Skip to content

Commit b795439

Browse files
carlpartridgecarlpartridge
authored
Merge branch 'main' into carl-9484-migrate-aws-to-v2
2 parents 32a4145 + 2d5d0a8 commit b795439

26 files changed

+691
-193
lines changed

‎.github/workflows/build-and-publish-all.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Build and Publish All
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
release_version:
7+
description: 'Release version/tag (or branch name)'
8+
required: true
9+
type: string
10+
ssas_release_version:
11+
description: 'Release version/tag for bcda-ssas (or branch name)'
12+
required: true
13+
type: string
14+
workflow_dispatch:
15+
inputs:
16+
release_version:
17+
description: 'Release version/tag (or branch name)'
18+
required: true
19+
type: string
20+
ssas_release_version:
21+
description: 'Release version/tag for bcda-ssas (or branch name)'
22+
required: true
23+
type: string
24+
25+
permissions:
26+
id-token: write
27+
contents: read
28+
29+
jobs:
30+
build_and_publish_api:
31+
uses: ./.github/workflows/build-and-publish-api.yml
32+
with:
33+
release_version: ${{ inputs.release_version || 'main' }}
34+
secrets: inherit
35+
36+
build_and_publish_worker:
37+
uses: ./.github/workflows/build-and-publish-worker.yml
38+
with:
39+
release_version: ${{ inputs.release_version || 'main' }}
40+
secrets: inherit
41+
42+
build_and_publish_ssas:
43+
uses: CMSgov/bcda-ssas-app/.github/workflows/build-and-publish.yml@main
44+
with:
45+
ssas_release_version: ${{ inputs.ssas_release_version || 'main' }}
46+
secrets: inherit
47+
48+
post_build:
49+
if: ${{ always() }}
50+
name: Post Build (Cleanup, Alerts)
51+
needs: [build_and_publish_api, build_and_publish_worker, build_and_publish_ssas]
52+
runs-on: codebuild-bcda-app-${{github.run_id}}-${{github.run_attempt}}
53+
steps:
54+
- name: Success Alert
55+
if: ${{ success() && needs.build_and_publish_api.result == 'success' && needs.build_and_publish_worker.result == 'success' && needs.build_and_publish_ssas.result == 'success' }}
56+
uses: slackapi/slack-github-action@v2.0.0
57+
with:
58+
method: chat.postMessage
59+
token: ${{ secrets.SLACK_BOT_TOKEN }}
60+
# Sends to bcda-deploy
61+
payload: |
62+
channel: "C03S23MJFJS"
63+
attachments:
64+
- color: good
65+
text: "SUCCESS: Build and Publish BCDA/SSAS (run: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.run_id }}>)."
66+
mrkdown_in:
67+
- text
68+
- name: Failure Alert
69+
if: ${{ failure() || needs.build_and_publish_api.result != 'success' || needs.build_and_publish_worker.result != 'success' || needs.build_and_publish_ssas.result != 'success' }}
70+
uses: slackapi/slack-github-action@v2.0.0
71+
with:
72+
method: chat.postMessage
73+
token: ${{ secrets.SLACK_BOT_TOKEN }}
74+
payload: |
75+
channel: "C03S23MJFJS"
76+
attachments:
77+
- color: danger
78+
text: "FAILURE: Build and Publish BCDA/SSAS (run: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.run_id }}>)."
79+
mrkdown_in:
80+
- text
81+

‎.github/workflows/build-and-publish-api.yml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Build and publish BCDA
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
release_version:
7+
description: 'Release version (or branch name)'
8+
required: true
9+
type: string
10+
workflow_dispatch:
11+
inputs:
12+
release_version:
13+
description: 'Release version (or branch name)'
14+
required: true
15+
type: string
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
# FARGATE FIXME: unnecessary and causes errors when running ci_checks more than once for a single build
23+
# This should be commented back in when build-and-package-all is no longer around.
24+
# ci_checks:
25+
# uses: ./.github/workflows/ci-checks.yml
26+
# with:
27+
# release_version: ${{ inputs.release_version || 'main' }}
28+
# secrets: inherit
29+
30+
build_and_publish:
31+
# needs: [ci_checks]
32+
runs-on: codebuild-bcda-app-${{github.run_id}}-${{github.run_attempt}}
33+
strategy:
34+
matrix:
35+
vars:
36+
- account_id: NON_PROD_ACCOUNT_ID
37+
role_to_assume: bcda-dev-github-actions
38+
- account_id: PROD_ACCOUNT_ID
39+
role_to_assume: bcda-prod-github-actions
40+
steps:
41+
- uses: aws-actions/configure-aws-credentials@v4
42+
with:
43+
aws-region: ${{ vars.AWS_REGION }}
44+
role-to-assume: arn:aws:iam::${{ secrets[matrix.vars.account_id] }}:role/delegatedadmin/developer/${{ matrix.vars.role_to_assume }}
45+
- name: Checkout BCDA
46+
uses: actions/checkout@v4
47+
with:
48+
repository: CMSgov/bcda-app
49+
ref: ${{ inputs.release_version }}
50+
- name: Set ECR_URL
51+
run: echo "ECR_URL=${{ secrets[matrix.vars.account_id] }}.dkr.ecr.us-east-1.amazonaws.com/bcda-api" >> $GITHUB_ENV
52+
- name: Build BCDA
53+
# Dont release main to prod, also make sure 'latest' in prod aligns with the latest release tag
54+
if: ${{ matrix.vars.account_id == 'NON_PROD_ACCOUNT_ID' && inputs.release_version == 'main' }}
55+
run: |
56+
docker build \
57+
--build-arg RELEASE_VERSION=${{ inputs.release_version || 'main' }} \
58+
-t ${{ env.ECR_URL }}:latest \
59+
-t ${{ env.ECR_URL }}:${{ inputs.release_version || 'main' }} \
60+
-f Dockerfiles/Dockerfile.bcda .
61+
- name: Push to ECR
62+
if: ${{ matrix.vars.account_id == 'NON_PROD_ACCOUNT_ID' && inputs.release_version == 'main' }}
63+
run: |
64+
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin '${{ env.ECR_URL }}'
65+
docker image push '${{ env.ECR_URL }}' -a

