Merge branch 'develop'

Author: alexandre.teilhet

.github/workflows/build.docker.yml

@@ -1,8 +1,5 @@
 name: build.docker.image.cortex
 on:
-  pull_request:
-    types:
-      - labeled
   workflow_dispatch:
     inputs:
       is_prod:
@@ -15,6 +12,10 @@ on:
         description: "Publish docker image in dockerhub?"
         type: boolean
         default: false
+      override_version:
+        description: "Override version tag (e.g., pr-60 for pull requests)"
+        type: string
+        required: false
     outputs:
       image_id:
         description: "ImageId of the docker image"
@@ -49,7 +50,6 @@ jobs:
         id: get_version
 
   build:
-    if: ${{ github.event.label.name == 'docker:build' || github.event_name == 'workflow_dispatch' }}
     needs:
       - prepare
     permissions:
@@ -61,7 +61,7 @@ jobs:
       image_id: ${{ steps.push.outputs.imageid }}
       image_digest: ${{ steps.push.outputs.digest }}
       image_metadata: ${{ steps.push.outputs.metadata }}
-      image_version: ${{ needs.prepare.outputs.image_version }}
+      image_version: ${{ inputs.override_version || needs.prepare.outputs.image_version }}
     steps:
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -140,8 +140,24 @@ jobs:
             infra/data/ci/dockerhub username   | DOCKERHUB_USERNAME;
             infra/data/ci/dockerhub token      | DOCKERHUB_TOKEN;
 
-      - name: Generate full docker tags
-        id: meta
+      - name: Generate docker tags for PR builds
+        if: ${{ inputs.override_version != '' }}
+        id: meta_pr
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            name=${{ vars.SB_GHCR }}/cortex
+          tags: |
+            type=raw,value=${{ inputs.override_version }}
+          labels: |
+            org.opencontainers.image.title=cortex
+            org.opencontainers.image.description=A Powerful Observable Analysis and Active Response Engine
+            org.opencontainers.image.vendor=StrangeBee
+            org.opencontainers.image.version=${{ inputs.override_version }}
+
+      - name: Generate full docker tags for releases
+        if: ${{ inputs.override_version == '' }}
+        id: meta_release
         uses: docker/metadata-action@v4
         with:
           images: |
@@ -180,5 +196,5 @@ jobs:
           context: target/docker/stage
           push: true
           platforms: linux/amd64,linux/arm64
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ inputs.override_version != '' && steps.meta_pr.outputs.tags || steps.meta_release.outputs.tags }}
+          labels: ${{ inputs.override_version != '' && steps.meta_pr.outputs.labels || steps.meta_release.outputs.labels }}

.github/workflows/deploy.nomad.yml

@@ -12,7 +12,7 @@ on:
         description: "If true, pull will be done from thehiveproject/cortex docker hub repo"
         default: false
   pull_request:
-    types: [ labeled ]
+    types: [ labeled, synchronize ]
 
