Job-is-BE/.github/workflows/deploy.yml at develop · Leets-Official/Job-is-BE · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: Deploy

on:
  push:
    branches:
      - develop
      - main

env:
  REGISTRY: ghcr.io

permissions:
  contents: read

concurrency:
  group: deploy-${{ github.ref_name }}
  cancel-in-progress: false

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'
      - name: Grant execute permission for gradlew
        run: chmod +x gradlew
      - name: Run tests
        run: ./gradlew test

  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.vars.outputs.image }}
      tag: ${{ steps.vars.outputs.tag }}
    steps:
      - uses: actions/checkout@v4
      - name: Compute lowercase image name and tag
        id: vars
        run: |
          echo "image=${REGISTRY}/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
          if [ "${{ github.ref_name }}" = "main" ]; then
            echo "tag=prod-latest" >> "$GITHUB_OUTPUT"
          else
            echo "tag=dev-latest" >> "$GITHUB_OUTPUT"
          fi
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64
          push: true
          tags: ${{ steps.vars.outputs.image }}:${{ steps.vars.outputs.tag }}

  deploy-dev:
    if: github.ref_name == 'develop'
    needs: build-and-push
    runs-on: ubuntu-latest
    environment: development
    env:
      AWS_REGION: us-east-1
      SG_ID: sg-04b6e6175adabdb30
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Whitelist runner IP for SSH
        run: |
          RUNNER_IP=$(curl -s https://api.ipify.org)
          echo "RUNNER_IP=$RUNNER_IP" >> "$GITHUB_ENV"
          aws ec2 authorize-security-group-ingress \
            --group-id "$SG_ID" \
            --protocol tcp --port 22 --cidr "${RUNNER_IP}/32"
      - name: Deploy to EC2 (dev)
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ubuntu
          key: ${{ secrets.EC2_SSH_KEY }}
          script: |
            cd /srv/jobis-dev
            docker compose pull
            docker compose up -d
      - name: Revoke runner IP from SSH
        if: always()
        run: |
          aws ec2 revoke-security-group-ingress \
            --group-id "$SG_ID" \
            --protocol tcp --port 22 --cidr "${RUNNER_IP}/32"

  deploy-prod:
    if: github.ref_name == 'main'
    needs: build-and-push
    runs-on: ubuntu-latest
    environment: production
    env:
      AWS_REGION: us-east-1
      SG_ID: sg-0a99d63a691fd07c8
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}
      - name: Whitelist runner IP for SSH
        run: |
          RUNNER_IP=$(curl -s https://api.ipify.org)
          echo "RUNNER_IP=$RUNNER_IP" >> "$GITHUB_ENV"
          aws ec2 authorize-security-group-ingress \
            --group-id "$SG_ID" \
            --protocol tcp --port 22 --cidr "${RUNNER_IP}/32"
      - name: Deploy to EC2 (prod)
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ubuntu
          key: ${{ secrets.EC2_SSH_KEY }}
          script: |
            cd /srv/jobis-prod
            docker compose pull
            docker compose up -d
      - name: Revoke runner IP from SSH
        if: always()
        run: |
          aws ec2 revoke-security-group-ingress \
            --group-id "$SG_ID" \
            --protocol tcp --port 22 --cidr "${RUNNER_IP}/32"