Skip to content

Commit efbabb0

Browse files
cditchercditcher
committed
Added deploy.to.openshift.dev.and.test.yml
1 parent c64d311 commit efbabb0

File tree

1 file changed

+255
-0
lines changed

1 file changed

+255
-0
lines changed

‎.github/workflows/deploy.to.openshift.dev.and.test.yml‎

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
name: Build & Deploy to DEV and TEST
2+
env:
3+
4+
OPENSHIFT_SERVER: ${{ vars.OPENSHIFT_SERVER }}
5+
OPENSHIFT_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
6+
COMMON_NAMESPACE: ${{ vars.COMMON_NAMESPACE }}
7+
GRAD_NAMESPACE: ${{ vars.GRAD_NAMESPACE }}
8+
BUSINESS_NAMESPACE: ${{ vars.GRAD_BUSINESS_NAMESPACE }}
9+
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
10+
IMAGE_REGISTRY_USER: ${{ github.actor }}
11+
IMAGE_REGISTRY_PASSWORD: ${{ github.token }}
12+
SPRING_BOOT_IMAGE_NAME: educ-grad-data-conversion-api
13+
REPO_NAME: "educ-grad-data-conversion-api"
14+
APP_DOMAIN: ${{ vars.APP_DOMAIN }}
15+
TAG: "latest"
16+
17+
on:
18+
# https://docs.github.com/en/actions/reference/events-that-trigger-workflows
19+
# Runs on workflow dispatch. Running from another branch manually will use the branch
20+
# reference for everything in the script. Update configmaps, etc. all run from that reference branch.
21+
workflow_dispatch:
22+
push:
23+
branches:
24+
- main
25+
paths:
26+
- 'api/**'
27+
- 'tools/**'
28+
29+
jobs:
30+
build-and-deploy-dev:
31+
name: Build and deploy to OpenShift DEV
32+
runs-on: ubuntu-22.04
33+
environment: dev
34+
env:
35+
OPENSHIFT_NAMESPACE: ${{ vars.GRAD_NAMESPACE }}-dev
36+
TARGET_ENV: dev
37+
KEYCLOAK_URL: ${{ secrets.KEYCLOAK_URL }}
38+
KEYCLOAK_REALM: ${{ secrets.KEYCLOAK_REALM }}
39+
MIN_CPU: "50m"
40+
MAX_CPU: "500m"
41+
MIN_MEM: "1Gi"
42+
MAX_MEM: "2Gi"
43+
MIN_REPLICAS: "2"
44+
MAX_REPLICAS: "3"
45+
46+
steps:
47+
- name: Check out repository
48+
uses: actions/checkout@v4
49+
with:
50+
ref: ${{ github.ref }}
51+
52+
- name: Determine image tags
53+
if: env.TAG == ''
54+
run: |
55+
echo "TAG=latest ${GITHUB_SHA::12}" | tee -a $GITHUB_ENV
56+
57+
- name: Login to Docker Hub
58+
uses: docker/login-action@v3
59+
with:
60+
registry: ${{ vars.DOCKER_ARTIFACTORY_REPO }}
61+
username: ${{ vars.DOCKER_ARTIFACTORY_USERNAME }}
62+
password: ${{ secrets.DOCKER_ARTIFACTORY_ACCESS_TOKEN }}
63+
64+
# https://github.com/redhat-actions/buildah-build#readme
65+
- name: Build from Dockerfile
66+
id: build-image
67+
uses: redhat-actions/buildah-build@v2
68+
with:
69+
image: ${{ env.REPO_NAME }}
70+
tags: ${{ env.TAG }}
71+
dockerfiles: |
72+
./Dockerfile
73+
74+
# https://github.com/redhat-actions/push-to-registry#readme
75+
- name: Push to registry
76+
id: push-image
77+
uses: redhat-actions/push-to-registry@v2
78+
with:
79+
image: ${{ steps.build-image.outputs.image }}
80+
tags: ${{ steps.build-image.outputs.tags }}
81+
registry: ${{ env.IMAGE_REGISTRY }}
82+
username: ${{ env.IMAGE_REGISTRY_USER }}
83+
password: ${{ env.IMAGE_REGISTRY_PASSWORD }}
84+
85+
# - name: Setup Node.js
86+
# uses: actions/setup-node@v3
87+