‎.github/workflows/build-and-publish-worker.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Build and publish Worker
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
release_version:
7+
description: 'Release version (or branch name)'
8+
required: true
9+
type: string
10+
workflow_dispatch:
11+
inputs:
12+
release_version:
13+
description: 'Release version (or branch name)'
14+
required: true
15+
type: string
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
build_and_publish:
23+
runs-on: codebuild-bcda-app-${{github.run_id}}-${{github.run_attempt}}
24+
strategy:
25+
matrix:
26+
vars:
27+
- account_id: NON_PROD_ACCOUNT_ID
28+
role_to_assume: bcda-dev-github-actions
29+
- account_id: PROD_ACCOUNT_ID
30+
role_to_assume: bcda-prod-github-actions
31+
steps:
32+
- uses: aws-actions/configure-aws-credentials@v4
33+
with:
34+
aws-region: ${{ vars.AWS_REGION }}
35+
role-to-assume: arn:aws:iam::${{ secrets[matrix.vars.account_id] }}:role/delegatedadmin/developer/${{ matrix.vars.role_to_assume }}
36+
- name: Checkout BCDA
37+
uses: actions/checkout@v4
38+
with:
39+
repository: CMSgov/bcda-app
40+
ref: ${{ inputs.release_version }}
41+
- name: Set ECR_URL
42+
run: echo "ECR_URL=${{ secrets[matrix.vars.account_id] }}.dkr.ecr.us-east-1.amazonaws.com/bcda-worker" >> $GITHUB_ENV
43+
- name: Build Worker
44+
# Dont release main to prod, also make sure 'latest' in prod aligns with the latest release tag
45+
if: ${{ matrix.vars.account_id == 'NON_PROD_ACCOUNT_ID' && inputs.release_version == 'main' }}
46+
run: |
47+
docker build \
48+
--build-arg RELEASE_VERSION=${{ inputs.release_version || 'main' }} \
49+
-t ${{ env.ECR_URL }}:latest \
50+
-t ${{ env.ECR_URL }}:${{ inputs.release_version || 'main' }} \
51+
-f Dockerfiles/Dockerfile.bcdaworker .
52+
- name: Push to ECR
53+
if: ${{ matrix.vars.account_id == 'NON_PROD_ACCOUNT_ID' && inputs.release_version == 'main' }}
54+
run: |
55+
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin '${{ env.ECR_URL }}'
56+
docker image push '${{ env.ECR_URL }}' -a

