R1.2 Webhook task hardening (#9) #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Relay Sandbox | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - "docs/**" | |
| - "*.md" | |
| concurrency: | |
| group: relay-sandbox | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| id-token: write | |
| env: | |
| AWS_REGION: eu-west-1 | |
| SANDBOX_INSTANCE_ID: ${{ vars.RELAY_SANDBOX_INSTANCE_ID || 'i-03b7cd5de0a10a889' }} | |
| SANDBOX_HEALTH_URL: ${{ vars.RELAY_SANDBOX_HEALTH_URL || 'https://relay.dtcdev.click/health/ready' }} | |
| SANDBOX_DEPLOY_ROLE_ARN: ${{ vars.RELAY_SANDBOX_DEPLOY_ROLE_ARN || 'arn:aws:iam::817685572750:role/relay-sandbox-github-deploy' }} | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: astral-sh/setup-uv@v7 | |
| - name: Install dependencies | |
| run: uv sync --frozen --dev | |
| - name: Run lint and checks | |
| run: | | |
| uv run ruff check . | |
| uv run python manage.py makemigrations --check --dry-run | |
| uv run python manage.py check | |
| - name: Run tests | |
| run: uv run pytest | |
| deploy: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v5 | |
| with: | |
| role-to-assume: ${{ env.SANDBOX_DEPLOY_ROLE_ARN }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| - name: Deploy the complete Relay release | |
| id: deploy | |
| run: | | |
| set -euo pipefail | |
| command_id=$( | |
| aws ssm send-command \ | |
| --region "$AWS_REGION" \ | |
| --instance-ids "$SANDBOX_INSTANCE_ID" \ | |
| --document-name AWS-RunShellScript \ | |
| --comment "Deploy Relay sandbox ${GITHUB_SHA}" \ | |
| --parameters "commands=[\"set -euo pipefail\",\"git config --system --get-all safe.directory | grep -Fxq /opt/relay || git config --system --add safe.directory /opt/relay\",\"if [[ ! -d /opt/relay/.git ]]; then if [[ -f /opt/relay/README ]]; then mv /opt/relay/README /var/lib/relay/bootstrap-readme; fi; git -C /opt/relay init; fi\",\"if git -C /opt/relay remote get-url origin >/dev/null 2>&1; then git -C /opt/relay remote set-url origin https://github.com/DataTalksClub/relay.git; else git -C /opt/relay remote add origin https://github.com/DataTalksClub/relay.git; fi\",\"git -C /opt/relay fetch origin ${GITHUB_SHA}\",\"git -C /opt/relay checkout --force ${GITHUB_SHA}\",\"bash /opt/relay/scripts/deploy_relay_sandbox.sh ${GITHUB_SHA}\"]" \ | |
| --query 'Command.CommandId' \ | |
| --output text | |
| ) | |
| echo "command_id=$command_id" >>"$GITHUB_OUTPUT" | |
| for _ in $(seq 1 240); do | |
| status=$(aws ssm get-command-invocation \ | |
| --region "$AWS_REGION" \ | |
| --command-id "$command_id" \ | |
| --instance-id "$SANDBOX_INSTANCE_ID" \ | |
| --query Status --output text 2>/dev/null || true) | |
| case "$status" in | |
| Success) exit 0 ;; | |
| Failed|Cancelled|TimedOut|Cancelling) exit 1 ;; | |
| esac | |
| sleep 5 | |
| done | |
| echo "Relay deployment did not finish within 20 minutes" >&2 | |
| exit 1 | |
| - name: Show deployment output | |
| if: always() | |
| run: | | |
| command_id="${{ steps.deploy.outputs.command_id }}" | |
| if [[ -z "$command_id" ]]; then | |
| echo "No SSM deployment command was created." | |
| exit 0 | |
| fi | |
| aws ssm get-command-invocation \ | |
| --region "$AWS_REGION" \ | |
| --command-id "$command_id" \ | |
| --instance-id "$SANDBOX_INSTANCE_ID" \ | |
| --query '{Status:Status,ResponseCode:ResponseCode,Stdout:StandardOutputContent,Stderr:StandardErrorContent}' | |
| - name: Verify public health | |
| run: curl --fail --silent --show-error --retry 10 --retry-delay 3 "$SANDBOX_HEALTH_URL" |