-
Notifications
You must be signed in to change notification settings - Fork 14
chore: deployment for ArgoCD, backup and restore with Infisical #4942
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 29 commits
cbc5870
be21f3a
d6f8a27
8d0501d
c6e55e4
7ed9a34
0a04f51
e22fcfd
2256005
19559cb
5963141
6a722bc
c42d534
b76c54e
fb9b578
9e92f6d
349d184
133f2ba
4b5bb03
0071f29
48e18a2
2a45115
fe7e9aa
e53c785
dcf855a
543da53
6ceeafd
57b76b2
a76edcb
0c2fdbc
a6c945b
d5310d3
8ec019e
6d3e7b2
b51ae2b
5bc6c0c
ac5a7a6
4234288
b0fcae7
279c8f9
e027015
e50e310
22526c9
cd3cac5
cd014c5
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| name: Build Docker image for analytics (prd) | ||
|
|
||
| on: | ||
| push: | ||
| tags: ['v*.*.*'] | ||
| pull_request: | ||
| # branches: [ "v3" ] | ||
| types: [opened, synchronize, reopened, ready_for_review] | ||
| paths: | ||
| - 'apps/analytics/**' | ||
| - '.github/workflows/v3_analytics**' | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }} | ||
| cancel-in-progress: true | ||
|
|
||
| env: | ||
| REGISTRY: ghcr.io | ||
| IMAGE_NAME: ${{ github.repository }}/analytics | ||
|
|
||
| jobs: | ||
| build-arm: | ||
| if: github.event.pull_request.draft == false | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v3 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Update deprecated GitHub Actions to Node 20–compatible versions. Multiple actions are pinned to older majors targeting Node 16, which GitHub Actions no longer supports. Update to maintained majors. Apply these updates to both build-arm and build-amd jobs: - uses: actions/checkout@v3
+ uses: actions/checkout@v4
- uses: docker/setup-qemu-action@v2
+ uses: docker/setup-qemu-action@v3
- uses: docker/setup-buildx-action@v2
+ uses: docker/setup-buildx-action@v3
- uses: docker/login-action@v2
+ uses: docker/login-action@v3
- uses: docker/metadata-action@v4
+ uses: docker/metadata-action@v5Also applies to: 39-39, 42-42, 50-50, 55-55 🧰 Tools🪛 actionlint (1.7.8)30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Run util/sync-schema.sh | ||
| run: util/sync-schema.sh | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v2 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v2 | ||
|
|
||
| - name: Log into registry ${{ env.REGISTRY }} | ||
| uses: docker/login-action@v2 | ||
| with: | ||
| registry: ${{ env.REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
Comment on lines
+42
to
+46
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add event guard to registry login steps. The docker/login-action steps lack the event guard present in other workflows and should skip authentication for PR builds to avoid unnecessary credential usage. Apply this diff to both build-arm and build-amd jobs: - name: Log into registry ${{ env.REGISTRY }}
+ if: github.event_name != 'pull_request'
uses: docker/login-action@v2Also applies to: 84-88 🧰 Tools🪛 actionlint (1.7.8)42-42: the runner of "docker/login-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||
|
|
||
| - name: Extract Docker metadata | ||
| id: meta | ||
| uses: docker/metadata-action@v4 | ||
| with: | ||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-arm | ||
|
|
||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@v3 | ||
| with: | ||
| context: . | ||
| file: apps/analytics/Dockerfile | ||
| push: ${{ github.event_name != 'pull_request' }} | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| platforms: linux/arm64 | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| build-amd: | ||
| if: github.event.pull_request.draft == false | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Run util/sync-schema.sh | ||
| run: util/sync-schema.sh | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v2 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v2 | ||
|
|
||
| - name: Log into registry ${{ env.REGISTRY }} | ||
| uses: docker/login-action@v2 | ||
| with: | ||
| registry: ${{ env.REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Extract Docker metadata | ||
| id: meta | ||
| uses: docker/metadata-action@v4 | ||
| with: | ||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-amd | ||
|
|
||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@v3 | ||
| with: | ||
| context: . | ||
| file: apps/analytics/Dockerfile | ||
| push: ${{ github.event_name != 'pull_request' }} | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| platforms: linux/amd64 | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| name: Build Docker image for analytics (QA) | ||
| name: Build Docker image for analytics (stg) | ||
|
|
||
| on: | ||
| push: | ||
|
|
@@ -21,7 +21,7 @@ env: | |
| IMAGE_NAME: ${{ github.repository }}/analytics | ||
|
|
||
| jobs: | ||
| build: | ||
| build-arm: | ||
| if: github.event.pull_request.draft == false | ||
| runs-on: ubuntu-latest | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Push builds to Branch pushes don’t carry a Apply this diff in both jobs: - build-arm:
- if: github.event.pull_request.draft == false
+ build-arm:
+ if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
@@
- build-amd:
- if: github.event_pull_request.draft == false
+ build-amd:
+ if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseAlso applies to: 66-67 🤖 Prompt for AI Agents |
||
| permissions: | ||
|
|
@@ -51,7 +51,7 @@ jobs: | |
| id: meta | ||
| uses: docker/metadata-action@v4 | ||
| with: | ||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | ||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-arm | ||
|
|
||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@v3 | ||
|
|
@@ -60,4 +60,46 @@ jobs: | |
| file: apps/analytics/Dockerfile | ||
| push: ${{ github.event_name != 'pull_request' }} | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| platforms: linux/arm64 | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| build-amd: | ||
| if: github.event.pull_request.draft == false | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Run util/sync-schema.sh | ||
| run: util/sync-schema.sh | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v2 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v2 | ||
|
|
||
| - name: Log into registry ${{ env.REGISTRY }} | ||
| uses: docker/login-action@v2 | ||
| with: | ||
| registry: ${{ env.REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Extract Docker metadata | ||
| id: meta | ||
| uses: docker/metadata-action@v4 | ||
| with: | ||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-amd | ||
|
|
||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@v3 | ||
| with: | ||
| context: . | ||
| file: apps/analytics/Dockerfile | ||
| push: ${{ github.event_name != 'pull_request' }} | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| platforms: linux/amd64 | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,113 @@ | ||||||||||
| name: Build Docker image for auth (prd) | ||||||||||
|
|
||||||||||
| on: | ||||||||||
| push: | ||||||||||
| tags: ['v*.*.*'] | ||||||||||
| pull_request: | ||||||||||
| # branches: [ "v3" ] | ||||||||||
| types: [opened, synchronize, reopened, ready_for_review] | ||||||||||
| paths: | ||||||||||
| - 'apps/auth/**' | ||||||||||
| - '.github/workflows/v3_auth**' | ||||||||||
|
|
||||||||||
| concurrency: | ||||||||||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref_name }} | ||||||||||
| cancel-in-progress: true | ||||||||||
|
|
||||||||||
| env: | ||||||||||
| REGISTRY: ghcr.io | ||||||||||
| IMAGE_NAME: ${{ github.repository }}/auth | ||||||||||
|
|
||||||||||
| jobs: | ||||||||||
| build-arm: | ||||||||||
| if: github.event.pull_request.draft == false | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fix job guard to allow push events (CRITICAL). The condition Apply this diff to both job conditions: - if: github.event.pull_request.draft == false
+ if: github.event_name != 'pull_request' || github.event.pull_request.draft == falseAlso applies to: 70-70 🤖 Prompt for AI Agents |
||||||||||
| runs-on: ubuntu-latest | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Let push builds run by loosening the PR-only guard On push events - if: github.event.pull_request.draft == false
+ if: github.event_name != 'pull_request' || github.event.pull_request.draft == false📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||
| permissions: | ||||||||||
| contents: read | ||||||||||
| packages: write | ||||||||||
| steps: | ||||||||||
| - name: Checkout repository | ||||||||||
| uses: actions/checkout@v3 | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Update deprecated actions to Node 20–compatible releases. Multiple actions are pinned to older major versions targeting Node 16 runtime, which GitHub Actions runners no longer support. Update to the maintained majors that support Node 20. Apply this diff to upgrade all actions: - name: Checkout repository
- uses: actions/checkout@v3
+ uses: actions/checkout@v4
- name: Set up QEMU
- uses: docker/setup-qemu-action@v2
+ uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v2
+ uses: docker/setup-buildx-action@v3
- name: Log into registry ${{ env.REGISTRY }}
- uses: docker/login-action@v2
+ uses: docker/login-action@v3
- name: Extract Docker metadata
id: meta
- uses: docker/metadata-action@v4
+ uses: docker/metadata-action@v5
- name: Build and push Docker image
- uses: docker/build-push-action@v5
+ uses: docker/build-push-action@v6Note: Apply these same updates to both the Also applies to: 39-39, 42-42, 45-45, 53-53, 58-58, 77-77, 86-86, 89-89, 92-92, 100-100, 105-105 🧰 Tools🪛 actionlint (1.7.8)30-30: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||||||||||
|
|
||||||||||
| - name: Replace .env.production with .env.prd | ||||||||||
| shell: bash | ||||||||||
| run: | | ||||||||||
| rm apps/auth/.env.production | ||||||||||
| mv apps/auth/.env.prd apps/auth/.env.production | ||||||||||
|
|
||||||||||
| - name: Set up QEMU | ||||||||||
| uses: docker/setup-qemu-action@v2 | ||||||||||
|
|
||||||||||
| - name: Set up Docker Buildx | ||||||||||
| uses: docker/setup-buildx-action@v2 | ||||||||||
|
|
||||||||||
|
Comment on lines
+29
to
+43
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Update deprecated Actions to maintained majors. Align with actionlint guidance to avoid workflow breakage. - uses: actions/checkout@v3
+ uses: actions/checkout@v4
@@
- uses: docker/setup-qemu-action@v2
+ uses: docker/setup-qemu-action@v3
@@
