Skip to content

Commit fad1eed

Browse files
galarghgalargh
authored
chore(ci): deploy workflows for staging/production (#499)
* ci: delete the auto deploy workflow * ci: create a deploy workflow which force pushes to staging/production * ci: split deploy workflow in two and apply fixes
1 parent d21178c commit fad1eed

File tree

3 files changed

+124
-57
lines changed

3 files changed

+124
-57
lines changed

‎.github/workflows/deploy-to-production.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Deploy to Production
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag:
7+
description: 'Tag to deploy'
8+
required: true
9+
type: string
10+
11+
permissions: {}
12+
13+
jobs:
14+
deploy:
15+
uses: ./.github/workflows/deploy.yml
16+
with:
17+
tag: ${{ inputs.tag }}
18+
environment: production
19+
lock: true
20+
secrets:
21+
DEPLOYMENT_GITHUB_TOKEN: ${{ secrets.DEPLOYMENT_GITHUB_TOKEN }}

‎.github/workflows/deploy-to-staging.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Deploy to Staging
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag:
7+
description: 'Tag to deploy'
8+
required: true
9+
type: string
10+
11+
permissions: {}
12+
13+
jobs:
14+
deploy:
15+
uses: ./.github/workflows/deploy.yml
16+
with:
17+
tag: ${{ inputs.tag }}
18+
environment: staging
19+
lock: true
20+
secrets:
21+
DEPLOYMENT_GITHUB_TOKEN: ${{ secrets.DEPLOYMENT_GITHUB_TOKEN }}
22+

‎.github/workflows/deploy.yml‎

Lines changed: 81 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,92 @@
1-
name: Auto release PR
1+
name: Deploy
22

33
on:
4-
push:
5-
tags:
6-
- '*'
7-
branches:
8-
- staging
9-
workflow_dispatch:
4+
workflow_call:
5+
inputs:
6+
tag:
7+
description: 'Tag to deploy'
8+
required: true
9+
type: string
10+
environment:
11+
description: 'Environment to deploy to'
12+
required: true
13+
type: string
14+
lock:
15+
description: 'Lock environment branch after deployment'
16+
required: false
17+
type: boolean
18+
default: false
19+
secrets:
20+
DEPLOYMENT_GITHUB_TOKEN:
21+
description: |
22+
A GitHub token with the following permissions:
23+
administration: write (optional; to be able to lock the environment branch)
24+
contents: write (required; to be able to push to the environment branch)
25+
workflows: write (required; to be able to modify .github/workflows)
26+
required: true
1027

11-
permissions:
12-
contents: write # to create release
13-
pull-requests: write # to create release PR
28+
permissions: {}
1429