‎.github/workflows/deploy-all.yml‎

Lines changed: 57 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -163,18 +163,35 @@ jobs:
163163
- name: Install tenv
164164
uses: cmsgov/cdap/actions/setup-tenv@8343fb96563ce4b74c4dececee9b268f42bd4a40
165165
- name: Init, Plan OpenTofu
166+
# FARGATE FIXUP: adding fargate vars to tf plan
167+
if: ${{ env.RELEASE_ENV == 'dev' }}
168+
working-directory: terraform/${{ env.RELEASE_ENV }}
169+
run: |
170+
IFS=":@" read -r -a STRS <<< ${{ env.DATABASE_URL }}
171+
export APP_DB_PW=${STRS[2]}
172+
tofu init
173+
tofu plan \
174+
-var 'env=${{ env.RELEASE_ENV }}' \
175+
-var 'ami_id=${{ env.BCDA_AMI }}' \
176+
-var 'worker_ami_id=${{ env.WORKER_AMI }}' \
177+
-var 'instance_type=${{ vars.INSTANCE_CLASS }}' \
178+
-var 'api_image_tag=${{ env.RELEASE_VERSION }}' \
179+
-var 'ssas_image_tag=${{ env.SSAS_RELEASE_VERSION }}' \
180+
-var 'worker_image_tag=${{ env.RELEASE_VERSION }}' \
181+
-out 'bcda-release-api-worker.tfplan'
182+
- name: Init, Plan OpenTofu
183+
# FARGATE FIXUP: adding fargate vars to tf plan
184+
if: ${{ env.RELEASE_ENV != 'dev' }}
166185
working-directory: terraform/${{ env.RELEASE_ENV }}
167186
run: |
168187
IFS=":@" read -r -a STRS <<< ${{ env.DATABASE_URL }}
169188
export APP_DB_PW=${STRS[2]}
170-
touch bcda-release-api-worker-vars.tfvars
171189
tofu init
172190
tofu plan \
173191
-var 'env=${{ env.RELEASE_ENV }}' \
174192
-var 'ami_id=${{ env.BCDA_AMI }}' \
175193
-var 'worker_ami_id=${{ env.WORKER_AMI }}' \
176194
-var 'instance_type=${{ vars.INSTANCE_CLASS }}' \
177-
-var-file=bcda-release-api-worker-vars.tfvars \
178195
-out 'bcda-release-api-worker.tfplan'
179196
- name: OpenTofu Apply
180197
working-directory: terraform/${{ env.RELEASE_ENV }}
@@ -186,6 +203,13 @@ jobs:
186203
aws autoscaling start-instance-refresh --region ${{ vars.AWS_REGION }} --auto-scaling-group-name ${ASG}
187204
export WORKER_ASG=`aws autoscaling describe-auto-scaling-groups --region ${{ vars.AWS_REGION }} --filters "Name=tag:Name,Values=bcda-${{ env.RELEASE_ENV }}-worker" --query 'AutoScalingGroups[0].AutoScalingGroupName' --output text`
188205
aws autoscaling start-instance-refresh --region ${{ vars.AWS_REGION }} --auto-scaling-group-name ${WORKER_ASG}
206+
- name: Refresh Deployments
207+
# FARGATE FIXUP:
208+
if: ${{ env.RELEASE_ENV == 'dev' }}
209+
run: |
210+
aws ecs update-service --cluster bcda-${{ env.RELEASE_ENV }} --service bcda-${{ env.RELEASE_ENV }}-api --force-new-deployment
211+
aws ecs update-service --cluster bcda-${{ env.RELEASE_ENV }} --service bcda-${{ env.RELEASE_ENV }}-ssas --force-new-deployment
212+
aws ecs update-service --cluster bcda-${{ env.RELEASE_ENV }} --service bcda-${{ env.RELEASE_ENV }}-worker --force-new-deployment
189213
- name: Upload notify script
190214
uses: actions/upload-artifact@v4
191215
with:
@@ -256,7 +280,7 @@ jobs:
256280
export IMAGE_ID=`aws ec2 describe-instances --region ${{ vars.AWS_REGION }} --filters 'Name=tag:Name,Values=bcda-${{ env.RELEASE_ENV }}-worker' 'Name=instance-state-name,Values=running' --query 'Reservations[0].Instances[*][LaunchTime,ImageId] | reverse(sort_by(@,&[0])) | [0][1]' --output text`
257281
# Was unable to escape the backticks (`), creating this function seems to get around that
258282
get_image_version () {
259-
aws ec2 describe-images --region us-east-1 --image-ids ${IMAGE_ID} --query 'Images[0].Tags[?Key==`version`].Value' --output text
283+
aws ec2 describe-images --region ${{ vars.AWS_REGION }} --image-ids ${IMAGE_ID} --query 'Images[0].Tags[?Key==`version`].Value' --output text
260284
}
261285
export BCDA_WORKER_VERSION=`get_image_version`
262286
@@ -272,6 +296,36 @@ jobs:
272296
break
273297
fi
274298
done
299+
300+
# # FARGATE FIXUP:
301+
# This needs the 'image_tag' tag to be added to each service before this will work
302+
# verify_worker_version:
303+
# needs: [deploy]
304+
# runs-on: codebuild-bcda-app-${{github.run_id}}-${{github.run_attempt}}
305+
# environment: ${{ inputs.env != '0' && inputs.env || 'dev' }}
306+
# steps:
307+
# - uses: aws-actions/configure-aws-credentials@v4
308+
# with:
309+
# aws-region: ${{ vars.AWS_REGION }}
310+
# role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/delegatedadmin/developer/${{ vars.AWS_ROLE_TO_ASSUME }}
311+
# - run: |
312+
# TRY=1
313+
314+
# until [ $TRY -gt $VERIFICATION_RETRIES ]; do
315+
# WORKER_VERSION=`aws ecs --resource-arn list-tags-for-resource arn:aws:ecs:${{ vars.AWS_REGION }}:${{ secrets.AWS_ACCOUNT_ID }}:service/bcda-${{ env.RELEASE_ENV }}/bcda-${{ env.RELEASE_ENV }}-api --query "tags[?key=='image_tag'].value | [0]" --output text`
316+
317+
# if [[ $WORKER_VERSION != ${{ env.RELEASE_VERSION }} ]]; then
318+
# echo "BCDA Worker expected release version: ${{ env.RELEASE_VERSION }} did not match AWS version: ${WORKER_VERSION}."
319+
# TRY=$(($TRY + 1))
320+
# if [ $TRY -gt $VERIFICATION_RETRIES ]; then
321+
# exit 1
322+
# else
323+
# sleep $VERIFICATION_SLEEP
324+
# fi
325+
# else
326+
# break
327+
# fi
328+
# done
275329

