Separate deploy image build from push-time tests

Author: anth-volk

.env.example

@@ -1,6 +1,7 @@
-# Path to the Google_Application_Credentials file
-# Required to run the simulation API
-GOOGLE_APPLICATION_CREDENTIALS=/path/to/policyengine_gcp_credentials.json
+# For local development only, uncomment this if you need to point ADC at a
+# specific credential file. The deployed App Engine service uses its attached
+# service account instead.
+# GOOGLE_APPLICATION_CREDENTIALS=/path/to/policyengine_gcp_credentials.json
 
 # Password for connecting to the PolicyEngine database
 POLICYENGINE_DB_PASSWORD=policyengine_db_password
@@ -15,4 +16,4 @@ ANTHROPIC_API_KEY=policyengine_anthropic_api_key
 OPENAI_API_KEY=policyengine_openai_api_key
 
 # Token for Hugging Face models 
-HUGGING_FACE_TOKEN=policyengine_huggingface_token
+HUGGING_FACE_TOKEN=policyengine_huggingface_token

.github/scripts/build_app_engine_image.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+APP_ENGINE_IMAGE_TAG="${APP_ENGINE_IMAGE_TAG:-policyengine-api-app-engine:test}"
+
+cleanup() {
+  rm -f app.yaml Dockerfile start.sh .dbpw
+}
+
+trap cleanup EXIT
+
+bash .github/scripts/prepare_app_engine_bundle.sh
+
+docker build -t "${APP_ENGINE_IMAGE_TAG}" .

.github/scripts/deploy_app_engine_version.sh

@@ -8,15 +8,12 @@ APP_ENGINE_PROMOTE="${APP_ENGINE_PROMOTE:-0}"
 APP_ENGINE_SERVICE_ACCOUNT="${APP_ENGINE_SERVICE_ACCOUNT:-github-deployment@policyengine-api.iam.gserviceaccount.com}"
 
 cleanup() {
-  rm -f app.yaml Dockerfile start.sh .gac.json .dbpw
+  rm -f app.yaml Dockerfile start.sh .dbpw
 }
 
 trap cleanup EXIT
 
-python gcp/export.py
-cp gcp/policyengine_api/app.yaml .
-cp gcp/policyengine_api/Dockerfile .
-cp gcp/policyengine_api/start.sh .
+bash .github/scripts/prepare_app_engine_bundle.sh
 
 gcloud config set app/cloud_build_timeout 2400
 

.github/scripts/prepare_app_engine_bundle.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+python gcp/export.py
+cp gcp/policyengine_api/app.yaml .
+cp gcp/policyengine_api/Dockerfile .
+cp gcp/policyengine_api/start.sh .

.github/workflows/push.yml

@@ -128,6 +128,10 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y redis-server
+      - name: Start Redis
+        run: sudo systemctl start redis-server
       - name: Compute staging version name
         id: version
         run: |
@@ -139,6 +143,16 @@ jobs:
           service_account: "${{ secrets.GCP_DEPLOY_SERVICE_ACCOUNT }}"
       - name: Set up GCloud
         uses: "google-github-actions/setup-gcloud@v2"
+      - name: Install dependencies
+        run: make install
+      - name: Run push-time tests
+        run: make test
+        env:
+          POLICYENGINE_DB_PASSWORD: ${{ secrets.POLICYENGINE_DB_PASSWORD }}
+          POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN: ${{ secrets.POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
       - name: Validate App Engine deployment configuration
         run: bash .github/scripts/validate_app_engine_deploy_env.sh
         env:
@@ -147,6 +161,20 @@ jobs:
           GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
           GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}
           GATEWAY_AUTH_CLIENT_SECRET_RESOURCE: ${{ secrets.GATEWAY_AUTH_CLIENT_SECRET_RESOURCE }}
+      - name: Build staging deploy image
+        run: bash .github/scripts/build_app_engine_image.sh
+        env:
+          APP_ENGINE_IMAGE_TAG: policyengine-api:staging-${{ steps.version.outputs.version }}
+          POLICYENGINE_DB_PASSWORD: ${{ secrets.POLICYENGINE_DB_PASSWORD }}
+          POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN: ${{ secrets.POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
+          SIMULATION_API_URL: ${{ secrets.SIMULATION_API_URL }}
+          GATEWAY_AUTH_ISSUER: ${{ secrets.GATEWAY_AUTH_ISSUER }}
+          GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
+          GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}
+          GATEWAY_AUTH_CLIENT_SECRET_RESOURCE: ${{ secrets.GATEWAY_AUTH_CLIENT_SECRET_RESOURCE }}
       - name: Deploy staging version
         run: bash .github/scripts/deploy_app_engine_version.sh
         env:

Makefile

@@ -1,5 +1,7 @@
 install:
 	pip install -e ".[dev]"
+
+setup-env:
 	bash .github/setup_env.sh
 
 debug:

README.md

@@ -32,6 +32,7 @@ To contribute, clone the repository instead of forking it and then request to be
 
 ```
 make install
+make setup-env
 ```
 
 ### 4. Start a server on localhost to see your changes

changelog.d/separate-build-and-push-tests.changed.md

@@ -0,0 +1 @@
+Move push-time API tests out of the App Engine Docker build and run them in sequence within the staging deploy workflow before the actual deploy.

gcp/policyengine_api/Dockerfile

@@ -23,7 +23,7 @@ ADD . /app
 # Make start.sh executable
 RUN chmod +x /app/start.sh
 
-RUN cd /app && make install && make test
+RUN cd /app && make install
 
 # Use full path to start.sh
 CMD ["/bin/sh", "/app/start.sh"]