Skip to content

Commit e955a7d

Browse files
abbesBenayacheabbesBenayache
committed
refactor: replace reusable workflow with direct approach for environment secrets access
- Modified dapp-deploy.yml to use direct workflow approach - Modified dapp-release.yml to use direct workflow approach - Removed reusable-dapp-deploy.yml workflow - All workflows now have direct access to environment secrets
1 parent 67ce8bb commit e955a7d

File tree

3 files changed

+219
-207
lines changed

3 files changed

+219
-207
lines changed

‎.github/workflows/dapp-deploy.yml‎

Lines changed: 108 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -35,22 +35,116 @@ jobs:
3535
id: tag
3636
run: echo "clean_tag=dev-${GITHUB_SHA}" | tee -a $GITHUB_OUTPUT
3737

38-
deploy-dapp:
39-
needs: extract-tag
40-
uses: ./.github/workflows/reusable-dapp-deploy.yml
38+
docker-publish:
39+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
40+
needs: [extract-tag]
41+
with:
42+
image-name: 'iexechub/web3mail-dapp'
43+
registry: 'docker.io'
44+
dockerfile: 'dapp/Dockerfile'
45+
context: 'dapp'
46+
security-scan: true
47+
security-report: 'sarif'
48+
hadolint: true
49+
push: true
50+
image-tag: ${{ needs.extract-tag.outputs.clean_tag }}
51+
secrets:
52+
username: ${{ secrets.DOCKERHUB_USERNAME }}
53+
password: ${{ secrets.DOCKERHUB_PAT }}
54+
55+
sconify:
56+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
57+
needs: [docker-publish]
4158
with:
42-
environment: ${{ inputs.environment }}
43-
tag: ${{ needs.extract-tag.outputs.clean_tag }}
44-
price: ${{ inputs.price }}
45-
volume: ${{ inputs.volume }}
59+
image-name: 'iexechub/web3mail-dapp'
60+
image-tag: ${{ needs.extract-tag.outputs.clean_tag }}
61+
sconify-debug: false
62+
sconify-prod: true
63+
docker-registry: docker.io
64+
sconify-version: '5.9.0-v15'
65+
binary: /usr/local/bin/node
66+
command: node /app/src/app.js
67+
host-path: |
68+
/etc/hosts
69+
/etc/resolv.conf
70+
binary-fs: true
71+
fs-dir: /app
72+
heap: 1G
73+
dlopen: 1
74+
mprotect: 1
4675
secrets:
47-
dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
48-
dockerhub-password: ${{ secrets.DOCKERHUB_PAT }}
49-
sconify-signing-private-key: ${{ secrets.SCONIFY_SIGNING_PRIVATE_KEY }}
76+
docker-username: ${{ secrets.DOCKERHUB_USERNAME }}
77+
docker-password: ${{ secrets.DOCKERHUB_PAT }}
5078
scontain-username: ${{ secrets.SCONTAIN_REGISTRY_USERNAME }}
5179
scontain-password: ${{ secrets.SCONTAIN_REGISTRY_PAT }}
80+
