example-gitops-github-flow/.github/workflows/wi-test.yml at 2f33f888a19cc9b4d14dbd681a2a2d5ce3a0fb96 · RainbowDashy/example-gitops-github-flow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
name: Rollout (wi)
on:
  push:
    branches: ["wi-test"]
    paths: ["migrations/*.sql"]
env:
  BYTEBASE_URL: https://4932-103-137-247-74.ngrok-free.app/
  BYTEBASE_WORKLOAD_IDENTITY: wi@db333.workload.bytebase.com
  BYTEBASE_PROJECT: projects/db333
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build
        run: echo "Building..."
  create-rollout:
    needs: build
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    container:
      image: bytebase/bytebase-action
    outputs:
      bytebase-plan: ${{ steps.set-output.outputs.plan }}
    steps:
      - uses: actions/checkout@v4
      - name: Exchange token
        id: bytebase-auth
        run: |
          OIDC_TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=bytebase" | jq -r '.value')
          ACCESS_TOKEN=$(curl -s -X POST "$BYTEBASE_URL/v1/auth:exchangeToken" \
            -H "Content-Type: application/json" \
            -d "{\"token\":\"$OIDC_TOKEN\",\"email\":\"$BYTEBASE_WORKLOAD_IDENTITY\"}" \
            | jq -r '.accessToken')
          echo "access-token=$ACCESS_TOKEN" >> $GITHUB_OUTPUT
      - name: Create rollout
        run: |
          bytebase-action rollout \
            --url=$BYTEBASE_URL \
            --access-token=${{ steps.bytebase-auth.outputs.access-token }} \
            --project=$BYTEBASE_PROJECT \
            --targets=instances/dbdbdb/databases/db_0 \
            --file-pattern=migrations/*.sql \
            --output=${{ runner.temp }}/bytebase-metadata.json
      - name: Set output
        id: set-output
        run: |
          PLAN=$(jq -r .plan ${{ runner.temp }}/bytebase-metadata.json)
          echo "plan=$PLAN" >> $GITHUB_OUTPUT
  deploy-to-test:
    needs: create-rollout
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    environment: test
    container:
      image: bytebase/bytebase-action
    steps:
      - uses: actions/checkout@v4
      - name: Exchange token
        id: bytebase-auth
        run: |
          OIDC_TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=bytebase" | jq -r '.value')
          ACCESS_TOKEN=$(curl -s -X POST "$BYTEBASE_URL/v1/auth:exchangeToken" \
            -H "Content-Type: application/json" \
            -d "{\"token\":\"$OIDC_TOKEN\",\"email\":\"$BYTEBASE_WORKLOAD_IDENTITY\"}" \
            | jq -r '.accessToken')
          echo "access-token=$ACCESS_TOKEN" >> $GITHUB_OUTPUT
      - name: Deploy to test
        run: |
          bytebase-action rollout \
            --url=$BYTEBASE_URL \
            --access-token=${{ steps.bytebase-auth.outputs.access-token }} \
            --project=$BYTEBASE_PROJECT \
            --target-stage=environments/test \
            --plan=${{ needs.create-rollout.outputs.bytebase-plan }}
  deploy-to-prod:
    needs: [deploy-to-test, create-rollout]
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    environment: prod
    container:
      image: bytebase/bytebase-action
    steps:
      - uses: actions/checkout@v4
      - name: Exchange token
        id: bytebase-auth
        run: |
          OIDC_TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=bytebase" | jq -r '.value')
          ACCESS_TOKEN=$(curl -s -X POST "$BYTEBASE_URL/v1/auth:exchangeToken" \
            -H "Content-Type: application/json" \
            -d "{\"token\":\"$OIDC_TOKEN\",\"email\":\"$BYTEBASE_WORKLOAD_IDENTITY\"}" \
            | jq -r '.accessToken')
          echo "access-token=$ACCESS_TOKEN" >> $GITHUB_OUTPUT
      - name: Deploy to prod
        run: |
          bytebase-action rollout \
            --url=$BYTEBASE_URL \
            --access-token=${{ steps.bytebase-auth.outputs.access-token }} \
            --project=$BYTEBASE_PROJECT \
            --target-stage=environments/prod \
            --plan=${{ needs.create-rollout.outputs.bytebase-plan }}