Skip to content

Commit 251ba9c

Browse files
stdavisstdavis
committed
ci: set up deploy cloudrun composite action
1 parent 1b6e29f commit 251ba9c

File tree

4 files changed

+162
-127
lines changed

4 files changed

+162
-127
lines changed

‎.github/actions/deploy-cloudrun/action.yml

+116
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
name: Deploy
2+
description: Deploy to GCP
3+
inputs:
4+
project_id:
5+
description: 'The GCP project ID'
6+
required: true
7+
identity_provider:
8+
description: 'The identity provider for the workload identity'
9+
required: true
10+
service_account_email:
11+
description: 'The service account email'
12+
required: true
13+
pause_schedule_job:
14+
description: 'Pause the scheduler job'
15+
required: false
16+
default: 'no'
17+
github_token:
18+
description: 'The GitHub token'
19+
required: true
20+
21+
runs:
22+
using: composite
23+
steps:
24+
- name: Set globals
25+
id: globals
26+
shell: bash
27+
run: |
28+
echo "TOPIC_NAME=backup-topic" >> "${GITHUB_OUTPUT}"
29+
echo "CRON=0 4 * * *" >> "${GITHUB_OUTPUT}"
30+
echo "JOB_NAME=nightly" >> "${GITHUB_OUTPUT}"
31+
echo "JOB_DESCRIPTION=Trigger the backup job every evening at 10 PM MDT" >> "${GITHUB_OUTPUT}"
32+
33+
- name: 🗝️ Authenticate to Google Cloud
34+
id: auth
35+
uses: google-github-actions/auth@v2
36+
with:
37+
token_format: access_token
38+
workload_identity_provider: ${{ inputs.identity_provider }}
39+
service_account: ${{ inputs.service_account_email }}
40+
41+
- name: 🐳 Set up Docker Buildx
42+
id: builder
43+
uses: docker/setup-buildx-action@v3
44+
45+
- name: 🗝️ Authenticate Docker to Google Cloud
46+
uses: docker/login-action@v3
47+
with:
48+
registry: us-central1-docker.pkg.dev
49+
username: oauth2accesstoken
50+
password: ${{ steps.auth.outputs.access_token }}
51+
52+
- name: 🏷️ Extract tags from GitHub
53+
id: meta
54+
uses: docker/metadata-action@v5
55+
with:
56+
github-token: ${{ inputs.github_token }}
57+
images: us-central1-docker.pkg.dev/${{ inputs.project_id }}/images/job
58+
tags: |
59+
type=ref,suffix=-{{sha}},event=branch
60+
type=ref,prefix=pr-,suffix=-{{sha}},event=pr
61+
type=semver,pattern={{version}}
62+
latest
63+
64+
- name: 📦 Build and push image
65+
uses: docker/build-push-action@v6
66+
with:
67+
builder: ${{ steps.builder.outputs.name }}
68+
tags: ${{ steps.meta.outputs.tags }}
69+
context: ./jobs
70+
file: ./Dockerfile
71+
push: true
72+
cache-from: type=gha
73+
cache-to: type=gha,mode=max
74+
provenance: false
75+
76+
- name: 🚀 Deploy Main Cloud Run Job
77+
id: deploy
78+
uses: google-github-actions/deploy-cloudrun@v2
79+
with:
80+
job: ${{ steps.globals.outputs.JOB_NAME }}
81+
image: us-central1-docker.pkg.dev/${{ inputs.project_id }}/images/job:latest
82+
timeout: 60m
83+
secrets: |
84+
/secrets/app/secrets.json=secrets:latest
85+
flags: |
86+
--memory=512Mi
87+
--service-account=cloud-run-sa@${{ inputs.project_id }}.iam.gserviceaccount.com
88+
89+
- name: 🕰️ Create Main Cloud Scheduler
90+
shell: bash
91+
run: |
92+
if [ ! "$(gcloud scheduler jobs list --location=us-central1 | grep ${{ steps.globals.outputs.JOB_NAME }})" ]; then
93+
gcloud scheduler jobs create http "${{ steps.globals.outputs.JOB_NAME }}" \
94+
--description="${{ steps.globals.outputs.JOB_DESCRIPTION }}" \
95+
--schedule="${{ steps.globals.outputs.CRON }}" \
96+
--time-zone=America/Denver \
97+
--location=us-central1 \
98+
--uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ inputs.project_id }}/jobs/${{ steps.globals.outputs.JOB_NAME }}:run" \
99+
--oauth-service-account-email=scheduler-sa@${{ inputs.project_id }}.iam.gserviceaccount.com \
100+
--quiet
101+
else
102+
gcloud scheduler jobs update http "${{ steps.globals.outputs.JOB_NAME }}" \
103+
--description="${{ steps.globals.outputs.JOB_DESCRIPTION }}" \
104+
--schedule="${{ steps.globals.outputs.CRON }}" \
105+
--time-zone=America/Denver \
106+
--location=us-central1 \
107+
--uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ inputs.project_id }}/jobs/${{ steps.globals.outputs.JOB_NAME }}:run" \
108+
--oauth-service-account-email=scheduler-sa@${{ inputs.project_id }}.iam.gserviceaccount.com \
109+
--quiet
110+
fi
111+
112+
- name: 🙅 Pause Scheduler Job
113+
shell: bash
114+
if: inputs.pause_schedule_job != 'no'
115+
run: |
116+
gcloud scheduler jobs pause "${{ steps.globals.outputs.JOB_NAME }}" --location=us-central1 --quiet