scone-signing-key: ${{ secrets.SCONIFY_SIGNING_PRIVATE_KEY }}
81+
82+
deploy-dapp:
83+
runs-on: ubuntu-latest
84+
environment: ${{ inputs.environment }}
85+
needs: [sconify]
86+
steps:
87+
- name: Checkout code
88+
uses: actions/checkout@v4
89+
90+
- name: Setup Node.js
91+
uses: actions/setup-node@v4
92+
with:
93+
node-version: '18.19'
94+
cache: 'npm'
95+
96+
- name: Install dependencies
97+
run: |
98+
npm ci
99+
cd node_modules/whitelist-smart-contract
100+
npm install --save-dev ts-node
101+
cd ../../deployment-dapp
102+
npm ci
103+
104+
- name: Deploy dapp contract
105+
env:
106+
WALLET_PRIVATE_KEY: ${{ secrets.WEB3MAIL_DAPP_OWNER_PRIVATEKEY }}
107+
DOCKER_IMAGE_TAG: ${{ needs.sconify.outputs.prod-image-tag }}
108+
CHECKSUM: ${{ needs.sconify.outputs.prod-checksum }}
109+
FINGERPRINT: ${{ needs.sconify.outputs.prod-mrenclave }}
110+
RPC_URL: ${{ secrets.RPC_URL }}
111+
run: |
112+
cd deployment-dapp
113+
npm run deploy-dapp
114+
115+
- name: Push dapp secret
116+
env:
117+
WALLET_PRIVATE_KEY: ${{ secrets.WEB3MAIL_DAPP_OWNER_PRIVATEKEY }}
118+
MJ_APIKEY_PUBLIC: ${{ secrets.MAILJET_APIKEY_PUBLIC }}
119+
MJ_APIKEY_PRIVATE: ${{ secrets.MAILJET_APIKEY_PRIVATE }}
120+
MJ_SENDER: ${{ secrets.MAILJET_SENDER }}
121+
MAILGUN_APIKEY: ${{ secrets.MAILGUN_APIKEY }}
122+
WEB3MAIL_WHITELISTED_APPS: ${{ vars.WEB3MAIL_WHITELISTED_APPS }}
123+
run: |
124+
cd deployment-dapp
125+
npm run push-dapp-secret
126+
127+
- name: Publish free sell order
128+
env:
129+
WALLET_PRIVATE_KEY: ${{ secrets.WEB3MAIL_DAPP_OWNER_PRIVATEKEY }}
130+
PRICE: ${{ inputs.price || vars.SELL_ORDER_PRICE }}
131+
VOLUME: ${{ inputs.volume || vars.SELL_ORDER_VOLUME }}
132+
run: |
133+
cd deployment-dapp
134+
npm run publish-sell-order
135+
136+
- name: Add resource to whitelist
137+
env:
138+
CONTRACT_ADDRESS: ${{ secrets.WEB3MAIL_WHITELIST_CONTRACT_ADDRESS }}
139+
run: |
140+
cd node_modules/whitelist-smart-contract
141+
export ADDRESS_TO_ADD=$(cat ../../deployment-dapp/.app-address) && npm run addResourceToWhitelist
52142
53-
mailjet-apikey-public: ${{ secrets.MAILJET_APIKEY_PUBLIC }}
54-
mailjet-apikey-private: ${{ secrets.MAILJET_APIKEY_PRIVATE }}
55-
mailjet-sender: ${{ secrets.MAILJET_SENDER }}
56-
mailgun-apikey: ${{ secrets.MAILGUN_APIKEY }}
143+
- name: Configure ENS
144+
if: ${{ vars.DAPP_ENS_NAME }}
145+
env:
146+
WALLET_PRIVATE_KEY: ${{ secrets.WEB3MAIL_DAPP_OWNER_PRIVATEKEY }}
147+
DAPP_ENS_NAME: ${{ vars.DAPP_ENS_NAME }}
148+
run: |
149+
cd deployment-dapp
150+
npm run configure-ens

