-
Notifications
You must be signed in to change notification settings - Fork 0
179 lines (174 loc) · 7.21 KB
/
push-tag.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
# You need to set up Workload Identity Federation in your Google Cloud project in order to use this GitHub Actions definition: https://medium.com/p/3932dce678b8.
# And the secrets.GSA_ID needs to have the roles/artifactregistry.writer role in order push container images.
name: push-tag
permissions:
contents: read
id-token: write
packages: write
on:
push:
tags:
- 'v*'
env:
IMAGE_TAG: ${{ github.ref_name }}
IMAGE_NAME: ${{ secrets.REGISTRY_LOCATION }}-docker.pkg.dev/${{ secrets.PROJECT_ID }}/${{ secrets.REGISTRY_NAME }}/my-sample-workload
ENVIRONMENT_ID: development
WORKLOAD_NAME: my-sample-workload
HUMCTL_VERSION: '*'
jobs:
build-push:
runs-on: ubuntu-24.04
steps:
- name: checkout code
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: authenticate to google cloud
uses: google-github-actions/auth@v2
with:
workload_identity_provider: '${{ secrets.WI_PROVIDER_ID }}'
service_account: '${{ secrets.GSA_ID }}'
- name: install gcloud
uses: google-github-actions/setup-gcloud@v2
with:
version: latest
- name: sign-in to gar
run: |
gcloud auth configure-docker \
${{ secrets.REGISTRY_LOCATION }}-docker.pkg.dev \
--quiet
- name: login to ghcr
run: |
echo ${{ secrets.GITHUB_TOKEN }} | docker login \
ghcr.io \
-u $ \
--password-stdin
- name: Build and push
uses: docker/build-push-action@v6
with:
context: app/
platforms: linux/amd64,linux/arm64
push: true
tags: "${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }},ghcr.io/${{ github.repository_owner }}/${{ env.WORKLOAD_NAME }}:latest"
deploy-humanitec:
needs: build-push
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v4
- name: install humctl
uses: humanitec/setup-cli-action@v1
with:
token: ${{ secrets.GITHUB_TOKEN }}
version: ${{ env.HUMCTL_VERSION }}
- name: create humanitec app
run: |
humctl create app ${{ vars.APP_NAME }} \
--token ${{ secrets.HUMANITEC_TOKEN }} \
--org ${{ secrets.HUMANITEC_ORG }} \
--name ${{ vars.APP_NAME }} \
|| true
- name: authenticate to google cloud
uses: google-github-actions/auth@v2
with:
workload_identity_provider: '${{ secrets.WI_PROVIDER_ID }}'
service_account: '${{ secrets.GSA_ID }}'
- name: setup gcloud
uses: google-github-actions/setup-gcloud@v2
with:
version: latest
- name: sign-in to gar
run: |
gcloud auth configure-docker \
${{ secrets.REGISTRY_LOCATION }}-docker.pkg.dev \
--quiet
- uses: oras-project/setup-oras@v1
- name: get container image digest
run: |
echo "IMAGE_DIGEST=$(oras manifest fetch ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} \
--descriptor \
| jq -r .digest)" >> ${{ github.env }}
- name: notify humanitec
run: |-
humctl create artefact-version \
--token ${{ secrets.HUMANITEC_TOKEN }} \
--org ${{ secrets.HUMANITEC_ORG }} \
-t container \
-n ${{ env.IMAGE_NAME }} \
--version ${{ env.IMAGE_TAG }} \
--ref ${{ github.ref }} \
--commit $(echo ${{ github.sha }} | cut -c1-7) \
--digest ${IMAGE_DIGEST}
- name: humctl score deploy
run: |
humctl score deploy \
--deploy-config score/score.deploy.yaml \
--image ${{ env.IMAGE_NAME }}@${IMAGE_DIGEST} \
--message ${{ github.ref_name }} \
--workload-source-url-prefix "https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/score" \
--token ${{ secrets.HUMANITEC_TOKEN }} \
--org ${{ secrets.HUMANITEC_ORG }} \
--app ${{ vars.APP_NAME }} \
--env ${{ env.ENVIRONMENT_ID }} \
--wait
- name: get deployment information
if: ${{ always() }}
run: |
DEPLOYMENT_ID=$(humctl get deployment . -o json \
--token ${{ secrets.HUMANITEC_TOKEN }} \
--org ${{ secrets.HUMANITEC_ORG }} \
--app ${{ vars.APP_NAME }} \
--env ${{ env.ENVIRONMENT_ID }} \
| jq -r .metadata.id)
ENV_URL="https://app.humanitec.io/orgs/"${{ secrets.HUMANITEC_ORG }}"/apps/"${{ vars.APP_NAME }}"/envs/"${{ env.ENVIRONMENT_ID }}"/deploys/"${DEPLOYMENT_ID}
DOMAINS=$(humctl get active-resources \
--token ${{ secrets.HUMANITEC_TOKEN }} \
--org ${{ secrets.HUMANITEC_ORG }} \
--app ${{ vars.APP_NAME }} \
--env ${{ env.ENVIRONMENT_ID }} -o json \
| jq -r '. | map(. | select(.metadata.type == "dns")) | map((.metadata.res_id | split(".") | .[1]) + ": [" + .status.resource.host + "](https://" + .status.resource.host + ")") | join("\n")')
DEPLOYMENT_ERRORS=$(humctl get deployment-error \
--token ${{ secrets.HUMANITEC_TOKEN }} \
--org ${{ secrets.HUMANITEC_ORG }} \
--app ${{ vars.APP_NAME }} \
--env ${{ env.ENVIRONMENT_ID }} -o json)
RUNTIME_ERRORS=$(humctl api get /orgs/${{ secrets.HUMANITEC_ORG }}/apps/${{ vars.APP_NAME }}/envs/${{ env.ENVIRONMENT_ID }}/runtime \
--token ${{ secrets.HUMANITEC_TOKEN }} \
| grep '"status": "Failure"' -B 10 -A 1) \
|| true
if [[ "$DEPLOYMENT_ERRORS" = "[]" && -z "$RUNTIME_ERRORS" ]]; then
echo "## Deployment successfully completed for ${{ env.ENVIRONMENT_ID }}! :tada:"
echo ""
else
echo "## Deployment failed for ${{ env.ENVIRONMENT_ID }}! :x:"
echo ""
if [ "$DEPLOYMENT_ERRORS" != "[]" ]; then
echo "### Deployment errors:"
echo ""
echo "$DEPLOYMENT_ERRORS"
echo ""
fi
if [ -n "$RUNTIME_ERRORS" ]; then
echo "### Runtime errors:"
echo ""
echo "$RUNTIME_ERRORS"
echo ""
fi
fi
echo "### View in Humanitec: $ENV_URL"
echo ""
echo "### Deployment ID: $DEPLOYMENT_ID"
echo ""
echo "### URLs:"
echo ""
echo "$DOMAINS"
echo ""
echo "### Deployment diff:"
echo ""
humctl diff sets deploy/+1 deploy/. \
--token ${{ secrets.HUMANITEC_TOKEN }} \
--org ${{ secrets.HUMANITEC_ORG }} \
--app ${{ vars.APP_NAME }} \
--env ${{ env.ENVIRONMENT_ID }} -o json
echo ""