Skip to content

Commit 39bee66

Browse files
bd-apillaibd-apillai
authored
DEVOPS-8282: Added workflow file for Deployment (#1911)
1 parent 1d9bbd5 commit 39bee66

1 file changed

Lines changed: 208 additions & 0 deletions

File tree

‎.github/workflows/deploy.yml‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
name: Deploy openhub
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
workflow_dispatch:
8+
inputs:
9+
oh_config_branch:
10+
description: 'openhub-config branch'
11+
default: 'main'
12+
required: true
13+
chart_version:
14+
description: 'Deploy existing chart version (skips build)'
15+
required: false
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
21+
jobs:
22+
deploy:
23+
runs-on: ubuntu-latest
24+
concurrency:
25+
group: deploy-${{ github.ref_name }}
26+
cancel-in-progress: true
27+
steps:
28+
- name: Wait for concurrent runs to settle
29+
if: github.event_name == 'push'
30+
run: sleep 15
31+
32+
- name: Mask sensitive values
33+
run: |
34+
echo "::add-mask::${{ secrets.GCP_PROJECT_ID }}"
35+
echo "::add-mask::$GITHUB_WORKSPACE"
36+
37+
- name: Resolve Harness config
38+
id: harness
39+
run: |
40+
if [ "${{ github.ref_name }}" = 'main' ]; then
41+
echo "webhook_url=${{ secrets.HARNESS_WEBHOOK_URL_PROD }}" >> $GITHUB_OUTPUT
42+
else
43+
echo "webhook_url=${{ secrets.HARNESS_WEBHOOK_URL_STAGE }}" >> $GITHUB_OUTPUT
44+
fi
45+
46+
- name: Checkout ohloh-ui
47+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
48+
with:
49+
path: ohloh-ui
50+
51+
- name: Generate GitHub App token
52+
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
53+
id: app-token
54+
with:
55+
client-id: ${{ secrets.APP_ID }}
56+
private-key: ${{ secrets.APP_PRIVATE_KEY }}
57+
repositories: openhub-config
58+
skip-token-revoke: true
59+
60+
- name: Checkout openhub-config
61+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
62+
with:
63+
repository: blackducksoftware/openhub-config
64+
ref: ${{ inputs.oh_config_branch || 'main' }}
65+
token: ${{ steps.app-token.outputs.token }}
66+
path: openhub-config
67+
68+
- name: Revoke GitHub App token
69+
run: |
70+
curl -s -X DELETE \
71+
-H "Authorization: Bearer ${{ steps.app-token.outputs.token }}" \
72+
https://api.github.com/installation/token
73+
74+
- name: Authenticate to GCP via WIF
75+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
76+
with:
77+
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
78+
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
79+
access_token_lifetime: 180s
80+
81+
- name: Mask credentials path
82+
run: |
83+
echo "::add-mask::$GOOGLE_APPLICATION_CREDENTIALS"
84+
echo "::add-mask::$(basename $GOOGLE_APPLICATION_CREDENTIALS)"
85+
86+
- name: Set up gcloud
87+
uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
88+
89+
- name: Configure Docker for GAR
90+
run: gcloud auth configure-docker us-docker.pkg.dev --quiet
91+
92+
- name: Clean git credentials before Docker build
93+
run: |
94+
git -C ohloh-ui config --local --unset http.https://github.com/.extraheader || true
95+
git -C openhub-config config --local --unset http.https://github.com/.extraheader || true
96+
97+
- name: Build Docker images
98+
if: ${{ !inputs.chart_version }}
99+
run: |
100+
docker build --quiet --tag openhub:base -f openhub-config/docker/openhub-gcp/Dockerfile .
101+
docker build --quiet --tag openhub:latest -f openhub-config/docker/openhub-gcp/Dockerfile.oh .
102+
docker build --quiet --tag openhub:sidekiq -f openhub-config/docker/openhub-gcp/Dockerfile.sidekiq .
103+
docker build --quiet --tag openhub:offline -f openhub-config/docker/openhub-gcp/Dockerfile.offline .
104+
105+
- name: Resolve image version
106+
run: |
107+
if [ -n "${{ inputs.chart_version }}" ]; then
108+
echo "IMAGE_TAG=${{ inputs.chart_version }}" >> $GITHUB_ENV
109+
else
110+
gsutil cp gs://${{ secrets.GCS_BUCKET }}/${{ secrets.VERSION_FILE }} ${{ secrets.VERSION_FILE }}
111+
112+
MAJ_MIN_REV="$(cut -d. -f1-2 ${{ secrets.VERSION_FILE }})"
