Run make update #47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run CI/CD | |
| on: | |
| merge_group: | |
| pull_request: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - backend/data/nest.json.gz | |
| - schema/* | |
| push: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - backend/data/nest.json.gz | |
| - schema/* | |
| release: | |
| types: | |
| - published | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| cancel-in-progress: true | |
| group: ${{ github.repository }}-${{ github.workflow }}-${{ github.ref }} | |
| env: | |
| DOCKERHUB_USERNAME: arkid15r | |
| FORCE_COLOR: 1 | |
| jobs: | |
| pre-commit: | |
| name: Check code quality | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Install Poetry | |
| run: pipx install poetry | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 | |
| with: | |
| cache: 'poetry' | |
| cache-dependency-path: backend/poetry.lock | |
| python-version: '3.13' | |
| - name: Run pre-commit | |
| uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Set up Node | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 | |
| with: | |
| node-version: 22 | |
| cache: 'pnpm' | |
| cache-dependency-path: frontend/pnpm-lock.yaml | |
| - name: Install frontend dependencies | |
| working-directory: frontend | |
| run: pnpm install --frozen-lockfile | |
| - name: Run pnpm format | |
| working-directory: frontend | |
| run: pnpm run format | |
| - name: Run pnpm lint check | |
| working-directory: frontend | |
| run: pnpm run lint:check | |
| - name: Check for uncommitted changes | |
| run: | | |
| git diff --exit-code || (echo 'Unstaged changes detected. \ | |
| Run `make check` and use `git add` to address it.' && exit 1) | |
| spellcheck: | |
| name: Run spell check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Run cspell | |
| run: | | |
| make check-spelling | |
| run-backend-tests: | |
| name: Run backend tests | |
| needs: | |
| - pre-commit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Set up Docker buildx | |
| uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 | |
| - name: Build backend test image | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 | |
| with: | |
| cache-from: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-backend:cache | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-backend:latest | |
| context: backend | |
| file: backend/docker/Dockerfile.test | |
| load: true | |
| platforms: linux/amd64 | |
| tags: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-backend:latest | |
| - name: Run backend tests | |
| run: | | |
| docker run -e DJANGO_CONFIGURATION=Test ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-backend:latest pytest | |
| run-frontend-unit-tests: | |
| name: Run frontend unit tests | |
| needs: | |
| - pre-commit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Set up Docker buildx | |
| uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 | |
| - name: Build frontend unit-testing image | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 | |
| with: | |
| cache-from: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-frontend-unit:cache | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-frontend-unit:latest | |
| context: frontend | |
| file: frontend/docker/Dockerfile.unit.test | |
| load: true | |
| platforms: linux/amd64 | |
| tags: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-frontend-unit:latest | |
| - name: Run frontend unit tests | |
| run: | | |
| docker run --env-file frontend/.env.example ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-frontend-unit:latest pnpm run test:unit | |
| run-frontend-e2e-tests: | |
| name: Run frontend e2e tests | |
| needs: | |
| - pre-commit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Set up Docker buildx | |
| uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 | |
| - name: Build frontend end-to-end testing image | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 | |
| with: | |
| cache-from: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-frontend-e2e:cache | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-frontend-e2e:latest | |
| context: frontend | |
| file: frontend/docker/Dockerfile.e2e.test | |
| load: true | |
| platforms: linux/amd64 | |
| tags: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-frontend-e2e:latest | |
| - name: Run frontend end-to-end tests | |
| run: | | |
| docker run --env-file frontend/.env.example ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-test-frontend-e2e:latest pnpm run test:e2e | |
| scan-code: | |
| name: Run Code Scan | |
| needs: | |
| - pre-commit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Run Trivy Repository Scan | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 | |
| with: | |
| scan-type: repo | |
| trivy-config: trivy.yaml | |
| scan-ci-dependencies: | |
| name: Run CI Denendencies Scan | |
| needs: | |
| - pre-commit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Run Trivy Filesystem Scan | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 | |
| with: | |
| scan-type: fs | |
| trivy-config: trivy.yaml | |
| build-staging-images: | |
| name: Build Staging Images | |
| environment: staging | |
| if: | | |
| github.repository == 'OWASP/Nest' && | |
| github.ref == 'refs/heads/main' | |
| needs: | |
| - run-backend-tests | |
| - run-frontend-e2e-tests | |
| - run-frontend-unit-tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 | |
| - name: Set up Docker buildx | |
| uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 | |
| with: | |
| username: ${{ env.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build backend image | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 | |
| with: | |
| cache-from: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:staging | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:staging-cache | |
| cache-to: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:staging-cache,mode=max | |
| context: backend | |
| file: backend/docker/Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:staging | |
| - name: Prepare frontend environment | |
| run: | | |
| touch frontend/.env | |
| echo "NEXT_PUBLIC_API_URL=${{ secrets.VITE_API_URL }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_CSRF_URL=${{ secrets.VITE_CSRF_URL }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_ENVIRONMENT=${{ secrets.VITE_ENVIRONMENT }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_GRAPHQL_URL=${{ secrets.VITE_GRAPHQL_URL }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_IDX_URL=${{ secrets.VITE_IDX_URL }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_RELEASE_VERSION=${{ github.event.release.tag_name }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_SENTRY_DSN=${{ secrets.VITE_SENTRY_DSN }}" >> frontend/.env | |
| echo "NEXT_SERVER_CSRF_URL=${{ secrets.NEXT_SERVER_CSRF_URL }}" >> frontend/.env | |
| echo "NEXT_SERVER_GRAPHQL_URL=${{ secrets.NEXT_SERVER_GRAPHQL_URL }}" >> frontend/.env | |
| - name: Build frontend image | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 | |
| with: | |
| cache-from: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:staging | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:staging-cache | |
| cache-to: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:staging-cache,mode=max | |
| context: frontend | |
| file: frontend/docker/Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:staging | |
| scan-staging-images: | |
| name: Scan Staging Images | |
| needs: | |
| - build-staging-images | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Scan backend image | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 | |
