Skip to content

Commit ec03678

Browse files
CMCDragonkaiCMCDragonkai
authored
Merge pull request #3 from MatrixAI/feature-workflows
Setup common workflows for all GH repositories (public/private)
2 parents 222203c + 02f43bb commit ec03678

9 files changed

+962
-1
lines changed

‎.github/actions/secrets-parse/action.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Secrets Bundle Parse
2+
description: |
3+
Parses a secrets bundle and exports each secret as an environment variable.
4+
Requires `jq`.
5+
6+
inputs:
7+
secrets:
8+
required: true
9+
description: |
10+
Secret bundle created by block scalar `|` and `toJSON` which is used to
11+
encode each secret into 1 line, allowing line-based separation per secret.
12+
13+
SECRETS: |
14+
SECRET1=\$\{\{ toJSON(secrets.SECRET1) \}\}
15+
SECRET2=\$\{\{ toJSON(secrets.SECRET2) \}\}
16+
SECRET3=\$\{\{ toJSON(secrets.SECRET3) \}\}
17+
18+
runs:
19+
using: composite
20+
steps:
21+
- shell: bash
22+
env:
23+
SECRETS: ${{ inputs.secrets }}
24+
run: |
25+
if ! type jq &> /dev/null; then
26+
echo 'jq is not installed. Please install jq to proceed.'
27+
exit 1
28+
fi
29+
delimiter="EOF-$RANDOM"
30+
while IFS= read -r line; do
31+
if [ -z "$line" ]; then
32+
continue
33+
fi
34+
key="${line%%=*}"
35+
json_value="${line#*=}"
36+
value="$(jq -r '.' <<< "$json_value")"
37+
# Mask the value (possibly multiline) from the logs
38+
while IFS= read -r line; do printf "::add-mask::%s\n" "$line"; done <<< "$value"
39+
{
40+
printf "%s<<%s\n" "$key" "$delimiter"
41+
printf "%s\n" "$value"
42+
printf "%s\n" "$delimiter"
43+
} >> "$GITHUB_ENV"
44+
done <<< "$SECRETS"

‎.github/workflows/application-js-cloudflare-feature-closed.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: "CI / Application JS Cloudflare Feature Closed"
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
appName:
7+
type: string
8+
required: true
9+
appHostname:
10+
type: string
11+
required: true
12+
featureBranch:
13+
type: string
14+
required: true
15+
secrets:
16+
NIXPKGS_PRIVATE_PAT:
17+
required: true
18+
CLOUDFLARE_ACCOUNT_ID:
19+
required: true
20+
CLOUDFLARE_ZONE_ID:
21+
required: true
22+
CLOUDFLARE_API_TOKEN:
23+
required: true
24+
25+
jobs:
26+
feature-closed-deployment-stop:
27+
name: "Feature Closed / Deployment Stop"
28+
runs-on: ubuntu-latest
29+
container:
30+
image: ghcr.io/matrixai/github-runner
31+
concurrency:
32+
group: feature-closed-deployment-stop
33+
cancel-in-progress: false
34+
# Only run if the PR head is a feature branch
35+
# This means the feature branch PR is closed
36+
if: startsWith(inputs.featureBranch, 'feature')
37+
permissions:
38+
packages: read
39+
contents: read
40+
steps:
41+
- uses: actions/checkout@v4
42+
with:
43+
lfs: true
44+
- name: Stop Deployment
45+
env:
46+
NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
47+
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
48+
CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
49+
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
50+
APP_NAME: ${{ inputs.appName }}
51+
APP_HOSTNAME: ${{ inputs.appHostname }}
52+
FEATURE_BRANCH: ${{ inputs.featureBranch }}
53+
run: |
54+
echo 'Perform service undeployment for feature'
55+
nix develop .#ci --command bash -c $'
56+
wrangler delete --name "$APP_NAME-dev-$FEATURE_BRANCH" --force
57+
./scripts/certs-gc.sh "$FEATURE_BRANCH.dev.$APP_HOSTNAME"
58+
'