- uses: docker/setup-buildx-action@v2
+ uses: docker/setup-buildx-action@v3
@@
- uses: docker/login-action@v2
+ uses: docker/login-action@v3
@@
- uses: docker/metadata-action@v4
+ uses: docker/metadata-action@v5
@@
- uses: docker/build-push-action@v5
+ uses: docker/build-push-action@v6Also applies to: 46-58, 59-69 🧰 Tools🪛 actionlint (1.7.7)32-32: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 41-41: the runner of "docker/setup-qemu-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 44-44: the runner of "docker/setup-buildx-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||||||||||
| - name: Log into registry ${{ env.REGISTRY }} | ||||||||||
| uses: docker/login-action@v2 | ||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Guard registry login by event type to prevent PR authentication. The login step lacks the event guard present in other workflows, which will attempt authentication on PR builds and may cause failures or credential leakage. Add the guard. Apply this diff to both build-arm and build-amd jobs: - name: Log into registry ${{ env.REGISTRY }}
+ if: github.event_name != 'pull_request'
uses: docker/login-action@v2Also applies to: 91-91 🧰 Tools🪛 actionlint (1.7.8)45-45: the runner of "docker/login-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||||||||||
| with: | ||||||||||
| registry: ${{ env.REGISTRY }} | ||||||||||
| username: ${{ github.actor }} | ||||||||||
| password: ${{ secrets.GITHUB_TOKEN }} | ||||||||||
|
Comment on lines
+44
to
+49
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Add event guard to registry login steps. The docker/login-action steps lack the event guard present in the build-push steps. Registry authentication should skip PR builds to prevent unnecessary credential usage and potential exposure. Apply this diff to both login steps: - name: Log into registry ${{ env.REGISTRY }}
+ if: github.event_name != 'pull_request'
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}Also applies to: 91-96 🧰 Tools🪛 actionlint (1.7.8)45-45: the runner of "docker/login-action@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||||||||||
|
|
||||||||||
| - name: Extract Docker metadata | ||||||||||
| id: meta | ||||||||||
| uses: docker/metadata-action@v4 | ||||||||||
| with: | ||||||||||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-arm | ||||||||||
|
|
||||||||||
| - name: Build and push Docker image | ||||||||||
| uses: docker/build-push-action@v5 | ||||||||||
| with: | ||||||||||
| context: . | ||||||||||
| file: apps/auth/Dockerfile | ||||||||||
| push: ${{ github.event_name != 'pull_request' }} | ||||||||||
| tags: ${{ steps.meta.outputs.tags }} | ||||||||||
| platforms: linux/arm64 | ||||||||||
| labels: ${{ steps.meta.outputs.labels }} | ||||||||||
| build-args: | | ||||||||||
| NEXT_PUBLIC_ENV=${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'staging' }} | ||||||||||
| build-amd: | ||||||||||
| if: github.event.pull_request.draft == false | ||||||||||
| runs-on: ubuntu-latest | ||||||||||
| permissions: | ||||||||||
| contents: read | ||||||||||
| packages: write | ||||||||||
| steps: | ||||||||||
| - name: Checkout repository | ||||||||||
| uses: actions/checkout@v3 | ||||||||||
|
|
||||||||||
| - name: Replace .env.production with .env.prd | ||||||||||
| shell: bash | ||||||||||
| run: | | ||||||||||
| rm apps/auth/.env.production | ||||||||||
| mv apps/auth/.env.prd apps/auth/.env.production | ||||||||||
|
|
||||||||||
| - name: Set up QEMU | ||||||||||
| uses: docker/setup-qemu-action@v2 | ||||||||||
|
|
||||||||||
| - name: Set up Docker Buildx | ||||||||||
| uses: docker/setup-buildx-action@v2 | ||||||||||
|
|
||||||||||
| - name: Log into registry ${{ env.REGISTRY }} | ||||||||||
| uses: docker/login-action@v2 | ||||||||||
| with: | ||||||||||
| registry: ${{ env.REGISTRY }} | ||||||||||
| username: ${{ github.actor }} | ||||||||||
| password: ${{ secrets.GITHUB_TOKEN }} | ||||||||||
|
|
||||||||||
| - name: Extract Docker metadata | ||||||||||
| id: meta | ||||||||||
| uses: docker/metadata-action@v4 | ||||||||||
| with: | ||||||||||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-amd | ||||||||||
|
|
||||||||||
| - name: Build and push Docker image | ||||||||||
| uses: docker/build-push-action@v5 | ||||||||||
| with: | ||||||||||
| context: . | ||||||||||
| file: apps/auth/Dockerfile | ||||||||||
| push: ${{ github.event_name != 'pull_request' }} | ||||||||||
| tags: ${{ steps.meta.outputs.tags }} | ||||||||||
| platforms: linux/amd64 | ||||||||||
| labels: ${{ steps.meta.outputs.labels }} | ||||||||||
| build-args: | | ||||||||||
| NEXT_PUBLIC_ENV=${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'staging' }} | ||||||||||
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Guard skips all non-PR executions
On tag pushes (the only way this workflow should ship images)
github.event.pull_requestisnull, sogithub.event.pull_request.draft == falseevaluates tofalseand both jobs are skipped. As a result, we never build or publish production images from release tags. Please gate the draft check so it only applies to PR events.Apply this diff in both jobs:
Also applies to: 64-65
🤖 Prompt for AI Agents