|
5 | 5 | push: |
6 | 6 | branches: |
7 | 7 | - main |
| 8 | + - patch/3967 |
8 | 9 | tags: |
9 | 10 | # pre-release tag |
10 | 11 | - "202[3-9].[0-9][0-9].[0-9]+-rc[0-9]+" |
@@ -36,21 +37,11 @@ jobs: |
36 | 37 | - id: set-env |
37 | 38 | run: | |
38 | 39 | # 1. Determine if it's a tag |
39 | | - if [[ "${{ github.ref_type }}" == "tag" ]]; then |
40 | | - IS_TAG="true" |
41 | | - else |
42 | | - IS_TAG="false" |
43 | | - fi |
| 40 | + IS_TAG="true" # this is a lie |
44 | 41 | echo "is_tag=$IS_TAG" >> $GITHUB_OUTPUT |
45 | 42 |
|
46 | 43 | # 2. Determine environment name |
47 | | - if [[ $IS_TAG == "false" ]]; then |
48 | | - ENV="dev" |
49 | | - elif [[ "${{ github.ref }}" == *"-rc"* ]]; then |
50 | | - ENV="test" |
51 | | - else |
52 | | - ENV="prod" |
53 | | - fi |
| 44 | + ENV="dev" |
54 | 45 | echo "env_name=$ENV" >> $GITHUB_OUTPUT |
55 | 46 |
|
56 | 47 | # 3. Determine if it's a final release tag |
|
68 | 59 | tests-pytest: |
69 | 60 | needs: [setup] |
70 | 61 | uses: ./.github/workflows/tests-pytest.yml |
| 62 | + with: |
| 63 | + parent_event: ${{ github.event_name }} |
71 | 64 | if: ${{ needs.setup.outputs.is_tag == 'true' }} |
72 | 65 |
|
73 | 66 | check-migrations-and-messages: |
@@ -96,120 +89,120 @@ jobs: |
96 | 89 | - name: Checkout |
97 | 90 | uses: actions/checkout@v7 |
98 | 91 |
|
99 | | - - uses: actions/setup-python@v7 |
100 | | - with: |
101 | | - python-version-file: .github/workflows/.python-version |
102 | | - cache: pip |
103 | | - cache-dependency-path: "**/pyproject.toml" |
104 | | - |
105 | | - - name: Write python packages to file |
106 | | - run: | |
107 | | - python -m venv .venv |
108 | | - source .venv/bin/activate |
109 | | - pip install pipdeptree |
110 | | - pip install -e . |
111 | | - pipdeptree |
112 | | - pipdeptree >> benefits/static/requirements.txt |
| 92 | + # - uses: actions/setup-python@v7 |
| 93 | + # with: |
| 94 | + # python-version-file: .github/workflows/.python-version |
| 95 | + # cache: pip |
| 96 | + # cache-dependency-path: "**/pyproject.toml" |
| 97 | + |
| 98 | + # - name: Write python packages to file |
| 99 | + # run: | |
| 100 | + # python -m venv .venv |
| 101 | + # source .venv/bin/activate |
| 102 | + # pip install pipdeptree |
| 103 | + # pip install -e . |
| 104 | + # pipdeptree |
| 105 | + # pipdeptree >> benefits/static/requirements.txt |
113 | 106 |
|
114 | 107 | - name: Write commit SHA to file |
115 | 108 | run: echo "${{ github.sha }}" >> benefits/static/sha.txt |
116 | 109 |
|
117 | | - - name: Docker Login to GitHub Container Registry |
118 | | - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 |
119 | | - with: |
120 | | - registry: ghcr.io |
121 | | - username: ${{ github.actor }} |
122 | | - password: ${{ secrets.GITHUB_TOKEN }} |
123 | | - |
124 | | - - name: Set up Docker Buildx |
125 | | - id: buildx |
126 | | - uses: docker/setup-buildx-action@v4 |
127 | | - |
128 | | - - name: Cache Parameters |
129 | | - id: cache_params |
130 | | - run: | |
131 | | - CACHE_SCOPE="cal-itp" |
132 | | - MAIN_BRANCH_REF="refs/heads/main" |
133 | | -
|
134 | | - echo "cache_from_args=type=gha,scope=${CACHE_SCOPE},ref=${MAIN_BRANCH_REF}" >> $GITHUB_OUTPUT |
135 | | - echo "cache_to_args=type=gha,scope=${CACHE_SCOPE},mode=max,ref=${MAIN_BRANCH_REF}" >> $GITHUB_OUTPUT |
136 | | -
|
137 | | - - name: Build, tag, and push image to GitHub Container Registry |
138 | | - uses: docker/build-push-action@v7 |
139 | | - with: |
140 | | - builder: ${{ steps.buildx.outputs.name }} |
141 | | - build-args: GIT-SHA=${{ github.sha }} |
142 | | - cache-from: ${{ steps.cache_params.outputs.cache_from_args }} |
143 | | - cache-to: ${{ steps.cache_params.outputs.cache_to_args }} |
144 | | - context: . |
145 | | - file: appcontainer/Dockerfile |
