Merge pull request #2572 from canonical/feature/WD-36600-csp #520
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| description: 'Select the environment to deploy to (staging or production)' | |
| required: true | |
| default: 'staging' | |
| type: choice | |
| options: | |
| - staging | |
| - production | |
| branch: | |
| description: 'Branch to deploy (production always requires main)' | |
| required: false | |
| default: 'main' | |
| type: string | |
| concurrency: | |
| group: canonical-com-deploy | |
| cancel-in-progress: false | |
| env: | |
| CHARMCRAFT_ENABLE_EXPERIMENTAL_EXTENSIONS: true | |
| ROCKCRAFT_ENABLE_EXPERIMENTAL_EXTENSIONS: true | |
| jobs: | |
| pack-charm: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| with: | |
| ref: ${{ github.event.inputs.branch || github.ref }} | |
| - name: Setup LXD | |
| uses: canonical/setup-lxd@main | |
| - name: Setup Charmcraft | |
| run: sudo snap install charmcraft --classic --channel=latest/edge | |
| - name: Pack charm | |
| run: | | |
| cd charm | |
| charmcraft pack -v --project-dir ./ | |
| - name: Upload charm | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: canonical-com-charm | |
| path: ./charm/*.charm | |
| pack-rock: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| with: | |
| ref: ${{ github.event.inputs.branch || github.ref }} | |
| - name: Use Node.js | |
| uses: actions/setup-node@v3 | |
| - name: Build Assets | |
| run: | | |
| yarn install | |
| yarn run build | |
| - name: Setup LXD | |
| uses: canonical/setup-lxd@main | |
| - name: Setup Rockcraft | |
| run: sudo snap install rockcraft --classic --revision 4542 | |
| - name: Pack Rock | |
| run: rockcraft pack | |
| - name: Upload Rock | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: canonical-com-rock | |
| path: ./*.rock | |
| publish-image: | |
| runs-on: ubuntu-latest | |
| needs: pack-rock | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| image_url: ${{ steps.set_image_url.outputs.image_url }} | |
| steps: | |
| - name: Get Rock | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: canonical-com-rock | |
| - name: Set image URL | |
| id: set_image_url | |
| run: echo "image_url=ghcr.io/canonical/canonical.com:$(date +%s)-${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT | |
| - name: Push to GHCR | |
| run: skopeo --insecure-policy copy oci-archive:$(ls *.rock) docker://${{ steps.set_image_url.outputs.image_url }} --dest-creds "canonical:${{ secrets.GITHUB_TOKEN }}" | |
| deploy-staging: | |
| runs-on: | |
| [self-hosted, self-hosted-linux-amd64-noble-private-endpoint-medium] | |
| if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'staging') | |
| needs: [pack-charm, publish-image] | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| - name: Install Dependencies | |
| run: | | |
| sudo snap install juju --channel=3.6/stable --classic | |
| sudo snap install vault --classic | |
| - name: Download Charm Artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: canonical-com-charm | |
| - name: Configure Vault and Juju | |
| run: | | |
| export VAULT_ADDR=https://vault.admin.canonical.com:8200 | |
| export TF_VAR_login_approle_role_id=${{ secrets.STG_VAULT_APPROLE_ROLE_ID }} | |
| export TF_VAR_login_approle_secret_id=${{ secrets.STG_VAULT_APPROLE_SECRET_ID }} | |
| export VAULT_SECRET_PATH_ROLE=secret/prodstack6/roles/stg-staging-canonical-com | |
| export VAULT_SECRET_PATH_COMMON=secret/prodstack6/juju/common | |
| VAULT_TOKEN=$(vault write -f -field=token auth/approle/login role_id=${TF_VAR_login_approle_role_id} secret_id=${TF_VAR_login_approle_secret_id}) | |
| export VAULT_TOKEN | |
| mkdir -p ~/.local/share/juju | |
| vault read -field=controller_config "${VAULT_SECRET_PATH_COMMON}/controllers/juju-controller-36-migration-ps6" | base64 -d > ~/.local/share/juju/controllers.yaml | |
| USERNAME=$(vault read -field=username "${VAULT_SECRET_PATH_ROLE}/juju") | |
| PASSWORD=$(vault read -field=password "${VAULT_SECRET_PATH_ROLE}/juju") | |
| printf "controllers:\n juju-controller-36-migration-ps6:\n user: %s\n password: %s\n" "$USERNAME" "$PASSWORD" > ~/.local/share/juju/accounts.yaml | |
| - name: Deploy Application to staging | |
| run: | | |
| export JUJU_MODEL=admin/stg-staging-canonical-com | |
| juju refresh canonical-com --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju refresh canonical-com-blog --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju refresh canonical-com-careers --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju wait-for application canonical-com --query='name=="canonical-com" && (status=="active" || status=="idle")' | |
| deploy-production: | |
| runs-on: [self-hosted, self-hosted-linux-amd64-noble-private-endpoint-medium] | |
| if: | | |
| always() && | |
| needs.pack-charm.result == 'success' && | |
| needs.publish-image.result == 'success' && | |
| (needs.deploy-staging.result == 'success' || needs.deploy-staging.result == 'skipped') && | |
| ( | |
| github.event_name == 'push' || | |
| ( | |
| github.event_name == 'workflow_dispatch' && | |
| github.event.inputs.environment == 'production' && | |
| github.event.inputs.branch == 'main' | |
| ) | |
| ) | |
| needs: [pack-charm, publish-image, deploy-staging] | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| - name: Install Dependencies | |
| run: | | |
| sudo snap install juju --channel=3.6/stable --classic | |
| sudo snap install vault --classic | |
| - name: Download Charm Artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: canonical-com-charm | |
| - name: Configure Vault and Juju | |
| run: | | |
| export VAULT_ADDR=https://vault.admin.canonical.com:8200 | |
| export TF_VAR_login_approle_role_id=${{ secrets.PROD_VAULT_APPROLE_ROLE_ID }} | |
| export TF_VAR_login_approle_secret_id=${{ secrets.PROD_VAULT_APPROLE_SECRET_ID }} | |
| export VAULT_SECRET_PATH_ROLE=secret/prodstack6/roles/prod-canonical-com | |
| export VAULT_SECRET_PATH_COMMON=secret/prodstack6/juju/common | |
| VAULT_TOKEN=$(vault write -f -field=token auth/approle/login role_id=${TF_VAR_login_approle_role_id} secret_id=${TF_VAR_login_approle_secret_id}) | |
| export VAULT_TOKEN | |
| mkdir -p ~/.local/share/juju | |
| vault read -field=controller_config "${VAULT_SECRET_PATH_COMMON}/controllers/juju-controller-36-production-ps6" | base64 -d > ~/.local/share/juju/controllers.yaml | |
| USERNAME=$(vault read -field=username "${VAULT_SECRET_PATH_ROLE}/juju") | |
| PASSWORD=$(vault read -field=password "${VAULT_SECRET_PATH_ROLE}/juju") | |
| printf "controllers:\n juju-controller-36-production-ps6:\n user: %s\n password: %s\n" "$USERNAME" "$PASSWORD" > ~/.local/share/juju/accounts.yaml | |
| - name: Deploy Application to production | |
| run: | | |
| export JUJU_MODEL=admin/prod-canonical-com | |
| juju refresh canonical-com --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju refresh canonical-com-blog --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju refresh canonical-com-careers --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju wait-for application canonical-com --query='name=="canonical-com" && (status=="active" || status=="idle")' |