Skip to content

Commit 779d635

Browse files
malessimalessi
authored
BFD-4188: Full Release and Deployment Workflow (#2757)
1 parent 204b727 commit 779d635

13 files changed

Lines changed: 743 additions & 8 deletions

‎.github/workflows/_deploy-env-service-layer.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ on:
2424
skip-applies:
2525
type: boolean
2626
required: true
27+
git-ref:
28+
type: string
29+
required: false
2730

2831
env:
2932
ACCOUNT_ROLE_MAP: |
@@ -47,7 +50,7 @@ jobs:
4750
uses: actions/checkout@v4
4851
with:
4952
fetch-depth: 0
50-
ref: ${{ github.ref_name }}
53+
ref: ${{ inputs.git-ref || github.ref }}
5154

5255
- name: Get role ARN
5356
id: get-role-arn

‎.github/workflows/_deploy-platform-service-layer.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# Not intended for use outside of the "Deploy Platform Services" Workflow. This is defined just
2+
# to make things a little DRYer
3+
4+
name: "Deploy Platform Service Layer"
5+
6+
on:
7+
workflow_call:
8+
inputs:
9+
account-type:
10+
type: string
11+
required: true
12+
matrix-json:
13+
type: string
14+
required: true
15+
layer-level:
16+
type: string
17+
required: true
18+
aws-region:
19+
type: string
20+
required: true
21+
skip-applies:
22+
type: boolean
23+
required: true
24+
git-ref:
25+
type: string
26+
required: false
27+
28+
env:
29+
ACCOUNT_ROLE_MAP: |
30+
{
31+
"prod": "${{ secrets.PROD_ACCOUNT_GHA_ROLE_ARN }}",
32+
"non-prod": "${{ secrets.NON_PROD_ACCOUNT_GHA_ROLE_ARN }}"
33+
}
34+
DEFAULT_LOG_GROUP: /bfd/platform/github_actions/deploy_platform_services/tofu
35+
36+
jobs:
37+
deploy-layer:
38+
if: ${{ fromJson(inputs.matrix-json)[inputs.layer-level] != fromJson('[]') }}
39+
strategy:
40+
matrix:
41+
context: ${{ fromJson(inputs.matrix-json)[inputs.layer-level] }}
42+
runs-on:
43+
- codebuild-bfd-${{ inputs.account-type }}-platform-${{ matrix.context.runner }}-${{ github.run_id }}-${{ github.run_attempt }}
44+
service:${{ matrix.context.service }}
45+
steps:
46+
- name: Checkout
47+
uses: actions/checkout@v4
48+
with:
49+
fetch-depth: 0
50+
ref: ${{ inputs.git-ref || github.ref }}
51+
52+
- name: Get role ARN
53+
id: get-role-arn
54+
run: |
55+
role_arn="$(jq -r --arg account_type "${{ inputs.account-type }}" '.[$account_type]' <<<"$ACCOUNT_ROLE_MAP")"
56+
57+
echo "::add-mask::$role_arn"
58+
echo "role-arn=$role_arn" >> "$GITHUB_OUTPUT"
59+
60+
- name: Configure AWS credentials
61+
uses: aws-actions/configure-aws-credentials@v4
62+
with:
63+
role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
64+
role-session-name: deploy-${{ matrix.context.layer }}-${{ matrix.context.service }}-${{ github.run_id }}-${{ github.run_attempt }}
65+
aws-region: ${{ inputs.aws-region }}
66+
67+
- name: Deploy ${{ matrix.context.service }}
68+
uses: ./.github/actions/bfd-deploy-platform-service
69+
with:
70+
account-type: ${{ inputs.account-type }}
71+
service-path: ops/platform/${{ matrix.context.layer }}-${{ matrix.context.service }}
72+
cw-log-group: ${{ env.DEFAULT_LOG_GROUP }}
73+
cw-log-stream: ${{ matrix.context.service }}-${{ github.run_id }}-${{ github.run_attempt }}
74+
skip-apply: ${{ inputs.skip-applies && 'true' || 'false' }}
75+