276330
smoketests:
277331
needs: [migrate_db, migrate_ssas_db, deploy, verify_api_version, verify_ssas_version, verify_worker_version]

‎.github/workflows/dev-daily-autodeploy.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Deploy BCDA/SSAS and Worker ec2 instances to dev daily
1+
# Build and Deploy BCDA, SSAS, and Worker to dev daily
22
name: Deploy main to dev daily
33

44
on:
@@ -17,9 +17,16 @@ jobs:
1717
ops_release_version: main
1818
ssas_release_version: main
1919
secrets: inherit
20+
21+
build_and_publish_all:
22+
uses: ./.github/workflows/build-and-publish-all.yml
23+
with:
24+
release_version: main
25+
ssas_release_version: main
26+
secrets: inherit
2027

2128
deploy_all:
22-
needs: [build_and_package_all]
29+
needs: [build_and_package_all, build_and_publish_all]
2330
uses: ./.github/workflows/deploy-all.yml
2431
with:
2532
release_version: main

‎Dockerfiles/Dockerfile.bcda‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
FROM golang:1.25.1-alpine3.22 AS builder
22

33
ARG GO_FLAGS
4+
ARG RELEASE_VERSION=main
45

56
WORKDIR /go/src/github.com/CMSgov/bcda-app
67

@@ -17,34 +18,40 @@ COPY . .
1718
WORKDIR /go/src/github.com/CMSgov/bcda-app/bcda
1819
RUN --mount=type=cache,target=/go/pkg/mod \
1920
--mount=type=cache,target=/root/.cache/go-build \
20-
go install "$GO_FLAGS"
21+
go install -ldflags "-X github.com/CMSgov/bcda-app/bcda/constants.Version=${RELEASE_VERSION}" "$GO_FLAGS"
2122

2223
# ------------------------------------------------------------------------
2324
FROM golang:1.25.1-alpine3.22
2425

26+
RUN apk update upgrade && \
27+
apk add --no-cache aws-cli
28+
2529
RUN addgroup -S -g 1010 bcda && adduser -S -G bcda -u 1010 bcda
2630

2731
# install dev packages if the environment argument was set to development
2832
ARG ENVIRONMENT
29-
RUN [ "$ENVIRONMENT" != "development" ] || apk update upgrade && \
30-
apk add bash && \
33+
RUN [ "$ENVIRONMENT" != "development" ] || apk add --no-cache bash && \
3134
go install github.com/go-delve/delve/cmd/dlv@latest
3235

3336
WORKDIR /go/src/github.com/CMSgov/bcda-app/bcda
3437

3538
COPY --from=builder /go/src/github.com/CMSgov/bcda-app/shared_files/ /go/src/github.com/CMSgov/bcda-app/shared_files/
3639
COPY --from=builder /go/src/github.com/CMSgov/bcda-app/bcda/ /go/src/github.com/CMSgov/bcda-app/bcda/
3740
COPY --from=builder /go/bin/ /go/bin/
41+
COPY --from=builder /go/src/github.com/CMSgov/bcda-app/entrypoint.sh .
3842

3943
# configure directories
40-
RUN mkdir /var/fhir && chown -R bcda:bcda \
44+
RUN mkdir -p /var/fhir /etc/sv/api/env && chown -R bcda:bcda \
4145
/go/src/github.com/CMSgov/bcda-app \
4246
/var/fhir \
47+
/etc/sv/api/env \
4348
/var/log
4449

4550
USER bcda
4651

4752
EXPOSE 3000 3001
4853

49-
ENTRYPOINT ["bcda"]
50-
CMD ["start-api"]
54+
ENV APP_NAME="api"
55+
56+
ENTRYPOINT ["./entrypoint.sh"]
57+
CMD ["bcda", "start-api"]

0 commit comments

Comments
 (0)