# with:
88+
# node-version: '20'
89+
90+
# - name: Install dependencies
91+
# run: npm install axios
92+
93+
# - name: Create/Update clients
94+
# run: node ./tools/config/clients-and-scopes.js
95+
96+
# - name: Create/Update secrets
97+
# run: node ./tools/openshift/fetch-and-create-secrets.js
98+
99+
# The path the image was pushed to is now stored in ${{ steps.push-image.outputs.registry-path }}
100+
- name: Install oc
101+
uses: redhat-actions/openshift-tools-installer@v1
102+
with:
103+
oc: 4
104+
105+
# https://github.com/redhat-actions/oc-login#readme
106+
- name: Deploy
107+
run: |
108+
set -eux
109+
# Login to OpenShift and select project
110+
oc login --token=${{ env.OPENSHIFT_TOKEN }} --server=${{ env.OPENSHIFT_SERVER }}
111+
oc project ${{ env.OPENSHIFT_NAMESPACE }}
112+
# Cancel any rollouts in progress
113+
oc rollout cancel deployment/${{ env.SPRING_BOOT_IMAGE_NAME }} 2> /dev/null \
114+
|| true && echo "No rollout in progress"
115+
# tag image stream
116+
oc -n ${{ env.OPENSHIFT_NAMESPACE }} tag ${{ steps.push-image.outputs.registry-path }} ${{ env.REPO_NAME }}:${{ env.TAG }}
117+
118+
# Process and apply deployment template
119+
oc process -f tools/openshift/api.dc.yaml \
120+
-p IS_NAMESPACE=${{ env.OPENSHIFT_NAMESPACE }} \
121+
-p REPO_NAME=${{ env.REPO_NAME }} \
122+
-p TAG_NAME=${{ env.TAG }} \
123+
-p HOST_ROUTE=${{ env.REPO_NAME }}-${{ env.OPENSHIFT_NAMESPACE }}.${{ env.APP_DOMAIN }} \
124+
-p MIN_REPLICAS=${{ env.MIN_REPLICAS }} \
125+
-p MAX_REPLICAS=${{ env.MAX_REPLICAS }} \
126+
-p MIN_CPU=${{ env.MIN_CPU }} \
127+
-p MAX_CPU=${{ env.MAX_CPU }} \
128+
-p MIN_MEM=${{ env.MIN_MEM }} \
129+
-p MAX_MEM=${{ env.MAX_MEM }} | oc apply -f -
130+
131+
# UPDATE Configmaps
132+
curl -s https://raw.githubusercontent.com/bcgov/${{ env.REPO_NAME }}/${{ github.ref }}/tools/config/update-configmap.sh \
133+
| bash /dev/stdin \
134+
dev \
135+
${{ env.REPO_NAME }} \
136+
${{ env.GRAD_NAMESPACE }} \
137+
${{ env.COMMON_NAMESPACE }} \
138+
${{ env.BUSINESS_NAMESPACE }} \
139+
${{ secrets.SPLUNK_TOKEN }} \
140+
${{ vars.APP_LOG_LEVEL }}
141+
142+
# OVERRIDE Configmaps
143+
curl -s https://raw.githubusercontent.com/bcgov/${{ env.REPO_NAME }}/${{ github.ref }}/tools/config/override-configmap-dev.sh \
144+
| bash /dev/stdin \
145+
dev \
146+
${{ env.REPO_NAME }} \
147+
${{ env.GRAD_NAMESPACE }} \
148+
${{ env.COMMON_NAMESPACE }} \
149+
${{ env.BUSINESS_NAMESPACE }} \
150+
${{ secrets.SPLUNK_TOKEN }} \
151+
${{ vars.APP_LOG_LEVEL }}
152+
153+
# Start rollout (if necessary) and follow it
154+
oc rollout restart deployment/${{ env.SPRING_BOOT_IMAGE_NAME }}
155+
156+
# Get status, returns 0 if rollout is successful
157+
oc rollout status deployment/${{ env.SPRING_BOOT_IMAGE_NAME }}
158+
159+
deploy-test:
160+
name: Build and deploy to OpenShift TEST
161+
needs: build-and-deploy-dev
162+
runs-on: ubuntu-22.04
163+
environment: test
164+
env:
165+
OPENSHIFT_NAMESPACE: ${{ vars.GRAD_NAMESPACE }}-test
166+
TARGET_ENV: test
167+
KEYCLOAK_URL: ${{ secrets.KEYCLOAK_URL }}