‎.github/workflows/build-release.yml‎

Lines changed: 48 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,52 @@ on:
3939
default: false
4040
required: false
4141
type: boolean
42+
workflow_call:
43+
inputs:
44+
releaseBranch:
45+
type: string
46+
description: >-
47+
releaseBranch: Override the branch on which a release is based.
48+
Default to the selected reference in the `Use workflow from` drop-down when empty.
49+
required: false
50+
default: ""
51+
releaseVersion:
52+
type: string
53+
description: >-
54+
releaseVersion: Override the release version. Default to promoting the current
55+
X.Y.Z-SNAPSHOT to X.Y.Z when empty.
56+
required: false
57+
default: ""
58+
developmentVersion:
59+
type: string
60+
description: >-
61+
developmentVersion: Override the next development iteration version.
62+
Default to X.(Y+1).0-SNAPSHOT of the release version X.Y.Z when empty.
63+
required: false
64+
default: ""
65+
awsRegion:
66+
type: string
67+
description: >-
68+
awsRegion: Override the AWS Region destination for uploaded artifacts.
69+
Default to `us-east-1`.
70+
default: us-east-1
71+
required: true
72+
forceRelease:
73+
type: boolean
74+
description: >-
75+
forceRelease: Override creation of the GitHub Release object.
76+
Default to creating release objects when `releaseVersion` does not contain the hyphen
77+
character ('-'), indicating a pre-release.
78+
default: false
79+
required: false
80+
outputs:
81+
bfd_release:
82+
description: The BFD release version that corresponds to the Git tag and GitHub release
83+
value: ${{ jobs.compute-version-strings.outputs.bfd_release }}
84+
bfd_dev_version:
85+
description: The BFD snapshot development version that corresponds to the next release version
86+
value: ${{ jobs.compute-version-strings.outputs.bfd_dev_version }}
87+
4288

4389
permissions:
4490
id-token: write # This is required for requesting the AWS IAM OIDC JWT
@@ -135,7 +181,6 @@ jobs:
135181
private-key: ${{ secrets.BFD_RELEASE_APP_KEY }}
136182

137183
- name: Checkout
138-
if: github.event_name == 'workflow_dispatch'
139184
uses: actions/checkout@v4
140185
with:
141186
fetch-depth: 0
@@ -190,7 +235,6 @@ jobs:
190235
EOF
191236
192237
- name: "Prepare Release"
193-
if: github.event_name == 'workflow_dispatch'
194238
run: |-
195239
# We set preparationGoals to an empty string because we don't want to build during the
196240
# release:prepare since we will need to build again during release:perform. We expect that the
@@ -207,7 +251,6 @@ jobs:
207251
GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
208252

209253
- name: "Perform Release"
210-
if: github.event_name == 'workflow_dispatch'
211254
run: |-
212255
mvn --batch-mode --activate-profiles perform-release \
213256
-Dtag="$BFD_RELEASE" \
@@ -336,7 +379,8 @@ jobs:
336379
bfd-platform-run-locust,
337380
bfd-platform-eft-sftp-outbound-transfer-lambda,
338381
bfd-platform-pipeline-ccw-manifests-verifier-lambda,
339-
bfd-platform-pipeline-ccw-runner
382+
bfd-platform-pipeline-ccw-runner,
383+
bfd-platform-codebuild-runner
340384
baseImagesVersion: ${{ needs.compute-version-strings.outputs.bfd_release }}
341385
cleanupImageArtifacts: false # We'll cleanup at the end of build-release, so don't do anything
342386
tagLatest: ${{ !contains(needs.compute-version-strings.outputs.bfd_release, '-') }}

‎.github/workflows/build_container_images_matrix.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,5 +52,11 @@
5252
"dockerfile": "ops/services/04-ccw-pipeline/lambda-src/ccw-runner/Dockerfile",
5353
"contextDir": "ops/services/04-ccw-pipeline/lambda-src/ccw-runner",
5454
"platform": "linux/arm64"
55+
},
56+
{
57+
"name": "bfd-platform-codebuild-runner",
58+
"dockerfile": "ops/images/bfd-platform-codebuild-runner/Dockerfile",
59+
"contextDir": "ops/images/bfd-platform-codebuild-runner",
60+
"platform": "linux/arm64"
5561
}
5662
]

