oddish/.github/workflows/modal-deploy.yml at 5a5620f9d4c0ba834d33b269ca17db7a89142e96 · abundant-ai/oddish · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
name: Modal Deploy

on:
  push:
    branches:
      - main

concurrency:
  group: modal-deploy-main
  cancel-in-progress: true

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    # Python 3.13, uv, and a warm uv cache live in the base image —
    # refreshed weekly by .github/workflows/ci-base-image.yml.
    container:
      image: ghcr.io/abundant-ai/oddish-ci-base:latest
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    env:
      MODAL_TOKEN_ID: ${{ secrets.MODAL_TOKEN_ID }}
      MODAL_TOKEN_SECRET: ${{ secrets.MODAL_TOKEN_SECRET }}
      MODAL_ENVIRONMENT: main
      # Hold LLM trials until a task's nop/oracle baselines validate it.
      ODDISH_GATE_LLM_ON_BASELINES: "1"
      # Enable the GKE (TPU) execution backend in prod. The SA credential
      # rides in the oddish-gcp secret (attached when ODDISH_GKE_ENABLED is
      # set); the non-secret cluster/registry coordinates are declared here
      # so the backend registers deterministically -- even if oddish-gcp is
      # ever re-created with only the key (which silently un-registered GKE
      # once, since gke_cluster_name failed to derive without a project id).
      ODDISH_GKE_ENABLED: "true"
      ODDISH_GKE_PROJECT_ID: "abundant-default"
      ODDISH_GKE_REGION: "us-east5"
      ODDISH_GKE_REGISTRY_LOCATION: "us-east5"
      ODDISH_GKE_REGISTRY_NAME: "oddish-envs"
      ODDISH_GKE_AUTO_PROVISION_CLUSTER: "true"
      ODDISH_GKE_AUTO_BUILD_MISSING_IMAGE: "true"
      ODDISH_GKE_IDLE_CLUSTER_TTL_HOURS: "1"
      # Ephemeral Harbor CPU sandboxes. Credentials and the SSH private key are
      # attached from dedicated Modal secrets; only platform-owned launch
      # coordinates are declared in the deployment environment.
      ODDISH_EC2_ENABLED: "true"
      ODDISH_EC2_CONTROL_SECRET_NAME: oddish-ec2-control
      ODDISH_EC2_SSH_SECRET_NAME: oddish-ec2-ssh
      ODDISH_EC2_REGION: us-west-2
      ODDISH_EC2_AMI_ID: ami-0ac74609c6396bed3
      ODDISH_EC2_INSTANCE_TYPE: m7i-flex.2xlarge
      ODDISH_EC2_SUBNET_ID: subnet-0da0349bc81aa34d8
      ODDISH_EC2_SECURITY_GROUP_IDS: '["sg-04d0011ae0f6b6c00"]'
      ODDISH_EC2_KEY_NAME: oddish-harbor
      ODDISH_EC2_SSH_USER: ubuntu
      ODDISH_EC2_ROOT_VOLUME_SIZE_GB: "80"
      ODDISH_EC2_USE_PUBLIC_IP: "true"
      ODDISH_EC2_BOOTSTRAP_DOCKER: "true"
      # Point uv at the .venv pre-built into the base image.  `uv sync
      # --frozen` then validates that venv against the current lockfile
      # and only patches the editable oddish path — typically a no-op
      # taking ~1s.
      UV_PROJECT_ENVIRONMENT: /opt/venvs/backend
    defaults:
      run:
        working-directory: backend
    steps:
      - name: Checkout repository
        uses: actions/checkout@v5

      - name: Sync backend dependencies
        run: uv sync --frozen

      - name: Deploy Modal backend
        run: uv run modal deploy deploy.py

      - name: Summarize deployment
        run: |
          {
            echo "## Modal deployment"
            echo
            echo "- Backend entrypoint: \`backend/deploy.py\`"
            echo "- Modal environment: \`main\`"
            echo "- Trigger: push to \`main\`"
            echo "- Commit: \`${{ github.sha }}\`"
          } >> "$GITHUB_STEP_SUMMARY"