dcubabot/.github/workflows/google-cloudrun-docker.yml at master · comcomUBA/dcubabot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
name: Build and Deploy to Cloud Run
on:
  push:
    branches:
      - master
  workflow_dispatch:

env:
  PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
  PROJECT_REGION: ${{ vars.GCP_PROJECT_REGION }}
  SERVICE_NAME: ${{ vars.GCP_SERVICE_API_NAME }}
  JOB_NAME: ${{ vars.GCP_SERVICE_API_NAME }}-update-groups
  ARTIFACT_REGISTRY: ${{ vars.GCP_ARTIFACT_REGISTRY }}

jobs:
  build-and-push:
    name: Build and Push to Artifact Registry
    runs-on: ubuntu-latest
    environment: GCP-Rozen
    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Authenticate Cloud CLI
        uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: 'google-github-actions/setup-gcloud@v2'

      - name: Authorize Docker push
        run: gcloud auth configure-docker ${{ env.PROJECT_REGION }}-docker.pkg.dev

      - name: Define image tag
        id: image_tag
        run: echo "TAG=${{ env.PROJECT_REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.ARTIFACT_REGISTRY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}" >> $GITHUB_ENV

      - name: Build and Push Docker Image
        run: |-
          docker build -t $TAG .
          docker push $TAG

  deploy-to-cloud-run:
    name: Deploy Service to Cloud Run
    needs: build-and-push
    runs-on: ubuntu-latest
    environment: GCP-Rozen
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - name: Authenticate Cloud CLI
        uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: 'google-github-actions/setup-gcloud@v2'

      - name: Define image tag for deployment
        id: image_tag
        run: echo "TAG=${{ env.PROJECT_REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.ARTIFACT_REGISTRY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}" >> $GITHUB_ENV

      - name: Get existing service URL
        id: get_url
        run: echo "URL=$(gcloud run services describe ${{ env.SERVICE_NAME }} --platform managed --region ${{ env.PROJECT_REGION }} --format 'value(status.url)')" >> $GITHUB_ENV

      - name: Deploy to Cloud Run
        run: |-
          gcloud run deploy ${{ env.SERVICE_NAME }} \
            --image $TAG \
            --region ${{ env.PROJECT_REGION }} \
            --service-account ${{ vars.GCP_SA_EMAIL }} \
            --memory=256Mi \
            --max-instances=${{ vars.GCP_SERVICE_API_MAX_INSTANCES }} \
            --set-secrets=TELEGRAM_BOT_TOKEN=${{ vars.GCP_SECRET_TG_BOT_TOKEN }}:latest \
            --set-secrets=DB_USER=${{ vars.GCP_SECRET_DB_USER }}:latest \
            --set-secrets=DB_PASSWORD=${{ vars.GCP_SECRET_DB_PASSWORD }}:latest \
            --set-secrets=DB_URL=${{ vars.GCP_SECRET_DB_URL }}:latest \
            --set-env-vars=DB_PORT=${{ vars.GCP_DB_PORT }} \
            --set-secrets=S3_ACCESS_ID=${{ vars.GCP_SECRET_S3_ACCESS_ID }}:latest \
            --set-secrets=S3_ACCESS_SECRET=${{ vars.GCP_SECRET_S3_ACCESS_SECRET }}:latest \
            --set-secrets=S3_HOST=${{ vars.GCP_SECRET_S3_HOST }}:latest \
            --set-env-vars=S3_BUCKET=${{ vars.GCP_S3_BUCKET }} \
            --set-env-vars=WEBHOOK_URL=${{ env.URL }} \
            --platform managed \
            --allow-unauthenticated

  deploy-and-schedule-job:
    name: Deploy and Schedule Job
    needs: build-and-push
    runs-on: ubuntu-latest
    environment: GCP-Rozen
    if: github.event_name == 'push'
    permissions:
      contents: 'read'
      id-token: 'write'

    steps:
      - name: Authenticate Cloud CLI
        uses: 'google-github-actions/auth@v2'
        with:
          credentials_json: ${{ secrets.GCP_SA_KEY }}

      - name: Set up Cloud SDK
        uses: 'google-github-actions/setup-gcloud@v2'

      - name: Define image tag for deployment
        run: echo "TAG=${{ env.PROJECT_REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.ARTIFACT_REGISTRY }}/${{ env.SERVICE_NAME }}:${{ github.sha }}" >> $GITHUB_ENV

      - name: Deploy Cloud Run Job
        run: |-
          gcloud run jobs deploy ${{ env.JOB_NAME }} \
            --image $TAG \
            --region ${{ env.PROJECT_REGION }} \
            --command=python \
            --args=cron.py \
            --service-account ${{ vars.GCP_SA_EMAIL }} \
            --set-secrets=TELEGRAM_BOT_TOKEN=${{ vars.GCP_SECRET_TG_BOT_TOKEN }}:latest \
            --set-secrets=DB_USER=${{ vars.GCP_SECRET_DB_USER }}:latest \
            --set-secrets=DB_PASSWORD=${{ vars.GCP_SECRET_DB_PASSWORD }}:latest \
            --set-secrets=DB_URL=${{ vars.GCP_SECRET_DB_URL }}:latest \
            --set-env-vars=DB_PORT=${{ vars.GCP_DB_PORT }}

      - name: Create or Update Cloud Scheduler Job
        run: |
          if gcloud scheduler jobs describe ${{ env.JOB_NAME }} --location=${{ env.PROJECT_REGION }} >/dev/null 2>&1; then
            echo "Updating existing Cloud Scheduler job"
            gcloud scheduler jobs update http ${{ env.JOB_NAME }} \
              --location=${{ env.PROJECT_REGION }} \
              --schedule="0 0 * * *" \
              --uri="https://${{ env.PROJECT_REGION }}-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ env.PROJECT_ID }}/jobs/${{ env.JOB_NAME }}:run" \
              --http-method=POST \
              --oauth-service-account-email=${{ vars.GCP_SA_EMAIL }}
          else
            echo "Creating new Cloud Scheduler job"
            gcloud scheduler jobs create http ${{ env.JOB_NAME }} \
              --location=${{ env.PROJECT_REGION }} \
              --schedule="0 0 * * *" \
              --time-zone="America/Argentina/Buenos_Aires" \
              --uri="https://${{ env.PROJECT_REGION }}-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ env.PROJECT_ID }}/jobs/${{ env.JOB_NAME }}:run" \
              --http-method=POST \
              --oauth-service-account-email=${{ vars.GCP_SA_EMAIL }}
          fi

      - name: Execute Cloud Run Job
        run: gcloud run jobs execute ${{ env.JOB_NAME }} --region ${{ env.PROJECT_REGION }}