ci: set environment in the workflow #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # yamllint disable rule:line-length | |
| name: publish-nginx | |
| on: # yamllint disable-line rule:truthy | |
| push: | |
| tags: | |
| - v* | |
| branches: | |
| - feat/nginx-config-as-artifact | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| release: | |
| name: Release nginx configs and image | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| # This environment is tied to the AWS Role assumed by this workflow. | |
| # The Role will only allow to be assumed if the workflow is set with this environment. | |
| # We also have additional protection rules on this environment. | |
| environment: publish-nginx | |
| permissions: | |
| id-token: write | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-hathor-env | |
| name: Setup Hathor node environment | |
| with: | |
| python: '3.12' | |
| os: 'ubuntu-24.04' | |
| - name: Extract version from tag | |
| id: version | |
| # run: echo "version=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT | |
| run: echo "version=test1" >> $GITHUB_OUTPUT | |
| - name: Configure AWS credentials (OIDC) | |
| uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6 | |
| with: | |
| role-to-assume: arn:aws:iam::769498303037:role/GitHubActionsNginxConfigUploadRole | |
| aws-region: us-east-1 | |
| - name: Generate all nginx configs | |
| working-directory: extras/nginx_docker | |
| run: poetry run make generate-all VERSION="$VERSION" | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| - name: Upload configs to S3 (versioned) | |
| working-directory: extras/nginx_docker | |
| run: make upload-to-s3 VERSION="$VERSION" | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| - name: Upload configs to S3 (latest) | |
| working-directory: extras/nginx_docker | |
| run: make upload-to-s3-as-latest VERSION="$VERSION" | |
| env: | |
| VERSION: ${{ steps.version.outputs.version }} | |
| - name: Generate set_real_ip_from_cloudfront | |
| working-directory: extras/nginx_docker | |
| run: make set_real_ip_from_cloudfront | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 | |
| # --- AWS ECR --- | |
| - name: Login to Amazon ECR | |
| uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2 | |
| - name: Build and push to ECR | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | |
| with: | |
| context: extras/nginx_docker | |
| push: true | |
| platforms: linux/amd64,linux/arm64/v8 | |
| tags: | | |
| 769498303037.dkr.ecr.us-east-1.amazonaws.com/webtank:${{ steps.version.outputs.version }} | |
| 769498303037.dkr.ecr.us-east-1.amazonaws.com/webtank:latest | |
| # --- GCP Artifact Registries --- | |
| # standalone-fullnodes | |
| - name: Authenticate to GCP (standalone-fullnodes) | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | |
| with: | |
| workload_identity_provider: projects/${{ vars.SF_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/github/providers/github | |
| service_account: '' | |
| id: gcp-auth-sf | |
| - name: Configure Docker for Artifact Registry (standalone-fullnodes) | |
| run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet | |
| - name: Build and push to standalone-fullnodes | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | |
| with: | |
| context: extras/nginx_docker | |
| push: true | |
| platforms: linux/amd64,linux/arm64/v8 | |
| tags: | | |
| us-central1-docker.pkg.dev/standalone-fullnodes/fullnodes/webtank:${{ steps.version.outputs.version }} | |
| us-central1-docker.pkg.dev/standalone-fullnodes/fullnodes/webtank:latest | |
| # hathor-testnet | |
| - name: Authenticate to GCP (hathor-testnet) | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | |
| with: | |
| workload_identity_provider: projects/${{ vars.HT_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/github/providers/github | |
| service_account: '' | |
| id: gcp-auth-ht | |
| - name: Configure Docker for Artifact Registry (hathor-testnet) | |
| run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet | |
| - name: Build and push to hathor-testnet | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | |
| with: | |
| context: extras/nginx_docker | |
| push: true | |
| platforms: linux/amd64,linux/arm64/v8 | |
| tags: | | |
| us-central1-docker.pkg.dev/hathor-testnet/fullnodes/webtank:${{ steps.version.outputs.version }} | |
| us-central1-docker.pkg.dev/hathor-testnet/fullnodes/webtank:latest | |
| # ekvilibro | |
| - name: Authenticate to GCP (ekvilibro) | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | |
| with: | |
| workload_identity_provider: projects/${{ vars.EKV_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/github/providers/github | |
| service_account: '' | |
| id: gcp-auth-ekv | |
| - name: Configure Docker for Artifact Registry (ekvilibro) | |
| run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet | |
| - name: Build and push to ekvilibro | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | |
| with: | |
| context: extras/nginx_docker | |
| push: true | |
| platforms: linux/amd64,linux/arm64/v8 | |
| tags: | | |
| us-central1-docker.pkg.dev/ekvilibro/fullnodes/webtank:${{ steps.version.outputs.version }} | |
| us-central1-docker.pkg.dev/ekvilibro/fullnodes/webtank:latest | |
| # hathor-testnet-playground | |
| - name: Authenticate to GCP (hathor-testnet-playground) | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | |
| with: | |
| workload_identity_provider: projects/${{ vars.HTP_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/github/providers/github | |
| service_account: '' | |
| id: gcp-auth-htp | |
| - name: Configure Docker for Artifact Registry (hathor-testnet-playground) | |
| run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet | |
| - name: Build and push to hathor-testnet-playground | |
| uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 | |
| with: | |
| context: extras/nginx_docker | |
| push: true | |
| platforms: linux/amd64,linux/arm64/v8 | |
| tags: | | |
| us-central1-docker.pkg.dev/hathor-testnet-playground/fullnodes/webtank:${{ steps.version.outputs.version }} | |
| us-central1-docker.pkg.dev/hathor-testnet-playground/fullnodes/webtank:latest |