ci: add SILL deployment workflows and sync-upstream #115
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI - CD | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| security-scan: | |
| name: Security scan dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| - name: Download Shai-Hulud IOC list | |
| run: | | |
| curl -o iocs.csv https://raw.githubusercontent.com/DataDog/indicators-of-compromise/refs/heads/main/shai-hulud-2.0/consolidated_iocs.csv | |
| - name: Scan dependencies against IOCs | |
| run: node scripts/scan-dependencies.js | |
| validations: | |
| needs: security-scan | |
| runs-on: ubuntu-latest | |
| env: | |
| DATABASE_URL: postgresql://catalogi:pg_password@localhost:5432/db | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_USER: catalogi | |
| POSTGRES_PASSWORD: pg_password | |
| POSTGRES_DB: db | |
| ports: | |
| - 5432:5432 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| - name: Install dependencies | |
| run: corepack enable && pnpm install --frozen-lockfile | |
| - name: Build back | |
| run: cd api && pnpm build | |
| - name: Migrate db | |
| run: cd api && pnpm migrate latest | |
| - name: Fullcheck | |
| run: pnpm fullcheck | |
| e2e: | |
| name: E2E tests | |
| runs-on: ubuntu-latest | |
| needs: security-scan | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| - name: Install dependencies | |
| run: corepack enable && pnpm install --frozen-lockfile | |
| - name: Get Playwright version | |
| id: playwright-version | |
| run: echo "version=$(cd e2e && pnpm exec playwright --version | awk '{print $2}')" >> "$GITHUB_OUTPUT" | |
| - name: Restore Playwright browsers cache | |
| id: playwright-cache | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: playwright-v3-${{ runner.os }}-${{ steps.playwright-version.outputs.version }} | |
| - name: Install Playwright system dependencies | |
| timeout-minutes: 10 | |
| run: cd e2e && pnpm exec playwright install-deps chromium | |
| - name: Install Playwright browsers | |
| timeout-minutes: 10 | |
| run: cd e2e && pnpm exec playwright install chromium | |
| - name: Save Playwright browsers cache | |
| if: steps.playwright-cache.outputs.cache-hit != 'true' | |
| uses: actions/cache/save@v4 | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: playwright-v3-${{ runner.os }}-${{ steps.playwright-version.outputs.version }} | |
| - name: Run e2e tests | |
| run: cd e2e && pnpm test:e2e | |
| check_if_version_upgraded: | |
| name: Check if version upgrade | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| needs: [validations, e2e] | |
| outputs: | |
| is_upgraded_in_preprod: ${{ steps.check_version.outputs.is_upgraded_in_preprod }} | |
| is_upgraded_version: ${{ steps.check_version.outputs.is_upgraded_version }} | |
| to_version: ${{ steps.check_version.outputs.to_version }} | |
| from_version: ${{ steps.check_version.outputs.from_version }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Check version upgrade | |
| id: check_version | |
| run: | | |
| # Get current version from package.json | |
| CURRENT_VERSION=$(jq -r '.version' package.json) | |
| echo "Version in package.json: $CURRENT_VERSION" | |
| # Get deployed version from preprod API | |
| PRE_PROD_DEPLOYED_VERSION=$(curl -s "https://code.gouv.fr/sill-preprod/api/getApiVersion" | jq -r '.result.data.json') | |
| PROD_DEPLOYED_VERSION=$(curl -s "https://code.gouv.fr/sill/api/getApiVersion" | jq -r '.result.data.json') | |
| echo "Deployed version in preprod: $PRE_PROD_DEPLOYED_VERSION" | |
| echo "Deployed version in prod: $PROD_DEPLOYED_VERSION" | |
| # Simple comparison: check if versions are different | |
| if [ "$CURRENT_VERSION" != "$PRE_PROD_DEPLOYED_VERSION" ]; then | |
| IS_UPGRADED_IN_PRE_PROD="true" | |
| IS_UPGRADED="true" | |
| echo "✅ Version different from preprod ($PRE_PROD_DEPLOYED_VERSION), should deploy: $CURRENT_VERSION" | |
| elif [ "$CURRENT_VERSION" != "$PROD_DEPLOYED_VERSION" ]; then | |
| IS_UPGRADED="true" | |
| echo "✅ Version different from prod ($PROD_DEPLOYED_VERSION), should deploy: $CURRENT_VERSION" | |
| else | |
| IS_UPGRADED="false" | |
| echo "ℹ️ Version unchanged: $CURRENT_VERSION" | |
| fi | |
| echo "Is version upgraded: $IS_UPGRADED" | |
| # Set outputs | |
| echo "is_upgraded_version=$IS_UPGRADED" >> $GITHUB_OUTPUT | |
| echo "is_upgraded_in_preprod=$IS_UPGRADED_IN_PRE_PROD" >> $GITHUB_OUTPUT | |
| echo "to_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT | |
| echo "from_version=$PRE_PROD_DEPLOYED_VERSION" >> $GITHUB_OUTPUT | |
| trigger_pre_production_deploy: | |
| needs: | |
| - check_if_version_upgraded | |
| if: needs.check_if_version_upgraded.outputs.is_upgraded_in_preprod == 'true' | |
| uses: ./.github/workflows/trigger-deploy.yaml | |
| with: | |
| server_host: code.gouv.fr | |
| server_user: web | |
| deploy_script_path: ./update-sill-preprod.sh | |
| server_ssh_key_path: ~/.ssh/sill-data | |
| environment_name: pre-production | |
| version: v${{ needs.check_if_version_upgraded.outputs.to_version }} | |
| secrets: | |
| SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} | |
| trigger_production_deploy: | |
| needs: | |
| - trigger_pre_production_deploy | |
| - check_if_version_upgraded | |
| if: needs.check_if_version_upgraded.outputs.is_upgraded_version == 'true' && (needs.trigger_pre_production_deploy.result == 'success' || needs.trigger_pre_production_deploy.result == 'skipped') | |
| uses: ./.github/workflows/trigger-deploy.yaml | |
| with: | |
| server_host: code.gouv.fr | |
| server_user: web | |
| deploy_script_path: ./update-sill-docker-compose.sh | |
| server_ssh_key_path: ~/.ssh/sill-data | |
| environment_name: production | |
| version: v${{ needs.check_if_version_upgraded.outputs.to_version }} | |
| github_environment: production | |
| secrets: | |
| SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} | |