Merge pull request #2878 from canonical/WD-38196 #688
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| inputs: | |
| environment: | |
| description: 'Select the environment to deploy to (staging or production)' | |
| required: true | |
| default: 'staging' | |
| type: choice | |
| options: | |
| - staging | |
| - production | |
| branch: | |
| description: 'Branch to deploy (production always requires main)' | |
| required: false | |
| default: 'main' | |
| type: string | |
| concurrency: | |
| group: canonical-com-deploy | |
| cancel-in-progress: false | |
| env: | |
| CHARMCRAFT_ENABLE_EXPERIMENTAL_EXTENSIONS: true | |
| ROCKCRAFT_ENABLE_EXPERIMENTAL_EXTENSIONS: true | |
| # Pinned so the charm cache stays reproducible: edge drift can't leave a | |
| # stale .charm cached under an unchanged charm/** key. Bump to invalidate. | |
| CHARMCRAFT_REVISION: "8137" | |
| jobs: | |
| pack-charm: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| with: | |
| ref: ${{ github.event.inputs.branch || github.ref }} | |
| # The charm is a generic 12-factor flask-framework charm whose output | |
| # depends only on the charm/ directory. Almost every deploy changes app | |
| # code (webapp/, templates/, static/) and leaves charm/ untouched, so we | |
| # cache the packed charm and only rebuild when charm/ actually changes. | |
| - name: Restore cached charm | |
| id: charm-cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ./charm/*.charm | |
| key: charm-${{ runner.os }}-${{ runner.arch }}-cc${{ env.CHARMCRAFT_REVISION }}-${{ hashFiles('charm/**') }} | |
| - name: Setup LXD | |
| if: steps.charm-cache.outputs.cache-hit != 'true' | |
| uses: canonical/setup-lxd@main | |
| - name: Setup Charmcraft | |
| if: steps.charm-cache.outputs.cache-hit != 'true' | |
| run: sudo snap install charmcraft --classic --revision ${{ env.CHARMCRAFT_REVISION }} | |
| - name: Pack charm | |
| if: steps.charm-cache.outputs.cache-hit != 'true' | |
| run: | | |
| cd charm | |
| charmcraft pack -v --project-dir ./ | |
| - name: Upload charm | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: canonical-com-charm | |
| path: ./charm/*.charm | |
| pack-rock: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| with: | |
| ref: ${{ github.event.inputs.branch || github.ref }} | |
| - name: Use Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: 'yarn' | |
| - name: Build Assets | |
| run: | | |
| yarn install --frozen-lockfile | |
| yarn run build | |
| - name: Pre-generate llms-full.txt | |
| env: | |
| SECRET_KEY: insecure_test_key | |
| APPLICATION_CRYPTO_SECRET_KEY: insecure_test_key | |
| HARVEST_API_KEY: local_development_fake_key | |
| SERVICE_ACCOUNT_EMAIL: test_email@email.com | |
| SERVICE_ACCOUNT_PRIVATE_KEY: test_private_key | |
| run: | | |
| python3 -m venv .venv-llms | |
| .venv-llms/bin/pip install --upgrade pip "setuptools<81" | |
| .venv-llms/bin/pip install -r requirements.txt | |
| .venv-llms/bin/python webapp/llms.py generate | |
| rm -rf .venv-llms | |
| - name: Setup LXD | |
| uses: canonical/setup-lxd@main | |
| - name: Setup Rockcraft | |
| run: sudo snap install rockcraft --classic --revision 4542 | |
| - name: Pack Rock | |
| run: rockcraft pack | |
| - name: Upload Rock | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: canonical-com-rock | |
| path: ./*.rock | |
| publish-image: | |
| runs-on: ubuntu-latest | |
| needs: pack-rock | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| image_url: ${{ steps.set_image_url.outputs.image_url }} | |
| steps: | |
| - name: Get Rock | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: canonical-com-rock | |
| - name: Set image URL | |
| id: set_image_url | |
| run: echo "image_url=ghcr.io/canonical/canonical.com:$(date +%s)-${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT | |
| - name: Push to GHCR | |
| run: skopeo --insecure-policy copy oci-archive:$(ls *.rock) docker://${{ steps.set_image_url.outputs.image_url }} --dest-creds "canonical:${{ secrets.GITHUB_TOKEN }}" | |
| deploy-staging: | |
| runs-on: | |
| [self-hosted, self-hosted-linux-amd64-noble-private-endpoint-medium] | |
| if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'staging') | |
| needs: [pack-charm, publish-image] | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| - name: Install Dependencies | |
| run: | | |
| sudo snap install juju --channel=3.6/stable --classic | |