113+
PATCH_REV="$(cut -d. -f3 ${{ secrets.VERSION_FILE }} | cut -d- -f1)"
114+
115+
if [ "${{ github.ref_name }}" = 'main' ]; then
116+
PATCH_REV=$(($PATCH_REV + 1))
117+
NEXT_VERSION="${MAJ_MIN_REV}.${PATCH_REV}"
118+
else
119+
RC_REV="$(cut -d. -f4 ${{ secrets.VERSION_FILE }})"
120+
RC_REV=$(($RC_REV + 1))
121+
NEXT_VERSION="${MAJ_MIN_REV}.${PATCH_REV}-rc.$RC_REV"
122+
fi
123+
124+
echo $NEXT_VERSION > ${{ secrets.VERSION_FILE }}
125+
gsutil cp ${{ secrets.VERSION_FILE }} gs://${{ secrets.GCS_BUCKET }}/${{ secrets.VERSION_FILE }}
126+
echo "IMAGE_TAG=$NEXT_VERSION" >> $GITHUB_ENV
127+
fi
128+
129+
- name: Install Helm
130+
if: ${{ !inputs.chart_version }}
131+
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
132+
133+
- name: Push Helm charts
134+
if: ${{ !inputs.chart_version }}
135+
run: |
136+
gcloud auth print-access-token | \
137+
helm registry login -u oauth2accesstoken --password-stdin us-docker.pkg.dev
138+
139+
push_chart() {
140+
cd openhub-config/helm/$1
141+
142+
sed -Ei "s/^version: .+/version: $IMAGE_TAG/" Chart.yaml
143+
sed -Ei "s/^appVersion: .+/appVersion: $IMAGE_TAG/" Chart.yaml
144+
145+
helm package . >/dev/null
146+
[ $2 ] && prefix="openhub-$2" || prefix="openhub"
147+
helm push $prefix-$IMAGE_TAG.tgz oci://${{ secrets.GAR_CHARTS_REGISTRY }}
148+
149+
git checkout Chart.yaml
150+
rm openhub-*.tgz
151+
cd -
152+
}
153+
154+
push_chart openhub
155+
push_chart sidekiq sidekiq
156+
push_chart openhub-cron cron
157+
158+
- name: Push images to GAR
159+
if: ${{ !inputs.chart_version }}
160+
run: |
161+
docker rmi $(docker images | grep "${{ secrets.GAR_IMAGE_BASE }}/openhub" | awk '{print $3}') 2>/dev/null || true
162+
docker tag openhub:latest ${{ secrets.GAR_IMAGE_BASE }}/openhub:$IMAGE_TAG
163+
docker push --quiet "${{ secrets.GAR_IMAGE_BASE }}/openhub:$IMAGE_TAG" >/dev/null
164+
165+
docker rmi $(docker images | grep "${{ secrets.GAR_IMAGE_BASE }}/sidekiq" | awk '{print $3}') 2>/dev/null || true
166+
docker tag openhub:sidekiq ${{ secrets.GAR_IMAGE_BASE }}/sidekiq:$IMAGE_TAG
167+
docker push --quiet "${{ secrets.GAR_IMAGE_BASE }}/sidekiq:$IMAGE_TAG" >/dev/null
168+
169+
docker rmi "${{ secrets.GAR_IMAGE_BASE }}/offline:offline" 2>/dev/null || true
170+
docker tag openhub:offline ${{ secrets.GAR_IMAGE_BASE }}/offline:offline
171+
docker push --quiet "${{ secrets.GAR_IMAGE_BASE }}/offline:offline" >/dev/null
172+
173+
- name: SCA scan (BlackDuck Detect)
174+
if: ${{ github.ref_name == 'main' && !inputs.chart_version }}
175+
working-directory: ohloh-ui
176+
run: |
177+
(curl -s -L https://detect.synopsys.com/detect9.sh | bash -s -- \
178+
--blackduck.url=${{ secrets.BLACKDUCK_URL }} \
179+
--blackduck.api.token=${{ secrets.BLACKDUCK_TOKEN }} \
180+
--detect.project.name=${{ secrets.BLACKDUCK_PROJECT_NAME }} \
181+
--detect.project.version.name=${{ secrets.BLACKDUCK_PROJECT_VERSION }} \
182+
--detect.project.group.name=${{ secrets.BLACKDUCK_PROJECT_GROUP }}) >/dev/null
183+
184+
- name: SAST scan (Coverity)
185+
if: ${{ github.ref_name == 'main' && !inputs.chart_version }}
186+
working-directory: ohloh-ui
187+
run: |
188+
(curl -fLsS \
189+
--user ${{ secrets.COVERITY_USER }}:${{ secrets.COVERITY_PASS }} \
190+
"${{ secrets.COVERITY_SCAN_URL }}" \
191+
--data-urlencode "stream=${{ secrets.COVERITY_STREAM }}" \
192+
--data-urlencode "project=${{ secrets.COVERITY_PROJECT }}") >/dev/null
193+
194+
- name: Deploy via Harness
195+
run: |
196+
[ -z "${{ inputs.chart_version }}" ] && \
197+
echo 'Waiting for Harness to fetch the charts' && sleep 90
198+
199+
response=$(curl -s -X POST \
200+
-H 'content-type: application/json' \
201+
--url "${{ steps.harness.outputs.webhook_url }}" \
202+
-d "{\"version\":\"$IMAGE_TAG\"}")
203+
204+
if echo "$response" | grep -q 'status":"ERROR'; then
205+
echo "Deployment failed" && exit 1
206+
fi
207+
208+
echo "Harness deployment triggered successfully"

0 commit comments

Comments
 (0)