146 | | - push: true |
147 | | - tags: ghcr.io/${{ github.repository }}:${{ github.sha }} |
148 | | - |
149 | | - # deploy application service |
150 | | - - name: Deploy to Azure Web App |
151 | | - uses: azure/webapps-deploy@v2 |
152 | | - with: |
153 | | - app-name: ${{ vars.AZURE_WEBAPP_NAME }} |
154 | | - images: ghcr.io/${{ github.repository }}:${{ github.sha }} |
155 | | - publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} |
156 | | - |
157 | | - # begin setup to deploy container app |
158 | | - - name: Log in to azure using federated identity credentials |
159 | | - uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3 |
160 | | - with: |
161 | | - client-id: ${{ secrets.AZURE_SP_CLIENT_ID }} |
162 | | - tenant-id: ${{ secrets.AZURE_TENANT_ID }} |
163 | | - subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} |
164 | | - |
165 | | - - name: Setup terraform |
166 | | - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4 |
167 | | - with: |
168 | | - terraform_version: 1.15.8 # should match TF_VERSION in .devcontainer/Dockerfile |
169 | | - |
170 | | - - name: Initialize terraform and select workspace |
171 | | - working-directory: terraform |
172 | | - run: ./init.sh "${{ needs.setup.outputs.env_name }}" |
173 | | - |
174 | | - - name: Terraform plan |
175 | | - working-directory: terraform |
176 | | - env: |
177 | | - TF_VAR_CONTAINER_TAG: ${{ github.sha }} |
178 | | - TF_VAR_DEVSECOPS_OBJECT_ID: ${{ secrets.TF_VAR_DEVSECOPS_OBJECT_ID }} |
179 | | - TF_VAR_ENGINEERING_GROUP_OBJECT_ID: ${{ secrets.TF_VAR_ENGINEERING_GROUP_OBJECT_ID }} |
180 | | - TF_VAR_sp_apply_object_id: ${{ secrets.AZURE_SP_OBJECT_ID }} |
181 | | - TF_VAR_sp_plan_object_id: ${{ secrets.AZURE_SP_PLAN_OBJECT_ID }} |
182 | | - run: terraform plan -out=tfplan -lock-timeout=5m |
183 | | - |
184 | | - - name: Terraform apply |
185 | | - working-directory: terraform |
186 | | - run: terraform apply -lock-timeout=5m tfplan |
187 | | - |
188 | | - # attach a detailed summary directly to a gh actions job. sensitive values that match repo secrets are automatically redacted |
189 | | - - name: Attach detailed summary to job |
190 | | - uses: borchero/terraform-plan-comment@f585438eda2fa77c6f275994b92aeccd86ef3542 # v3.2.0 |
191 | | - with: |
192 | | - planfile: tfplan |
193 | | - token: ${{ github.token }} |
194 | | - skip-comment: true |
195 | | - working-directory: terraform |
196 | | - |
197 | | - release: |
198 | | - needs: deploy |
199 | | - if: ${{ needs.setup.outputs.is_release =='true' }} |
200 | | - runs-on: ubuntu-latest |
201 | | - permissions: |
202 | | - # https://github.com/softprops/action-gh-release#permissions |
203 | | - contents: write |
204 | | - |
205 | | - steps: |
206 | | - - name: Checkout |
207 | | - uses: actions/checkout@v7 |
208 | | - with: |
209 | | - fetch-depth: 0 |
210 | | - |
211 | | - - name: Release |
212 | | - uses: softprops/action-gh-release@v3 |
213 | | - with: |
214 | | - prerelease: false |
215 | | - generate_release_notes: true |
| 110 | + # - name: Docker Login to GitHub Container Registry |
| 111 | + # uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 |
| 112 | + # with: |
| 113 | + # registry: ghcr.io |
| 114 | + # username: ${{ github.actor }} |
| 115 | + # password: ${{ secrets.GITHUB_TOKEN }} |
| 116 | + |
| 117 | + # - name: Set up Docker Buildx |
| 118 | + # id: buildx |
| 119 | + # uses: docker/setup-buildx-action@v4 |
| 120 | + |
| 121 | + # - name: Cache Parameters |
| 122 | + # id: cache_params |
| 123 | + # run: | |
| 124 | + # CACHE_SCOPE="cal-itp" |
| 125 | + # MAIN_BRANCH_REF="refs/heads/main" |
| 126 | + |
| 127 | + # echo "cache_from_args=type=gha,scope=${CACHE_SCOPE},ref=${MAIN_BRANCH_REF}" >> $GITHUB_OUTPUT |