‎.github/workflows/dapp-release.yml‎

Lines changed: 111 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,24 +17,120 @@ jobs:
1717
TAG=${GITHUB_REF#refs/tags/dapp-v}
1818
echo "clean_tag=${TAG}" >> $GITHUB_OUTPUT
1919
20-
deploy-multi-env-prod:
21-
uses: ./.github/workflows/reusable-dapp-deploy.yml
22-
strategy:
23-
matrix:
24-
environment:
25-
[bellecour-prod, arbitrum-sepolia-prod, arbitrum-mainnet-prod]
20+
docker-publish:
21+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
2622
needs: [extract-tag]
2723
with:
28-
environment: ${{ matrix.environment }}
29-
tag: ${{ needs.extract-tag.outputs.clean_tag }}
24+
image-name: 'iexechub/web3mail-dapp'
25+
registry: 'docker.io'
26+
dockerfile: 'dapp/Dockerfile'
27+
context: 'dapp'
28+
security-scan: true
29+
security-report: 'sarif'
30+
hadolint: true
31+
push: true
32+
image-tag: ${{ needs.extract-tag.outputs.clean_tag }}
33+
secrets:
34+
username: ${{ secrets.DOCKERHUB_USERNAME }}
35+
password: ${{ secrets.DOCKERHUB_PAT }}
36+
37+
sconify:
38+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/[email protected]
39+
needs: [docker-publish]
40+
with:
41+
image-name: 'iexechub/web3mail-dapp'
42+
image-tag: ${{ needs.extract-tag.outputs.clean_tag }}
43+
sconify-debug: false
44+
sconify-prod: true
45+
docker-registry: docker.io
46+
sconify-version: '5.9.0-v15'
47+
binary: /usr/local/bin/node
48+
command: node /app/src/app.js
49+
host-path: |
50+
/etc/hosts
51+
/etc/resolv.conf
52+
binary-fs: true
53+
fs-dir: /app
54+
heap: 1G
55+
dlopen: 1
56+
mprotect: 1
3057
secrets:
31-
dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
32-
dockerhub-password: ${{ secrets.DOCKERHUB_PAT }}
33-
sconify-signing-private-key: ${{ secrets.SCONIFY_SIGNING_PRIVATE_KEY }}
58+
docker-username: ${{ secrets.DOCKERHUB_USERNAME }}
59+
docker-password: ${{ secrets.DOCKERHUB_PAT }}
3460
scontain-username: ${{ secrets.SCONTAIN_REGISTRY_USERNAME }}
3561
scontain-password: ${{ secrets.SCONTAIN_REGISTRY_PAT }}
62+
scone-signing-key: ${{ secrets.SCONIFY_SIGNING_PRIVATE_KEY }}
63+
64+
deploy-multi-env-prod:
65+
runs-on: ubuntu-latest
66+
environment: ${{ matrix.environment }}
67+
needs: [sconify]
68+
strategy:
69+
matrix:
70+
environment:
71+
[bellecour-prod, arbitrum-sepolia-prod, arbitrum-mainnet-prod]
72+
steps:
73+
- name: Checkout code
74+
uses: actions/checkout@v4
75+
76+
- name: Setup Node.js
77+
uses: actions/setup-node@v4
78+
with:
79+
node-version: '18.19'
80+
cache: 'npm'
81+
82+
- name: Install dependencies
83+
run: |
84+
npm ci
85+
cd node_modules/whitelist-smart-contract
86+
npm install --save-dev ts-node
87+
cd ../../deployment-dapp
88+
npm ci
89+
90+
- name: Deploy dapp contract
91+
env:
92+
WALLET_PRIVATE_KEY: ${{ secrets.WEB3MAIL_DAPP_OWNER_PRIVATEKEY }}
93+
DOCKER_IMAGE_TAG: ${{ needs.sconify.outputs.prod-image-tag }}
94+
CHECKSUM: ${{ needs.sconify.outputs.prod-checksum }}
95+
FINGERPRINT: ${{ needs.sconify.outputs.prod-mrenclave }}
96+
RPC_URL: ${{ secrets.RPC_URL }}
97+
run: |
98+
cd deployment-dapp
99+
npm run deploy-dapp
36100
37-
mailjet-apikey-public: ${{ secrets.MAILJET_APIKEY_PUBLIC }}
38-
mailjet-apikey-private: ${{ secrets.MAILJET_APIKEY_PRIVATE }}
39-
mailjet-sender: ${{ secrets.MAILJET_SENDER }}
40-
mailgun-apikey: ${{ secrets.MAILGUN_APIKEY }}
101+
- name: Push dapp secret
102+
env:
103+
WALLET_PRIVATE_KEY: ${{ secrets.WEB3MAIL_DAPP_OWNER_PRIVATEKEY }}
104+
MJ_APIKEY_PUBLIC: ${{ secrets.MAILJET_APIKEY_PUBLIC }}
105+
MJ_APIKEY_PRIVATE: ${{ secrets.MAILJET_APIKEY_PRIVATE }}
106+
MJ_SENDER: ${{ secrets.MAILJET_SENDER }}
107+
MAILGUN_APIKEY: ${{ secrets.MAILGUN_APIKEY }}
108+
WEB3MAIL_WHITELISTED_APPS: ${{ vars.WEB3MAIL_WHITELISTED_APPS }}
109+
run: |
110+
cd deployment-dapp
111+
npm run push-dapp-secret
112+
113+
- name: Publish free sell order
114+
env:
115+
WALLET_PRIVATE_KEY: ${{ secrets.WEB3MAIL_DAPP_OWNER_PRIVATEKEY }}
116+
PRICE: ${{ vars.SELL_ORDER_PRICE }}
117+
VOLUME: ${{ vars.SELL_ORDER_VOLUME }}
118+
run: |
119+
cd deployment-dapp
120+
npm run publish-sell-order
121+
122+
- name: Add resource to whitelist
123+
env:
124+
CONTRACT_ADDRESS: ${{ secrets.WEB3MAIL_WHITELIST_CONTRACT_ADDRESS }}
125+
run: |
126+
cd node_modules/whitelist-smart-contract
127+
export ADDRESS_TO_ADD=$(cat ../../deployment-dapp/.app-address) && npm run addResourceToWhitelist
128+
129+
- name: Configure ENS
130+
if: ${{ vars.DAPP_ENS_NAME }}
131+
env:
132+
WALLET_PRIVATE_KEY: ${{ secrets.WEB3MAIL_DAPP_OWNER_PRIVATEKEY }}
133+
DAPP_ENS_NAME: ${{ vars.DAPP_ENS_NAME }}
134+
run: |
135+
cd deployment-dapp
136+
npm run configure-ens

0 commit comments

Comments
 (0)