diff --git a/.github/workflows/cd-workflow.yaml b/.github/workflows/cd-workflow.yaml index 7f4e3bf..4359762 100644 --- a/.github/workflows/cd-workflow.yaml +++ b/.github/workflows/cd-workflow.yaml @@ -1,11 +1,12 @@ - name: Deploy backstage + on: - workflow_run: - workflows: - - CI Workflow - types: - - completed + push: + branches: + - main + pull_request: + branches: + - main jobs: create-and-push-image: @@ -21,27 +22,32 @@ jobs: steps: - name: Checkout uses: actions/checkout@v4 + - id: 'setup-qemu' name: Set up QEMU uses: docker/setup-qemu-action@v3 + - id: 'docker-buildx-setup' name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + - name: 'Authenticate to Google Cloud' id: 'auth' uses: 'google-github-actions/auth@v2' with: create_credentials_file: true token_format: "access_token" - workload_identity_provider: 'projects/1006240973223/locations/global/workloadIdentityPools/deploy-backstage/providers/github-actions' - service_account: 'deploy-backstage@code-idp.iam.gserviceaccount.com' + workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} + service_account: ${{ secrets.GCP_DEPLOY_SA }} + - name: "Login to GAR" id: 'login-gar' uses: docker/login-action@v3 with: - registry: europe-west10-docker.pkg.dev/code-idp/backstage-deploy + registry: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_GAR_REPO }} username: oauth2accesstoken password: ${{ steps.auth.outputs.access_token }} + - id: 'build-and-push' name: 'Build and Push docker Image' uses: docker/build-push-action@v5 @@ -50,46 +56,48 @@ jobs: context: . file: ./Dockerfile platforms: linux/amd64 - tags: europe-west10-docker.pkg.dev/code-idp/backstage-deploy/backstage-image:${{ github.sha }} + tags: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_GAR_REPO }}/backstage-image:${{ github.sha }} build-args: | APP_ENV=docker + + deploy-image: permissions: id-token: write contents: read + name: "Deploy image on cloud run" runs-on: ubuntu-latest defaults: run: shell: bash needs: create-and-push-image + steps: - name: Checkout uses: actions/checkout@v4 + - id: 'auth' name: 'Authenticate to Google Cloud' uses: 'google-github-actions/auth@v2' with: create_credentials_file: true - workload_identity_provider: 'projects/1006240973223/locations/global/workloadIdentityPools/deploy-backstage/providers/github-actions' - service_account: 'deploy-backstage@code-idp.iam.gserviceaccount.com' - - id: 'deploy' + workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }} + service_account: ${{ secrets.GCP_DEPLOY_SA }} + + - name: Deploy to Cloud Run + id: 'deploy' uses: 'google-github-actions/deploy-cloudrun@v2' with: - service: 'backstage-deployment' - image: 'europe-west10-docker.pkg.dev/code-idp/backstage-deploy/backstage-image:${{ github.sha }}' - region: europe-west1 - flags: '--port=7007 --add-cloudsql-instances=code-idp:europe-west10:backstage-pg' - env_vars: | - POSTGRES_HOST=/cloudsql/code-idp:europe-west10:backstage-pg - POSTGRES_PORT=5432 - POSTGRES_USER=postgres - BASE_URL=https://backstage.foundations-software-engineering.com + service: ${{ secrets.GCP_CLOUD_RUN_SERVICE }} + image: ${{ secrets.GCP_REGION }}-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/${{ secrets.GCP_GAR_REPO }}/backstage-image:${{ github.sha }} + region: ${{ secrets.GCP_REGION }} + flags: '--platform managed --allow-unauthenticated --port=7007' secrets: |- - POSTGRES_PASSWORD=postgres-password:latest GITHUB_TOKEN=github_token:latest + GITLAB_TOKEN=gitlab_token:latest GOOGLE_CLIENT_ID=google_client_id:latest GOOGLE_CLIENT_SECRET=google_client_secret:latest - GITHUB_CLIENT_SECRET=github_client_secret:latest - GITHUB_CLIENT_ID=github_client_id:latest + PROD_GITHUB_CLIENT_SECRET=github_client_secret:latest + PROD_GITHUB_CLIENT_ID=github_client_id:latest diff --git a/.github/workflows/delete-old-branches.yml b/.github/workflows/delete-old-branches.yml deleted file mode 100644 index 96a3298..0000000 --- a/.github/workflows/delete-old-branches.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: Delete old merged and unmerged branches - -on: - schedule: - - cron: '0 0 * * *' #Run every day at midnight - workflow_dispatch: - -jobs: - delete-old-branches: - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Delete old branches (Except main) - run: | - git fetch --prune - - # Get the list of merged branches (remote) - MERGED_BRANCHES=$(git branch -r --merged origin/main | grep -v "main" | grep -v "HEAD") - - # Delete merged branches older than 30 days, except main - for branch in $(git branch -r --merged | grep -v "main" | grep -v "HEAD"); do - BRANCH_NAME=$(echo $branch | sed 's/origin\///') - LAST_COMMIT_DATE=$(git log -1 --format=%ci $BRANCH_NAME) - DAYS_OLD=$(echo $(( ( $(date +%s) - $(date -d "$LAST_COMMIT_DATE" +%s) ) / 86400 ))) - - if [[ $DAYS_OLD -gt 30 ]]; then - echo "Deleting merged branch: $BRANCH_NAME" - git push origin --delete $BRANCH_NAME - fi - done - - # Delete unmerged branches older than 90 days, except main - for branch in $(git branch -r --no-merged | grep -v "main" | grep -v "HEAD"); do - BRANCH_NAME=$(echo $branch | sed 's/origin\///') - LAST_COMMIT_DATE=$(git log -1 --format=%ci $BRANCH_NAME) - DAYS_OLD=$(echo $(( ( $(date +%s) - $(date -d "$LAST_COMMIT_DATE" +%s) ) / 86400 ))) - - if [[ $DAYS_OLD -gt 90 ]]; then - echo "Deleting stale unmerged branch: $BRANCH_NAME" - git push origin --delete $BRANCH_NAME - fi - done - env: - GITHUB_TOKEN: ${{ secrets.CODE_IDP_TOKEN }} diff --git a/app-config.production.yaml b/app-config.production.yaml index 8b515dc..e4e8953 100644 --- a/app-config.production.yaml +++ b/app-config.production.yaml @@ -1,9 +1,17 @@ app: - baseUrl: prodlink + baseUrl: https://backstage.code-idp.com backend: - baseUrl: prodlink + baseUrl: https://backstage.code-idp.com cors: - origin: prodlink + origin: https://backstage.code-idp.com methods: [GET, HEAD, PATCH, POST, PUT, DELETE] - credentials: true \ No newline at end of file + credentials: true + +auth: + environment: production + providers: + github: + production: + clientId: ${PROD_GITHUB_CLIENT_ID} + clientSecret: ${PROD_GITHUB_CLIENT_SECRET}