| 128 | + # echo "cache_to_args=type=gha,scope=${CACHE_SCOPE},mode=max,ref=${MAIN_BRANCH_REF}" >> $GITHUB_OUTPUT |
| 129 | + |
| 130 | + # - name: Build, tag, and push image to GitHub Container Registry |
| 131 | + # uses: docker/build-push-action@v7 |
| 132 | + # with: |
| 133 | + # builder: ${{ steps.buildx.outputs.name }} |
| 134 | + # build-args: GIT-SHA=${{ github.sha }} |
| 135 | + # cache-from: ${{ steps.cache_params.outputs.cache_from_args }} |
| 136 | + # cache-to: ${{ steps.cache_params.outputs.cache_to_args }} |
| 137 | + # context: . |
| 138 | + # file: appcontainer/Dockerfile |
| 139 | + # push: true |
| 140 | + # tags: ghcr.io/${{ github.repository }}:${{ github.sha }} |
| 141 | + |
| 142 | + # # deploy application service |
| 143 | + # - name: Deploy to Azure Web App |
| 144 | + # uses: azure/webapps-deploy@v2 |
| 145 | + # with: |
| 146 | + # app-name: ${{ vars.AZURE_WEBAPP_NAME }} |
| 147 | + # images: ghcr.io/${{ github.repository }}:${{ github.sha }} |
| 148 | + # publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }} |
| 149 | + |
| 150 | + # # begin setup to deploy container app |
| 151 | + # - name: Log in to azure using federated identity credentials |
| 152 | + # uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3 |
| 153 | + # with: |
| 154 | + # client-id: ${{ secrets.AZURE_SP_CLIENT_ID }} |
| 155 | + # tenant-id: ${{ secrets.AZURE_TENANT_ID }} |
| 156 | + # subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} |
| 157 | + |
| 158 | + # - name: Setup terraform |
| 159 | + # uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4 |
| 160 | + # with: |
| 161 | + # terraform_version: 1.15.8 # should match TF_VERSION in .devcontainer/Dockerfile |
| 162 | + |
| 163 | + # - name: Initialize terraform and select workspace |
| 164 | + # working-directory: terraform |
| 165 | + # run: ./init.sh "${{ needs.setup.outputs.env_name }}" |
| 166 | + |
| 167 | + # - name: Terraform plan |
| 168 | + # working-directory: terraform |
| 169 | + # env: |
| 170 | + # TF_VAR_CONTAINER_TAG: ${{ github.sha }} |
| 171 | + # TF_VAR_DEVSECOPS_OBJECT_ID: ${{ secrets.TF_VAR_DEVSECOPS_OBJECT_ID }} |
| 172 | + # TF_VAR_ENGINEERING_GROUP_OBJECT_ID: ${{ secrets.TF_VAR_ENGINEERING_GROUP_OBJECT_ID }} |
| 173 | + # TF_VAR_sp_apply_object_id: ${{ secrets.AZURE_SP_OBJECT_ID }} |
| 174 | + # TF_VAR_sp_plan_object_id: ${{ secrets.AZURE_SP_PLAN_OBJECT_ID }} |
| 175 | + # run: terraform plan -out=tfplan -lock-timeout=5m |
| 176 | + |
| 177 | + # - name: Terraform apply |
| 178 | + # working-directory: terraform |
| 179 | + # run: terraform apply -lock-timeout=5m tfplan |
| 180 | + |
| 181 | + # # attach a detailed summary directly to a gh actions job. sensitive values that match repo secrets are automatically redacted |
| 182 | + # - name: Attach detailed summary to job |
| 183 | + # uses: borchero/terraform-plan-comment@f585438eda2fa77c6f275994b92aeccd86ef3542 # v3.2.0 |
| 184 | + # with: |
| 185 | + # planfile: tfplan |
| 186 | + # token: ${{ github.token }} |
| 187 | + # skip-comment: true |
| 188 | + # working-directory: terraform |
| 189 | + |
| 190 | + # release: |
| 191 | + # needs: deploy |
| 192 | + # if: ${{ needs.setup.outputs.is_release =='true' }} |
| 193 | + # runs-on: ubuntu-latest |
| 194 | + # permissions: |
| 195 | + # # https://github.com/softprops/action-gh-release#permissions |
| 196 | + # contents: write |
| 197 | + |
| 198 | + # steps: |
| 199 | + # - name: Checkout |
| 200 | + # uses: actions/checkout@v7 |
| 201 | + # with: |
| 202 | + # fetch-depth: 0 |
| 203 | + |
| 204 | + # - name: Release |
| 205 | + # uses: softprops/action-gh-release@v3 |
| 206 | + # with: |
| 207 | + # prerelease: false |
| 208 | + # generate_release_notes: true |
0 commit comments