‎.github/workflows/push.yml

+32-34
Original file line numberDiff line numberDiff line change
@@ -119,37 +119,35 @@ jobs:
119119
- name: 🚀 Deploy to Cloud Run Job
120120
uses: google-github-actions/deploy-cloudrun@v2
121121
with:
122-
project_id: secrets.PROJECT_ID
123-
region: us-central1
124-
image: us-central1-docker.pkg.dev/${{ secrets.PROJECT_ID }}/images/job:latest
125-
job: default
126-
secrets: /secrets/app/secrets.json=skid-secrets:latest
127-
timeout: 3h
128-
flags: >
129-
'--cpu=1
130-
--memory=3Gi
131-
--service-account=cloud-run-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
132-
--timeout=3h
133-
--max-instances=1
134-
--max-retries=0
135-
--parallelism=0'
136-
137-
- name: 🕰️ Create Cloud Scheduler
138-
run: |
139-
if [ ! "$(gcloud scheduler jobs list --location=us-central1 | grep saturday-evening)" ]; then
140-
gcloud scheduler jobs create http saturday-evening \
141-
--description="Trigger the nfhl-skid bot once a week on saturday evening" \
142-
--schedule="0 3 * * 6" \
143-
--time-zone=America/Denver \
144-
--location=us-central1 \
145-
--uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ secrets.PROJECT_ID }}/jobs/default:run" \
146-
--oauth-service-account-email=scheduler-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
147-
else
148-
gcloud scheduler jobs update http saturday-evening \
149-
--description="Trigger the nfhl-skid bot once a week on saturday evening" \
150-
--schedule="0 3 * * 6" \
151-
--time-zone=America/Denver \
152-
--location=us-central1 \
153-
--uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ secrets.PROJECT_ID }}/jobs/default:run" \
154-
--oauth-service-account-email=scheduler-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
155-
fi
122+
identity-provider: ${{ secrets.IDENTITY_PROVIDER }}
123+
service-account-email: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}
124+
project-id: ${{ secrets.PROJECT_ID }}
125+
build-command: npm run build -- --mode dev
126+
env:
127+
VITE_FIREBASE_CONFIG: ${{ secrets.FIREBASE_CONFIG }}
128+
129+
deploy-cloudrun-dev:
130+
name: Deploy Cloud Run to dev
131+
runs-on: ubuntu-latest
132+
if: github.ref_name == 'dev'
133+
environment:
134+
name: dev
135+
permissions:
136+
id-token: write
137+
contents: read
138+
139+
steps:
140+
- name: ⬇️ Set up code
141+
uses: actions/checkout@v4
142+
with:
143+
show-progress: false
144+
145+
- name: 🚀 Deploy
146+
uses: ./.github/actions/deploy-cloudrun
147+
timeout-minutes: 15
148+
with:
149+
project_id: ${{ secrets.PROJECT_ID }}
150+
identity_provider: ${{ secrets.IDENTITY_PROVIDER }}
151+
service_account_email: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}
152+
pause_schedule_job: 'yes'
153+
github_token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release.yml

+10-93
Original file line numberDiff line numberDiff line change
@@ -9,113 +9,30 @@ concurrency:
99
cancel-in-progress: true
1010

1111
jobs:
12-
deploy-python-prod:
12+
deploy-cloudrun-prod:
1313
name: Deploy python production
1414
runs-on: ubuntu-latest
15-
if: github.ref == 'refs/heads/main'
15+
if: github.ref_name == 'main'
1616
environment:
1717
name: prod
1818
permissions:
1919
id-token: write
2020
contents: read
2121

2222
steps:
23-
- name: ⬇️ Checkout code
23+
- name: ⬇️ Set up code
2424
uses: actions/checkout@v4
2525
with:
2626
show-progress: false
2727