| sudo snap install vault --classic | |
| - name: Download Charm Artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: canonical-com-charm | |
| - name: Configure Vault and Juju | |
| run: | | |
| export VAULT_ADDR=https://vault.admin.canonical.com:8200 | |
| export TF_VAR_login_approle_role_id=${{ secrets.STG_VAULT_APPROLE_ROLE_ID }} | |
| export TF_VAR_login_approle_secret_id=${{ secrets.STG_VAULT_APPROLE_SECRET_ID }} | |
| export VAULT_SECRET_PATH_ROLE=secret/prodstack6/roles/stg-staging-canonical-com | |
| export VAULT_SECRET_PATH_COMMON=secret/prodstack6/juju/common | |
| VAULT_TOKEN=$(vault write -f -field=token auth/approle/login role_id=${TF_VAR_login_approle_role_id} secret_id=${TF_VAR_login_approle_secret_id}) | |
| export VAULT_TOKEN | |
| mkdir -p ~/.local/share/juju | |
| vault read -field=controller_config "${VAULT_SECRET_PATH_COMMON}/controllers/juju-controller-36-migration-ps6" | base64 -d > ~/.local/share/juju/controllers.yaml | |
| USERNAME=$(vault read -field=username "${VAULT_SECRET_PATH_ROLE}/juju") | |
| PASSWORD=$(vault read -field=password "${VAULT_SECRET_PATH_ROLE}/juju") | |
| printf "controllers:\n juju-controller-36-migration-ps6:\n user: %s\n password: %s\n" "$USERNAME" "$PASSWORD" > ~/.local/share/juju/accounts.yaml | |
| - name: Deploy Application to staging | |
| run: | | |
| export JUJU_MODEL=admin/stg-staging-canonical-com | |
| juju refresh canonical-com --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju refresh canonical-com-blog --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju refresh canonical-com-careers --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju wait-for application canonical-com --query='name=="canonical-com" && (status=="active" || status=="idle")' | |
| deploy-production: | |
| runs-on: [self-hosted, self-hosted-linux-amd64-noble-private-endpoint-medium] | |
| if: | | |
| always() && | |
| needs.pack-charm.result == 'success' && | |
| needs.publish-image.result == 'success' && | |
| (needs.deploy-staging.result == 'success' || needs.deploy-staging.result == 'skipped') && | |
| ( | |
| github.event_name == 'push' || | |
| ( | |
| github.event_name == 'workflow_dispatch' && | |
| github.event.inputs.environment == 'production' && | |
| github.event.inputs.branch == 'main' | |
| ) | |
| ) | |
| needs: [pack-charm, publish-image, deploy-staging] | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v3 | |
| - name: Install Dependencies | |
| run: | | |
| sudo snap install juju --channel=3.6/stable --classic | |
| sudo snap install vault --classic | |
| - name: Download Charm Artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: canonical-com-charm | |
| - name: Configure Vault and Juju | |
| run: | | |
| export VAULT_ADDR=https://vault.admin.canonical.com:8200 | |
| export TF_VAR_login_approle_role_id=${{ secrets.PROD_VAULT_APPROLE_ROLE_ID }} | |
| export TF_VAR_login_approle_secret_id=${{ secrets.PROD_VAULT_APPROLE_SECRET_ID }} | |
| export VAULT_SECRET_PATH_ROLE=secret/prodstack6/roles/prod-canonical-com | |
| export VAULT_SECRET_PATH_COMMON=secret/prodstack6/juju/common | |
| VAULT_TOKEN=$(vault write -f -field=token auth/approle/login role_id=${TF_VAR_login_approle_role_id} secret_id=${TF_VAR_login_approle_secret_id}) | |
| export VAULT_TOKEN | |
| mkdir -p ~/.local/share/juju | |
| vault read -field=controller_config "${VAULT_SECRET_PATH_COMMON}/controllers/juju-controller-36-production-ps6" | base64 -d > ~/.local/share/juju/controllers.yaml | |
| USERNAME=$(vault read -field=username "${VAULT_SECRET_PATH_ROLE}/juju") | |
| PASSWORD=$(vault read -field=password "${VAULT_SECRET_PATH_ROLE}/juju") | |
| printf "controllers:\n juju-controller-36-production-ps6:\n user: %s\n password: %s\n" "$USERNAME" "$PASSWORD" > ~/.local/share/juju/accounts.yaml | |
| - name: Deploy Application to production | |
| run: | | |
| export JUJU_MODEL=admin/prod-canonical-com | |
| juju refresh canonical-com --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju refresh canonical-com-blog --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju refresh canonical-com-careers --path ./canonical-com_ubuntu-22.04-amd64.charm --resource flask-app-image=${{ needs.publish-image.outputs.image_url }} | |
| juju wait-for application canonical-com --query='name=="canonical-com" && (status=="active" || status=="idle")' |