‎.github/workflows/application-js-cloudflare-feature.yml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
name: "CI / Application JS Cloudflare Feature"
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
type: string
8+
default: master
9+
description: >
10+
Reference used for this repository, so we can re-use it when
11+
referencing local actions, and avoid having to checkout this
12+
repository separately.
13+
secrets:
14+
NIXPKGS_PRIVATE_PAT:
15+
required: true
16+
DEPLOY_SECRETS:
17+
required: true
18+
19+
jobs:
20+
# Lint the code
21+
feature-lint:
22+
name: "Feature / Lint"
23+
runs-on: ubuntu-latest
24+
container:
25+
image: ghcr.io/matrixai/github-runner
26+
permissions:
27+
packages: read
28+
contents: read
29+
steps:
30+
- uses: actions/checkout@v4
31+
with:
32+
lfs: true
33+
- name: Run linting
34+
env:
35+
NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
36+
run: |
37+
nix develop .#ci --command bash -c $'
38+
npm run lint
39+
'
40+
41+
# Build the public
42+
feature-build:
43+
name: "Feature / Build"
44+
runs-on: ubuntu-latest
45+
container:
46+
image: ghcr.io/matrixai/github-runner
47+
permissions:
48+
packages: read
49+
contents: read
50+
actions: write
51+
steps:
52+
- uses: actions/checkout@v4
53+
with:
54+
lfs: true
55+
- name: Run build
56+
env:
57+
NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
58+
run: |
59+
nix develop .#ci --command bash -c $'
60+
npm run build --verbose
61+
'
62+
- name: Upload Build
63+
uses: actions/upload-artifact@v4
64+
with:
65+
name: public
66+
path: ./public
67+
68+
# Deploy the public
69+
feature-deployment:
70+
name: "Feature / Deployment"
71+
runs-on: ubuntu-latest
72+
needs: feature-build
73+
container:
74+
image: ghcr.io/matrixai/github-runner
75+
concurrency:
76+
group: feature-deployment
77+
cancel-in-progress: false
78+
steps:
79+
- name: Checkout Actions
80+
uses: actions/checkout@v4
81+
with:
82+
repository: MatrixAI/.github
83+
ref: ${{ inputs.ref }}
84+
path: tmp/.github
85+
- name: Parse Secrets
86+
uses: ./tmp/.github/.github/actions/secrets-parse
87+
with:
88+
secrets: ${{ secrets.DEPLOY_SECRETS }}
89+
- uses: actions/checkout@v4
90+
with:
91+
lfs: true
92+
- uses: actions/download-artifact@v4
93+
with:
94+
name: public
95+
path: ./public
96+
- name: Run deployment
97+
env:
98+
NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
99+
run: |
100+
echo 'Perform service deployment for feature'
101+
nix develop .#ci --command bash -c $'
102+
npm run deploy -- \
103+
--feature "$GITHUB_REF_NAME" \
104+
--env "$GITHUB_REF_NAME"
105+
'

‎.github/workflows/application-js-cloudflare-master.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: "CI / Application JS Cloudflare Master"
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
type: string
8+
default: master
9+
description: >
10+
Reference used for this repository, so we can re-use it when
11+
referencing local actions, and avoid having to checkout this
12+
repository separately.
13+
secrets:
14+
NIXPKGS_PRIVATE_PAT:
15+
required: true
16+
DEPLOY_SECRETS:
17+
required: true
18+
19+
jobs:
20+
# Build the public - JS is platform-agnostic
21+
master-build:
22+
name: "Master / Build"
23+
runs-on: ubuntu-latest
24+
container:
25+
image: ghcr.io/matrixai/github-runner
26+
permissions:
27+
packages: read
28+
contents: read
29+
actions: write
30+
steps:
31+
- uses: actions/checkout@v4
32+
with:
33+
lfs: true
34+
- name: Run build
35+
env:
36+
NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
37+
run: |
38+
nix develop .#ci --command bash -c $'
39+
npm run build --verbose
40+
'
41+
- name: Upload Build
42+
uses: actions/upload-artifact@v4
43+
with:
44+
name: public
45+
path: ./public
46+
47+
# Deploy the public
48+
master-deployment:
49+
name: "Master / Deployment"
50+
runs-on: ubuntu-latest
51+
needs: master-build
52+
container:
53+
image: ghcr.io/matrixai/github-runner
54+
concurrency:
55+
group: master-deployment
56+
cancel-in-progress: false
57+
permissions:
58+
packages: read
59+
contents: read
60+
steps:
61+
- name: Checkout Actions
62+
uses: actions/checkout@v4
63+
with:
64+
repository: MatrixAI/.github
65+
ref: ${{ inputs.ref }}
66+
path: tmp/.github
67+
- name: Parse Secrets
68+
uses: ./tmp/.github/.github/actions/secrets-parse
69+
with:
70+
secrets: ${{ secrets.DEPLOY_SECRETS }}
71+
- uses: actions/checkout@v4
72+
with:
73+
lfs: true
74+
- uses: actions/download-artifact@v4
75+
with:
76+
name: public
77+
path: ./public
78+
- name: Run deployment
79+
env:
80+
NIX_CONFIG: access-tokens = github.com=${{ secrets.NIXPKGS_PRIVATE_PAT }}
81+
run: |
82+
echo 'Perform service deployment for master'
83+
nix develop .#ci --command bash -c $'
84+
npm run deploy -- --env master
85+
'

0 commit comments

Comments
 (0)