genie-space-cicd-example/ci-github-actions-deploy.yml at main · ryanbates99/genie-space-cicd-example · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# CI/CD: validate the bundle on every PR, promote on merge.
#
# TO ACTIVATE: move this file to .github/workflows/deploy.yml in your repo.
# (It is parked here at the repo root only because the token used to push this
# example lacked GitHub's `workflow` scope. Once it lives under
# .github/workflows/, GitHub Actions will pick it up automatically.)
#
# Flow:
#   - PR opened/updated  -> validate the bundle + dry-run the deploy (no mutation)
#   - merge to main      -> deploy bundle to staging, run the deploy job
#   - manual dispatch    -> promote to prod (gated by a GitHub Environment)
#
# Auth: this uses a Databricks service principal via OAuth (M2M). Set these as
# GitHub repo/environment secrets:
#   DATABRICKS_HOST           workspace URL for the target
#   DATABRICKS_CLIENT_ID      service principal application id
#   DATABRICKS_CLIENT_SECRET  service principal OAuth secret
# The Databricks CLI picks these up automatically from the environment.

name: genie-space-cicd

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      environment:
        description: "Target environment to promote to"
        required: true
        default: prod
        type: choice
        options: [staging, prod]

jobs:
  validate:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    env:
      DATABRICKS_HOST: ${{ secrets.DATABRICKS_HOST }}
      DATABRICKS_CLIENT_ID: ${{ secrets.DATABRICKS_CLIENT_ID }}
      DATABRICKS_CLIENT_SECRET: ${{ secrets.DATABRICKS_CLIENT_SECRET }}
    steps:
      - uses: actions/checkout@v4
      - uses: databricks/setup-cli@main
      - name: Validate bundle (staging target)
        run: databricks bundle validate -t staging
      - name: Dry-run deploy (no mutation)
        run: |
          pip install -r requirements.txt
          PYTHONPATH=src python src/deploy_space.py \
            --space spaces/sales_assistant.json --env staging --dry-run

  deploy-staging:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: staging
    env:
      DATABRICKS_HOST: ${{ secrets.DATABRICKS_HOST }}
      DATABRICKS_CLIENT_ID: ${{ secrets.DATABRICKS_CLIENT_ID }}
      DATABRICKS_CLIENT_SECRET: ${{ secrets.DATABRICKS_CLIENT_SECRET }}
    steps:
      - uses: actions/checkout@v4
      - uses: databricks/setup-cli@main
      - name: Deploy bundle to staging
        run: databricks bundle deploy -t staging
      - name: Run the promote job
        run: databricks bundle run deploy_genie_space -t staging

  deploy-prod:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    # Bind this job to a protected GitHub Environment that requires approval.
    environment: ${{ github.event.inputs.environment }}
    env:
      DATABRICKS_HOST: ${{ secrets.DATABRICKS_HOST }}
      DATABRICKS_CLIENT_ID: ${{ secrets.DATABRICKS_CLIENT_ID }}
      DATABRICKS_CLIENT_SECRET: ${{ secrets.DATABRICKS_CLIENT_SECRET }}
    steps:
      - uses: actions/checkout@v4
      - uses: databricks/setup-cli@main
      - name: Deploy bundle
        run: databricks bundle deploy -t ${{ github.event.inputs.environment }}
      - name: Run the promote job
        run: databricks bundle run deploy_genie_space -t ${{ github.event.inputs.environment }}