168+
KEYCLOAK_REALM: ${{ secrets.KEYCLOAK_REALM }}
169+
MIN_CPU: "50m"
170+
MAX_CPU: "500m"
171+
MIN_MEM: "1Gi"
172+
MAX_MEM: "2Gi"
173+
MIN_REPLICAS: "3"
174+
MAX_REPLICAS: "4"
175+
176+
steps:
177+
- name: Check out repository
178+
uses: actions/checkout@v4
179+
with:
180+
ref: ${{ github.ref }}
181+
182+
- name: Setup Node.js
183+
uses: actions/setup-node@v3
184+
with:
185+
node-version: '20'
186+
187+
- name: Install dependencies
188+
run: npm install axios
189+
190+
- name: Create/Update clients
191+
run: node ./tools/config/clients-and-scopes.js
192+
193+
- name: Create/Update secrets
194+
run: node ./tools/openshift/fetch-and-create-secrets.js
195+
196+
- name: Install oc
197+
uses: redhat-actions/openshift-tools-installer@v1
198+
with:
199+
oc: 4
200+
201+
# https://github.com/redhat-actions/oc-login#readme
202+
- name: Deploy
203+
run: |
204+
set -eux
205+
# Login to OpenShift and select project
206+
oc login --token=${{ env.OPENSHIFT_TOKEN }} --server=${{ env.OPENSHIFT_SERVER }}
207+
oc project ${{ env.OPENSHIFT_NAMESPACE }}
208+
# Cancel any rollouts in progress
209+
oc rollout cancel deployment/${{ env.SPRING_BOOT_IMAGE_NAME }} 2> /dev/null \
210+
|| true && echo "No rollout in progress"
211+
212+
oc tag ${{ env.OPENSHIFT_NAMESPACE }}/${{ env.REPO_NAME }}:${{ env.TAG }} \
213+
${{ env.OPENSHIFT_NAMESPACE }}/${{ env.REPO_NAME }}:${{ env.TAG }}
214+
215+
# Process and apply deployment template
216+
oc process -f tools/openshift/api.dc.yaml \
217+
-p IS_NAMESPACE=${{ env.OPENSHIFT_NAMESPACE }} \
218+
-p REPO_NAME=${{ env.REPO_NAME }} \
219+
-p TAG_NAME=${{ env.TAG }} \
220+
-p HOST_ROUTE=${{ env.REPO_NAME }}-${{ env.OPENSHIFT_NAMESPACE }}.${{ env.APP_DOMAIN }} \
221+
-p MIN_REPLICAS=${{ env.MIN_REPLICAS }} \
222+
-p MAX_REPLICAS=${{ env.MAX_REPLICAS }} \
223+
-p MIN_CPU=${{ env.MIN_CPU }} \
224+
-p MAX_CPU=${{ env.MAX_CPU }} \
225+
-p MIN_MEM=${{ env.MIN_MEM }} \
226+
-p MAX_MEM=${{ env.MAX_MEM }} | oc apply -f -
227+
228+
# UPDATE Configmaps
229+
curl -s https://raw.githubusercontent.com/bcgov/${{ env.REPO_NAME }}/${{ github.ref }}/tools/config/update-configmap.sh \
230+
| bash /dev/stdin \
231+
test \
232+
${{ env.REPO_NAME }} \
233+
${{ env.GRAD_NAMESPACE }} \
234+
${{ env.COMMON_NAMESPACE }} \
235+
${{ env.BUSINESS_NAMESPACE }} \
236+
${{ secrets.SPLUNK_TOKEN }} \
237+
${{ vars.APP_LOG_LEVEL }}
238+
239+
# Start rollout (if necessary) and follow it
240+
oc rollout restart deployment/${{ env.SPRING_BOOT_IMAGE_NAME }}
241+
242+
# Get status, returns 0 if rollout is successful
243+
oc rollout status deployment/${{ env.SPRING_BOOT_IMAGE_NAME }}
244+
245+
zap-scan:
246+
name: Zap Scan
247+
needs: build-and-deploy-dev
248+
runs-on: ubuntu-22.04
249+
env:
250+
OPENSHIFT_NAMESPACE: ${{ vars.GRAD_NAMESPACE }}-dev
251+
steps:
252+
- name: ZAP Scan
253+
uses: zaproxy/action-api-scan@v0.9.0
254+
with:
255+
target: 'https://${{ env.REPO_NAME }}-${{ env.OPENSHIFT_NAMESPACE }}.apps.silver.devops.gov.bc.ca/api/v1/api-docs'

0 commit comments

Comments
 (0)