1530
jobs:
16-
# from https://github.com/peter-evans/create-pull-request/blob/main/docs/examples.md#keep-a-branch-up-to-date-with-another
17-
deploy-staging:
18-
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'))
31+
deploy:
32+
name: Deploy
1933
runs-on: ubuntu-latest
34+
environment: ${{ inputs.environment }}
2035
steps:
21-
- uses: actions/checkout@v4
36+
- name: Checkout
37+
uses: actions/checkout@v4
2238
with:
23-
token: ${{ secrets.SGTPOOKI_PAT }}
24-
ref: staging
25-
- name: Fetch all tags
26-
run: git fetch --tags
27-
- name: Get latest tag
28-
id: get_latest_tag
29-
run: echo "tag=$(git describe --tags `git rev-list --tags --max-count=1`)" >> $GITHUB_OUTPUT
30-
- name: Ensure staging-release branch points to latest tag
39+
fetch-depth: 0
40+
token: ${{ secrets.DEPLOYMENT_GITHUB_TOKEN }}
41+
- name: Set up git config
3142
run: |
32-
git reset --hard ${{ steps.get_latest_tag.outputs.tag }}
33-
- name: Create Pull Request
34-
uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
35-
with:
36-
token: ${{ secrets.SGTPOOKI_PAT }}
37-
base: staging
38-
branch: staging-release
39-
title: 'chore: point staging to release ${{ steps.get_latest_tag.outputs.tag }}'
40-
body: 'This PR points the staging branch to release ${{ steps.get_latest_tag.outputs.tag }}. **Choose "Rebase and merge" for this PR only!**'
41-
42-
# from https://github.com/peter-evans/create-pull-request/blob/main/docs/examples.md#keep-a-branch-up-to-date-with-another
43-
deploy-production:
44-
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/staging')
45-
runs-on: ubuntu-latest
46-
steps:
47-
- uses: actions/checkout@v4
48-
with:
49-
token: ${{ secrets.SGTPOOKI_PAT }}
50-
ref: production
51-
fetch-depth: 0 # Fetch all branches and commit history
52-
- name: Get latest tag deployed to staging
53-
id: get_latest_tag
43+
git config --global user.name "github-actions[bot]"
44+
git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
45+
- name: Verify tag
46+
env:
47+
TAG: ${{ inputs.tag }}
5448
run: |
55-
latest_tag=$(git --no-pager log origin/staging --all --grep="chore: point staging to release v" --pretty=format:"%H %s" | head -n1 | sed -n 's/.*release \(v[0-9]*\.[0-9]*\.[0-9]*\).*/\1/p')
56-
echo "tag=$latest_tag" >> $GITHUB_OUTPUT
57-
- name: Set production branch to latest tag deployed to staging
49+
git merge-base --is-ancestor $TAG origin/main
50+
if [ $? -ne 0 ]; then
51+
echo "Tag $TAG is not present in the history of main"
52+
exit 1
53+
fi
54+
- name: Checkout environment branch
55+
env:
56+
ENVIRONMENT: ${{ inputs.environment }}
57+
run: git checkout $ENVIRONMENT
58+
- name: Reset environment branch to tag
59+
env:
60+
TAG: ${{ inputs.tag }}
61+
run: git reset --hard $TAG
62+
# TODO: Use repository rule sets instead of branch protection rules
63+
- name: Unlock environment branch
64+
if: inputs.lock == true
65+
env:
66+
ENVIRONMENT: ${{ inputs.environment }}
67+
GITHUB_TOKEN: ${{ secrets.DEPLOYMENT_GITHUB_TOKEN }}
5868
run: |
59-
git reset --hard ${{ steps.get_latest_tag.outputs.tag }}
60-
- name: Create Pull Request
61-
uses: peter-evans/[email protected]
62-
with:
63-
token: ${{ secrets.SGTPOOKI_PAT }}
64-
base: production
65-
branch: production-release
66-
title: 'chore: Point production to ${{ steps.get_latest_tag.outputs.tag }}'
67-
body: 'This PR points the production branch to release ${{ steps.get_latest_tag.outputs.tag }}, which is the latest tag deployed to staging. **Choose "Rebase and merge" for this PR only!**'
68-
69+
gh api --method PUT /repos/$GITHUB_REPOSITORY/branches/$ENVIRONMENT/protection \
70+
-F required_status_checks=null \
71+
-F enforce_admins=true \
72+
-F required_pull_request_reviews=null \
73+
-F restrictions=null \
74+
-F allow_force_pushes=true \
75+
-F lock_branch=false
76+
- name: Force push environment branch
77+
env:
78+
ENVIRONMENT: ${{ inputs.environment }}
79+
run: git push -f origin $ENVIRONMENT
80+
- name: Lock environment branch
81+
if: inputs.lock == true
82+
env:
83+
ENVIRONMENT: ${{ inputs.environment }}
84+
GITHUB_TOKEN: ${{ secrets.DEPLOYMENT_GITHUB_TOKEN }}
85+
run: |
86+
gh api --method PUT /repos/$GITHUB_REPOSITORY/branches/$ENVIRONMENT/protection \
87+
-F required_status_checks=null \
88+
-F enforce_admins=true \
89+
-F required_pull_request_reviews=null \
90+
-F restrictions=null \
91+
-F allow_force_pushes=false \
92+
-F lock_branch=true

0 commit comments

Comments
 (0)