 # Here we define if we should go with a pr-XXX deployment version, or a vXXX (release) version
 # this depends on the event name
@@ -22,11 +22,21 @@ env:
   deployment_version: ${{ github.event_name == 'pull_request' && format('{0}-{1}', 'pr', github.event.number) || format('{0}{1}', 'v', inputs.docker_image_version) }}
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: deploy-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+  build:
+    if: ${{ (github.event.label.name == 'ci:deploy' || contains(github.event.pull_request.labels.*.name, 'ci:deploy')) || github.event_name == 'workflow_dispatch' }}
+    uses: ./.github/workflows/build.docker.yml
+    with:
+      is_prod: false
+      override_version: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || '' }}
+    secrets: inherit
+
   prepare:
+    needs:
+      - build
     runs-on:
       - linux
     outputs:
@@ -50,7 +60,7 @@ jobs:
           DV2=$(echo $DV | sed 's/\.//g')
           echo rewriten_deployment_version=$(echo $DV2 | sed 's/-//g') >> $GITHUB_OUTPUT
   deploy:
-    if: ${{ github.event.label.name == 'ci:deploy' || github.event_name == 'workflow_dispatch' }}
+    if: ${{ (github.event.label.name == 'ci:deploy' || contains(github.event.pull_request.labels.*.name, 'ci:deploy')) || github.event_name == 'workflow_dispatch' }}
     needs:
       - prepare
     permissions:
@@ -70,20 +80,64 @@ jobs:
           secrets: |
             /nomad-dev/creds/developers-token-dev secret_id | NOMAD_TOKEN;
       - uses: actions/checkout@v4
+
+      - name: Setup Nomad CLI
+        uses: hashicorp/setup-nomad@main
+
       - name: Setup `nomad-pack`
         uses: hashicorp/setup-nomad-pack@main
         id: setup
+
+      - name: Verify installations
+        run: |
+          nomad version
+          nomad-pack version
+
       - name: Deploy job using Nomad Pack
         id: run
         # We pass two different version variables: one for Docker pull, the other for Nomad services
         run: |
-          nomad-pack run -var from_docker_hub=${{ inputs.from_docker_hub }} \
+          nomad-pack run -var from_docker_hub=${{ inputs.from_docker_hub || false }} \
                          -var docker_image="${{ vars.SB_GHCR }}/cortex" \
-                         -var docker_image_version=${{ inputs.docker_image_version || env.deployment_version }} \
+                         -var docker_image_version=${{ needs.build.outputs.image_version || inputs.docker_image_version || env.deployment_version }} \
                          -var service_version=${{ needs.prepare.outputs.expected_deployment_version }} ./deployment/nomad/packs/cortex
         env:
           NOMAD_ADDR: "http://10.30.4.180:4646"
           NOMAD_TOKEN: "${{ env.NOMAD_TOKEN }}"
+
+      - name: Wait for deployment to be healthy
+        run: |
+          JOB_NAME="cortex-${{ needs.prepare.outputs.expected_deployment_version }}"
+          echo "Waiting for deployment of job: $JOB_NAME"
+
+          # Get the latest deployment ID
+          DEPLOYMENT_ID=$(nomad job deployments -json "$JOB_NAME" | jq -r '.[0].ID')
+
+          if [ "$DEPLOYMENT_ID" = "null" ] || [ -z "$DEPLOYMENT_ID" ]; then
+            echo "No deployment found for job $JOB_NAME"
+            exit 1
+          fi
+
+          echo "Monitoring deployment: $DEPLOYMENT_ID"
+
+          # Monitor the deployment status with polling every 10 seconds
+          nomad deployment status -monitor -wait 10s "$DEPLOYMENT_ID"
+
+          # Check final deployment status
+          DEPLOYMENT_STATUS=$(nomad deployment status -json "$DEPLOYMENT_ID" | jq -r '.Status')
+
+          if [ "$DEPLOYMENT_STATUS" = "successful" ]; then
+            echo "✅ Deployment completed successfully!"
+            exit 0
+          else
+            echo "❌ Deployment failed with status: $DEPLOYMENT_STATUS"
+            exit 1
+          fi
+        env:
+          NOMAD_ADDR: "http://10.30.4.180:4646"
+          NOMAD_TOKEN: "${{ env.NOMAD_TOKEN }}"
+        continue-on-error: false
+
   setup:
     needs:
       - prepare

deployment/nomad/packs/cortex/variables.hcl

@@ -60,7 +60,7 @@ variable "docker_image_version" {
 variable "from_docker_hub" {
   description = "if we should deploy from Docker hub instead of ghcr.io"
   type        = bool
-  default     = "false"
+  default     = false
 }
 
 variable "service_version" {

package/docker/entrypoint

@@ -169,7 +169,7 @@ then
 
   chown -R cortex:cortex "$CONFIG_FILE" /etc/cortex
   test -e /var/run/docker.sock && chown cortex:cortex /var/run/docker.sock
-  su - cortex -c "/opt/cortex/bin/cortex \
+  su -m cortex -c "/opt/cortex/bin/cortex \
     -Dconfig.file=$CONFIG_FILE \
     -Dlogger.file=/etc/cortex/logback.xml \
     -Dpidfile.path=/dev/null \

project/plugins.sbt

@@ -14,4 +14,4 @@ Seq[(String, ModuleID)](
 
 // The Play plugin
 addSbtPlugin("org.playframework" % "sbt-plugin"   % "3.0.9")
-addSbtPlugin("org.scalameta"     % "sbt-scalafmt" % "2.5.5")
+addSbtPlugin("org.scalameta"     % "sbt-scalafmt" % "2.5.5")

version.sbt

@@ -1 +1 @@
-ThisBuild / version := "4.0.0-1"
+ThisBuild / version := "4.0.1-1"