paths
if: needs.filter-paths.outputs.api == 'true'
permissions:
id-token: write
steps:
- name: Prevent Auth from printing warning
run: echo "Shut up!" > dont_warn.txt
- name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
service_account: ${{ secrets.GCP_SA_EMAIL }}
- name: Cleanup Artifact Registry
uses: docker://europe-docker.pkg.dev/gcr-cleaner/gcr-cleaner/gcr-cleaner-cli
with:
args: >-
-repo=${{ env.API_ARTIFACT_REGISTRY_LOCATION }}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID }}/${{ env.API_ARTIFACT_REGISTRY }}/${{ env.API_ARTIFACT_REGISTRY_CONTAINER_NAME }}
-keep=4
-tag-filter-any=.*
api-delete-outdated-cr:
name: "API: Delete outdated Cloud Run Revisions"
runs-on: ubuntu-latest
needs: filter-paths
if: needs.filter-paths.outputs.api == 'true'
permissions:
id-token: write
steps:
- name: Prevent Auth from printing warning
run: echo "Shut up!" > dont_warn.txt
- name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
token_format: "access_token"
workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
service_account: ${{ secrets.GCP_SA_EMAIL }}
access_token_lifetime: 60s
create_credentials_file: false
- name: Only leave the most recent Cloud Run Revisions
uses: actions/github-script@v7
with:
script: |
const response = await fetch("https://run.googleapis.com/v2/projects/${{ vars.GCP_PROJECT_ID }}/locations/${{ env.API_CLOUD_RUN_LOCATION }}/services/${{ env.API_CLOUD_RUN_SERVICE }}/revisions", { headers: { 'Authorization': "Bearer ${{ steps.auth.outputs.access_token }}" } })
.then(res => res.json());
const toBeDeleted = response.revisions.sort((a, b) => (new Date(b.createTime) - new Date(a.createTime))).slice(1);
const deletionPromises = [];
for(const revision of toBeDeleted) {
deletionPromises.push(fetch(`https://run.googleapis.com/v2/${revision.name}`, { method: 'DELETE', headers: { 'Authorization': "Bearer ${{ steps.auth.outputs.access_token }}" } }));
}
await Promise.all(deletionPromises);
api-deploy:
name: 'API: Deploy new OpenAPI version'
runs-on: ubuntu-latest
needs: [api-delete-outdated-ar, api-delete-outdated-cr]
permissions:
contents: read
id-token: write
defaults:
run:
working-directory: public-api
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Setup Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Authenticate to Google Cloud
id: auth
uses: google-github-actions/auth@v2
with:
token_format: access_token
workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
service_account: ${{ secrets.GCP_SA_EMAIL }}
access_token_lifetime: 600s
- name: Login to GCP Artifact Registry
uses: docker/login-action@v3
with:
registry: ${{ env.API_ARTIFACT_REGISTRY_LOCATION }}-docker.pkg.dev
username: oauth2accesstoken
password: ${{ steps.auth.outputs.access_token }}
- name: Setup Cloud SDK
uses: google-github-actions/setup-gcloud@v2
- name: Deploy new Cloud Endpoints revision
run: 'gcloud endpoints services deploy openapi-run.yaml'
- name: Get latest revision config id
id: current-config-id
run: echo "config-id=$(gcloud endpoints configs list --service=${{ env.API_ENDPOINTS_SERVICE }} | awk 'NR==2 {print $1}')" >> $GITHUB_OUTPUT
- name: Download ESPv2 config
id: current-esp-config
run: 'curl -o "service.json" -H "Authorization: Bearer ${{ steps.auth.outputs.access_token }}" "https://servicemanagement.googleapis.com/v1/services/${{ env.API_ENDPOINTS_SERVICE }}/configs/${{ steps.current-config-id.outputs.config-id }}?view=FULL"'
- name: Create Dockerfile for ESPv2 container
run: |
cat <<EOF > Dockerfile
FROM ${BASE_IMAGE}
USER root
ENV ENDPOINTS_SERVICE_PATH /etc/endpoints/service.json
COPY service.json \${ENDPOINTS_SERVICE_PATH}
RUN chown -R envoy:envoy \${ENDPOINTS_SERVICE_PATH} && chmod -R 755 \${ENDPOINTS_SERVICE_PATH}
USER envoy
ENTRYPOINT ["/env_start_proxy.py"]
EOF
- name: Extract Metadata for Docker
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.API_ARTIFACT_REGISTRY_LOCATION }}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID }}/${{ env.API_ARTIFACT_REGISTRY }}/${{ env.API_ARTIFACT_REGISTRY_CONTAINER_NAME }}
tags: |
type=raw,value=latest
type=sha,prefix=,format=long
type=raw,value=${{ env.API_ENDPOINTS_SERVICE }}-${{ steps.current-config-id.outputs.config-id }}
- name: Build and Push Docker Image
uses: docker/build-push-action@v5
with:
context: public-api/
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
- name: Create new Cloud Run Revision
env:
CLOUDSDK_CORE_DISABLE_PROMPTS: 1
run: gcloud run deploy ${{ env.API_CLOUD_RUN_SERVICE }} --image ${{ env.API_ARTIFACT_REGISTRY_LOCATION }}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID }}/${{ env.API_ARTIFACT_REGISTRY }}/${{ env.API_ARTIFACT_REGISTRY_CONTAINER_NAME }}:${{ github.sha }} --region ${{ env.API_CLOUD_RUN_LOCATION }}
# END: Public API - Cloud Endpoints