Photon — Scheduled Import #62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Photon — Scheduled Import | |
| on: | |
| schedule: | |
| # Run full build every day (6:27 UTC is 7:27 CET or 8:27 CEST) | |
| # Uses the `prod-approved` tag to avoid picking up untested commits from main. | |
| - cron: '27 6 * * *' | |
| concurrency: | |
| group: "${{ github.workflow }}" | |
| cancel-in-progress: true | |
| env: | |
| LATEST_TAG: latest-prod | |
| # All checkouts and the generate-tag reusable workflow use the `prod-approved` tag | |
| # (moved by proxy CI after a successful prod deploy) so the scheduled rebuild runs | |
| # against the same code that's currently in prod, not whatever happens to be on main. | |
| # Hardcoded in three places below because reusable-workflow `with:` blocks can't read | |
| # the workflow-level `env` context. | |
| jobs: | |
| generate-tag: | |
| name: Generate Tag | |
| uses: ./.github/workflows/_generate-tag.yml | |
| with: | |
| ref: prod-approved | |
| nominatim-data: | |
| name: Nominatim Data | |
| needs: generate-tag | |
| runs-on: | |
| group: grp-ubuntu-24.04-8core-x64 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| outputs: | |
| image_tag: ${{ steps.build.outputs.image_tag }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: prod-approved | |
| - name: Build nominatim data | |
| id: build | |
| uses: ./.github/actions/build-nominatim-data | |
| with: | |
| build_tag: ${{ needs.generate-tag.outputs.tag }} | |
| workload_identity_provider: ${{ vars.CI_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ vars.CI_SERVICE_ACCOUNT }} | |
| latest_tag: ${{ env.LATEST_TAG }} | |
| photon: | |
| name: Photon Image | |
| needs: [generate-tag, nominatim-data] | |
| runs-on: | |
| group: grp-ubuntu-24.04-8core-x64 | |
| permissions: | |
| actions: read | |
| contents: read | |
| id-token: write | |
| security-events: write | |
| pull-requests: write | |
| outputs: | |
| image_tag: ${{ steps.build.outputs.image_tag }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: prod-approved | |
| - name: Build Photon image | |
| id: build | |
| uses: ./.github/actions/build-photon-image | |
| with: | |
| nominatim_data_tag: ${{ needs.nominatim-data.outputs.image_tag }} | |
| build_tag: ${{ needs.generate-tag.outputs.tag }} | |
| workload_identity_provider: ${{ vars.CI_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ vars.CI_SERVICE_ACCOUNT }} | |
| latest_tag: ${{ env.LATEST_TAG }} | |
| deploy: | |
| name: Deploy | |
| needs: photon | |
| uses: ./.github/workflows/_photon-deploy-fanout.yml | |
| with: | |
| image: "geocoder-photon:${{ needs.photon.outputs.image_tag }}" | |
| target: 'tst → prd' | |
| require_approval: false | |
| secrets: inherit | |
| notify-slack: | |
| needs: [ generate-tag, nominatim-data, photon, deploy ] | |
| if: failure() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: slackapi/slack-github-action@v3 | |
| with: | |
| webhook: ${{ secrets.SLACK_WEBHOOK_URL_HENRIK }} | |
| webhook-type: incoming-webhook | |
| payload: | | |
| text: "❌ *${{ github.workflow }}* failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|run>" |