firetower/.github/workflows/restart-service.yml at main · getsentry/firetower · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
name: Restart Service
permissions:
  contents: read
  id-token: write

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to restart ("prod" or "test")'
        type: environment
        default: test
        required: true

jobs:
  restart-test:
    if: ${{ inputs.environment == 'test' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        service:
          - firetower-test
          - firetower-slack-app-test
          - firetower-async-test
    steps:
      - name: Authenticate with GCP
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_SLUG }}
          workload_identity_provider: projects/${{ secrets.GCP_PROJECT_NUM }}/locations/global/workloadIdentityPools/github/providers/github-prvdr
      - name: Export current service definition
        run: |
          gcloud run services describe ${{ matrix.service }} \
            --project ${{ secrets.GCP_PROJECT_SLUG }} \
            --region us-west1 \
            --format export > service.yaml
      - name: Force new revision name
        run: |
          # Cloud Run only creates a new revision when the revision
          # template changes. Since we're re-applying the exact same spec,
          # give it a unique revision name so a new revision (and new
          # instances) are actually created. Revision names are immutable,
          # so we can't rely on github.run_number alone: it stays the same
          # across re-runs of a failed job. Combining run_id and run_attempt
          # guarantees a fresh name on every attempt, including retries.
          yq -i '.spec.template.metadata.name = "${{ matrix.service }}-restart-${{ github.run_id }}-${{ github.run_attempt }}"' service.yaml
      - name: Redeploy ${{ matrix.service }}
        run: |
          gcloud run services replace service.yaml \
            --project ${{ secrets.GCP_PROJECT_SLUG }} \
            --region us-west1
      - name: Route traffic to new revision
        run: |
          # Ensure traffic actually shifts to the revision we just created,
          # regardless of whatever traffic split was in the exported spec
          # (e.g. if traffic was previously pinned to a specific revision).
          gcloud run services update-traffic ${{ matrix.service }} \
            --project ${{ secrets.GCP_PROJECT_SLUG }} \
            --region us-west1 \
            --to-latest

  restart-prod:
    if: ${{ inputs.environment == 'prod' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        service:
          - firetower
          - firetower-slack-app
          - firetower-async-prod
    steps:
      - name: Authenticate with GCP
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
        with:
          project_id: ${{ secrets.GCP_PROJECT_SLUG }}
          workload_identity_provider: projects/${{ secrets.GCP_PROJECT_NUM }}/locations/global/workloadIdentityPools/github/providers/github-prvdr
      - name: Export current service definition
        run: |
          gcloud run services describe ${{ matrix.service }} \
            --project ${{ secrets.GCP_PROJECT_SLUG }} \
            --region us-west1 \
            --format export > service.yaml
      - name: Force new revision name
        run: |
          # Cloud Run only creates a new revision when the revision
          # template changes. Since we're re-applying the exact same spec,
          # give it a unique revision name so a new revision (and new
          # instances) are actually created. Revision names are immutable,
          # so we can't rely on github.run_number alone: it stays the same
          # across re-runs of a failed job. Combining run_id and run_attempt
          # guarantees a fresh name on every attempt, including retries.
          yq -i '.spec.template.metadata.name = "${{ matrix.service }}-restart-${{ github.run_id }}-${{ github.run_attempt }}"' service.yaml
      - name: Redeploy ${{ matrix.service }}
        run: |
          gcloud run services replace service.yaml \
            --project ${{ secrets.GCP_PROJECT_SLUG }} \
            --region us-west1
      - name: Route traffic to new revision
        run: |
          # Ensure traffic actually shifts to the revision we just created,
          # regardless of whatever traffic split was in the exported spec
          # (e.g. if traffic was previously pinned to a specific revision).
          gcloud run services update-traffic ${{ matrix.service }} \
            --project ${{ secrets.GCP_PROJECT_SLUG }} \
            --region us-west1 \
            --to-latest