28-
- name: 🗝️ Authenticate to Google Cloud
29-
id: auth
30-
uses: google-github-actions/auth@v2
31-
with:
32-
workload_identity_provider: ${{ secrets.IDENTITY_PROVIDER }}
33-
service_account: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}
34-
token_format: 'access_token'
35-
36-
- name: 🐳 Set up Docker Buildx
37-
id: builder
38-
uses: docker/setup-buildx-action@v3
39-
40-
- name: 🗝️ Authenticate Docker to Google Cloud
41-
uses: docker/login-action@v3
42-
with:
43-
registry: us-central1-docker.pkg.dev
44-
username: oauth2accesstoken
45-
password: ${{ steps.auth.outputs.access_token }}
46-
47-
- name: 🏷️ Extract tags from GitHub
48-
id: meta
49-
uses: docker/metadata-action@v5
50-
with:
51-
github-token: ${{ secrets.GITHUB_TOKEN }}
52-
images: us-central1-docker.pkg.dev/${{ secrets.PROJECT_ID }}/images/job
53-
tags: |
54-
type=ref,suffix=-{{sha}},event=branch
55-
type=ref,prefix=pr-,suffix=-{{sha}},event=pr
56-
type=semver,pattern={{version}}
57-
latest
58-
59-
- name: 📦 Build and push image
60-
uses: docker/build-push-action@v6
28+
- name: 🚀 Deploy
29+
uses: ./.github/actions/deploy-cloudrun
30+
timeout-minutes: 15
6131
with:
62-
builder: ${{ steps.builder.outputs.name }}
63-
tags: ${{ steps.meta.outputs.tags }}
64-
context: .
65-
file: ./Dockerfile
66-
push: true
67-
cache-from: type=gha
68-
cache-to: type=gha,mode=max
69-
provenance: false
70-
71-
- name: ☁️ Set up Cloud SDK
72-
uses: google-github-actions/setup-gcloud@v2
73-
74-
- name: 🚀 Deploy to Cloud Run Job
75-
run: |
76-
if [ ! "$(gcloud run jobs list | grep default)" ]; then
77-
gcloud run jobs create default \
78-
--region us-central1 \
79-
--image us-central1-docker.pkg.dev/${{ secrets.PROJECT_ID }}/images/job:latest \
80-
--service-account cloud-run-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com \
81-
--memory=3Gi \
82-
--cpu=1 \
83-
--max-retries 0 \
84-
--parallelism 0 \
85-
--set-secrets=/secrets/app/secrets.json=skid-secrets:latest \
86-
--task-timeout 3h
87-
else
88-
gcloud run jobs update default \
89-
--region us-central1 \
90-
--image us-central1-docker.pkg.dev/${{ secrets.PROJECT_ID }}/images/job:latest \
91-
--service-account cloud-run-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com \
92-
--memory=3Gi \
93-
--cpu=1 \
94-
--max-retries 0 \
95-
--parallelism 0 \
96-
--set-secrets=/secrets/app/secrets.json=skid-secrets:latest \
97-
--task-timeout 3h
98-
fi
99-
100-
- name: 🕰️ Create Cloud Scheduler
101-
run: |
102-
if [ ! "$(gcloud scheduler jobs list --location=us-central1 | grep saturday-evening)" ]; then
103-
gcloud scheduler jobs create http saturday-evening \
104-
--description="Trigger the nfhl-skid bot once a week on saturday evening" \
105-
--schedule="0 3 * * 6" \
106-
--time-zone=America/Denver \
107-
--location=us-central1 \
108-
--uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ secrets.PROJECT_ID }}/jobs/default:run" \
109-
--oauth-service-account-email=scheduler-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
110-
else
111-
gcloud scheduler jobs update http saturday-evening \
112-
--description="Trigger the nfhl-skid bot once a week on saturday evening" \
113-
--schedule="0 3 * * 6" \
114-
--time-zone=America/Denver \
115-
--location=us-central1 \
116-
--uri="https://us-central1-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${{ secrets.PROJECT_ID }}/jobs/default:run" \
117-
--oauth-service-account-email=scheduler-sa@${{ secrets.PROJECT_ID }}.iam.gserviceaccount.com
118-
fi
32+
project_id: ${{ secrets.PROJECT_ID }}
33+
identity_provider: ${{ secrets.IDENTITY_PROVIDER }}
34+
service_account_email: ${{ secrets.SERVICE_ACCOUNT_EMAIL }}
35+
github_token: ${{ secrets.GITHUB_TOKEN }}
11936

12037
deploy-firebase-prod:
12138
name: Deploy Firebase project to production

‎.vscode/settings.json

+4
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
{
22
"cSpell.words": [
3+
"accesstoken",
34
"appspot",
5+
"Buildx",
6+
"cloudrun",
47
"dotenv",
58
"firestore",
69
"fromitem",
10+
"gserviceaccount",
711
"instafail",
812
"orgid",
913
"prebuild",

0 commit comments

Comments
 (0)