‎.github/workflows/deploy-env-services.yml‎

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ on:
1212
config,
1313
cluster,
1414
database,
15-
eft,
1615
locust,
1716
migrator,
1817
ccw-pipeline,
@@ -41,6 +40,58 @@ on:
4140
default: false
4241
required: false
4342
type: boolean
43+
git-ref:
44+
description: >-
45+
The Git reference (branch, tag, commit, etc.) to use for deploy.
46+
Defaults to the selected branch/tag
47+
default: ""
48+
required: false
49+
workflow_call:
50+
inputs:
51+
bfd-env:
52+
type: string
53+
description: The BFD environment to deploy services to
54+
required: true
55+
services:
56+
type: string
57+
description: Comma-separated list of services to deploy
58+
default: >-
59+
config,
60+
cluster,
61+
database,
62+
locust,
63+
migrator,
64+
ccw-pipeline,
65+
npi-pipeline,
66+
rda-pipeline,
67+
server,
68+
ccw-pipeline-metrics,
69+
rda-pipeline-metrics,
70+
server-metrics,
71+
ccw-pipeline-alarms,
72+
rda-pipeline-alarms,
73+
server-alarms
74+
required: false
75+
aws-region:
76+
type: string
77+
description: >-
78+
Override the AWS Region
79+
default: us-east-1
80+
required: false
81+
skip-applies:
82+
type: boolean
83+
description: >-
84+
If true, skips the apply step for each Terraservice such that only the plans are generated
85+
default: false
86+
required: false
87+
git-ref:
88+
type: string
89+
description: >-
90+
The Git reference (branch, tag, commit, etc.) to use for deploy.
91+
Defaults to the selected branch/tag
92+
default: ""
93+
required: false
94+
4495

4596
permissions:
4697
id-token: write # This is required for requesting the AWS IAM OIDC JWT
@@ -135,6 +186,7 @@ jobs:
135186
matrix-json: ${{ needs.setup.outputs.deploy-jobs-matrix-json }}
136187
aws-region: ${{ inputs.aws-region }}
137188
skip-applies: ${{ inputs.skip-applies }}
189+
git-ref: ${{ inputs.git-ref || github.ref }}
138190
secrets: inherit
139191

140192
deploy-layer-02:
@@ -150,6 +202,7 @@ jobs:
150202
matrix-json: ${{ needs.setup.outputs.deploy-jobs-matrix-json }}
151203
aws-region: ${{ inputs.aws-region }}
152204
skip-applies: ${{ inputs.skip-applies }}
205+
git-ref: ${{ inputs.git-ref || github.ref }}
153206
secrets: inherit
154207

155208
deploy-layer-03:
@@ -180,6 +233,7 @@ jobs:
180233
matrix-json: ${{ needs.setup.outputs.deploy-jobs-matrix-json }}
181234
aws-region: ${{ inputs.aws-region }}
182235
skip-applies: ${{ inputs.skip-applies }}
236+
git-ref: ${{ inputs.git-ref || github.ref }}
183237
secrets: inherit
184238

185239
deploy-layer-05:
@@ -195,6 +249,7 @@ jobs:
195249
matrix-json: ${{ needs.setup.outputs.deploy-jobs-matrix-json }}
196250
aws-region: ${{ inputs.aws-region }}
197251
skip-applies: ${{ inputs.skip-applies }}
252+
git-ref: ${{ inputs.git-ref || github.ref }}
198253
secrets: inherit
199254

200255
deploy-layer-06:
@@ -210,4 +265,5 @@ jobs:
210265
matrix-json: ${{ needs.setup.outputs.deploy-jobs-matrix-json }}
211266
aws-region: ${{ inputs.aws-region }}
212267
skip-applies: ${{ inputs.skip-applies }}
268+
git-ref: ${{ inputs.git-ref || github.ref }}
213269
secrets: inherit

0 commit comments

Comments
 (0)