ever-rec/.github/workflows/deploy-do-dev.yml at develop · ever-co/ever-rec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: Deploy to DigitalOcean Dev

on:
  workflow_run:
    workflows: ["Build and Publish API Docker Images Dev"]
    branches: [develop]
    types:
      - completed

jobs:
  deploy-demo:
    if: ${{ vars.DO_ENABLED == 'true' }}
    runs-on: buildjet-4vcpu-ubuntu-2204

    environment: dev

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install doctl
        uses: digitalocean/action-doctl@v2
        with:
          token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}

      - name: Log in to DigitalOcean Container Registry with short-lived credentials
        run: doctl registry login --expiry-seconds 600

      - name: Save DigitalOcean kubeconfig with short-lived credentials
        run: doctl kubernetes cluster kubeconfig save --expiry-seconds 600 k8s-gauzy

      - name: Generate TLS Secrets
        run: |
          rm -f ${HOME}/ingress.api.crt ${HOME}/ingress.api.key ${HOME}/ingress.webapp.crt ${HOME}/ingress.webapp.key
          echo "${{ secrets.INGRESS_API_CERT }}" | base64 --decode > ${HOME}/ingress.api.crt
          echo "${{ secrets.INGRESS_API_CERT_KEY }}" | base64 --decode > ${HOME}/ingress.api.key
          echo "${{ secrets.INGRESS_WEBAPP_CERT }}" | base64 --decode > ${HOME}/ingress.webapp.crt
          echo "${{ secrets.INGRESS_WEBAPP_CERT_KEY }}" | base64 --decode > ${HOME}/ingress.webapp.key
          kubectl create secret tls apidev.rec.so-tls --save-config --dry-run=client --cert=${HOME}/ingress.api.crt --key=${HOME}/ingress.api.key -o yaml | kubectl --context do-sfo2-k8s-gauzy apply -f -
          kubectl create secret tls appdev.rec.so-tls --save-config --dry-run=client --cert=${HOME}/ingress.webapp.crt --key=${HOME}/ingress.webapp.key -o yaml | kubectl --context do-sfo2-k8s-gauzy apply -f -

      - name: Apply k8s manifests changes in DigitalOcean k8s cluster (if any)
        run: |
          envsubst < $GITHUB_WORKSPACE/.deploy/k8s/k8s-manifest.dev.yaml | kubectl --context do-sfo2-k8s-gauzy apply -f -
        env:
          CLOUD_PROVIDER: "DO"
          REC_JWT_SECRET: "${{ secrets.REC_JWT_SECRET }}"
          FIREBASE_API_KEY: "${{ secrets.FIREBASE_API_KEY }}"
          FIREBASE_AUTH_DOMAIN: "${{ secrets.FIREBASE_AUTH_DOMAIN }}"
          FIREBASE_DATABASE_URL: "${{ secrets.FIREBASE_DATABASE_URL }}"
          FIREBASE_PROJECT_ID: "${{ secrets.FIREBASE_PROJECT_ID }}"
          FIREBASE_STORAGE_BUCKET: "${{ secrets.FIREBASE_STORAGE_BUCKET }}"
          FIREBASE_MESSAGING_SENDER_ID: "${{ secrets.FIREBASE_MESSAGING_SENDER_ID }}"
          FIREBASE_APP_ID: "${{ secrets.FIREBASE_APP_ID }}"
          FIREBASE_MEASUREMENT_ID: "${{ secrets.FIREBASE_MEASUREMENT_ID }}"
          FIREBASE_ADMIN_PRIVATE_KEY: "${{ secrets.FIREBASE_ADMIN_PRIVATE_KEY }}"
          FIREBASE_ADMIN_CLIENT_EMAIL: "${{secrets.FIREBASE_ADMIN_CLIENT_EMAIL}}"
          SENTRY_DSN: "${{ secrets.SENTRY_DSN }}"
          SENTRY_TRACES_SAMPLE_RATE: "${{ secrets.SENTRY_TRACES_SAMPLE_RATE }}"
          SENTRY_PROFILE_SAMPLE_RATE: "${{ secrets.SENTRY_PROFILE_SAMPLE_RATE }}"
          SENTRY_HTTP_TRACING_ENABLED: "${{ secrets.SENTRY_HTTP_TRACING_ENABLED }}"
          SENTRY_POSTGRES_TRACKING_ENABLED: "${{ secrets.SENTRY_POSTGRES_TRACKING_ENABLED }}"
          SENTRY_PROFILING_ENABLED: "${{ secrets.SENTRY_PROFILING_ENABLED }}"

      # we need this step because for now we just use :latest tag
      # note: for production we will use different strategy later
      - name: Restart Pods to pick up :latest tag version
        run: |
          kubectl --context do-sfo2-k8s-gauzy rollout restart deployment/ever-rec-api-dev
          kubectl --context do-sfo2-k8s-gauzy rollout restart deployment/ever-rec-portal-dev