| with: | |
| exit-code: 1 | |
| image-ref: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:staging | |
| trivy-config: trivy.yaml | |
| - name: Scan frontend image | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 | |
| with: | |
| exit-code: 1 | |
| image-ref: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:staging | |
| trivy-config: trivy.yaml | |
| deploy-staging-nest: | |
| name: Deploy Nest Staging | |
| env: | |
| ANSIBLE_HOST_KEY_CHECKING: false | |
| NEST_HOST_IP_ADDRESS: ${{ secrets.NEST_HOST_IP_ADDRESS }} | |
| NEST_SSH_PRIVATE_KEY_PATH: ${{ vars.NEST_SSH_PRIVATE_KEY_PATH }} | |
| environment: staging | |
| if: | | |
| github.repository == 'OWASP/Nest' && | |
| github.ref == 'refs/heads/main' | |
| needs: | |
| - build-staging-images | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Prepare SSH key | |
| run: | | |
| mkdir -m 700 ~/.ssh | |
| echo "${{ secrets.NEST_SSH_PRIVATE_KEY }}" > ${{ env.NEST_SSH_PRIVATE_KEY_PATH }} | |
| chmod 400 ${{ env.NEST_SSH_PRIVATE_KEY_PATH }} | |
| - name: Prepare secrets | |
| run: | | |
| # Backend | |
| touch .env.backend | |
| echo "DJANGO_ALGOLIA_APPLICATION_ID=${{ secrets.DJANGO_ALGOLIA_APPLICATION_ID }}" >> .env.backend | |
| echo "DJANGO_ALGOLIA_WRITE_API_KEY=${{ secrets.DJANGO_ALGOLIA_WRITE_API_KEY }}" >> .env.backend | |
| echo "DJANGO_ALLOWED_HOSTS=${{ secrets.DJANGO_ALLOWED_HOSTS }}" >> .env.backend | |
| echo "DJANGO_AWS_ACCESS_KEY_ID=${{ secrets.DJANGO_AWS_ACCESS_KEY_ID }}" >> .env.backend | |
| echo "DJANGO_AWS_SECRET_ACCESS_KEY=${{ secrets.DJANGO_AWS_SECRET_ACCESS_KEY }}" >> .env.backend | |
| echo "DJANGO_CONFIGURATION=${{ secrets.DJANGO_CONFIGURATION }}" >> .env.backend | |
| echo "DJANGO_DB_HOST=${{ secrets.DJANGO_DB_HOST }}" >> .env.backend | |
| echo "DJANGO_DB_NAME=${{ secrets.DJANGO_DB_NAME }}" >> .env.backend | |
| echo "DJANGO_DB_PASSWORD=${{ secrets.DJANGO_DB_PASSWORD }}" >> .env.backend | |
| echo "DJANGO_DB_PORT=${{ secrets.DJANGO_DB_PORT }}" >> .env.backend | |
| echo "DJANGO_DB_USER=${{ secrets.DJANGO_DB_USER }}" >> .env.backend | |
| echo "DJANGO_OPEN_AI_SECRET_KEY=${{ secrets.DJANGO_OPEN_AI_SECRET_KEY }}" >> .env.backend | |
| echo "DJANGO_REDIS_HOST=${{ secrets.DJANGO_REDIS_HOST }}" >> .env.backend | |
| echo "DJANGO_REDIS_PASSWORD=${{ secrets.DJANGO_REDIS_PASSWORD }}" >> .env.backend | |
| echo "DJANGO_RELEASE_VERSION=$(date '+%y.%-m.%-d')-${GITHUB_SHA:0:7}" >> .env.backend | |
| echo "DJANGO_SECRET_KEY=${{ secrets.DJANGO_SECRET_KEY }}" >> .env.backend | |
| echo "DJANGO_SENTRY_DSN=${{ secrets.DJANGO_SENTRY_DSN }}" >> .env.backend | |
| echo "DJANGO_SETTINGS_MODULE=${{ secrets.DJANGO_SETTINGS_MODULE }}" >> .env.backend | |
| echo "DJANGO_SLACK_BOT_TOKEN=${{ secrets.DJANGO_SLACK_BOT_TOKEN }}" >> .env.backend | |
| echo "DJANGO_SLACK_SIGNING_SECRET=${{ secrets.DJANGO_SLACK_SIGNING_SECRET }}" >> .env.backend | |
| echo "GITHUB_TOKEN=${{ secrets.DJANGO_GITHUB_TOKEN }}" >> .env.backend | |
| # Cache | |
| touch .env.cache | |
| echo "REDIS_PASSWORD=${{ secrets.DJANGO_REDIS_PASSWORD }}" >> .env.cache | |
| # Database | |
| touch .env.db | |
| echo "POSTGRES_DB=${{ secrets.DJANGO_DB_NAME }}" >> .env.db | |
| echo "POSTGRES_PASSWORD=${{ secrets.DJANGO_DB_PASSWORD }}" >> .env.db | |
| echo "POSTGRES_USER=${{ secrets.DJANGO_DB_USER }}" >> .env.db | |
| - name: Run Nest deploy | |
| working-directory: .github/ansible | |
| run: ansible-playbook -i inventory.yaml staging/nest.yaml -e "github_workspace=$GITHUB_WORKSPACE" | |
| deploy-staging-nest-proxy: | |
| name: Deploy Staging Nest Proxy | |
| env: | |
| ANSIBLE_HOST_KEY_CHECKING: false | |
| PROXY_HOST_IP_ADDRESS: ${{ secrets.PROXY_HOST_IP_ADDRESS }} | |
| PROXY_SSH_PRIVATE_KEY_PATH: ${{ vars.PROXY_SSH_PRIVATE_KEY_PATH }} | |
| environment: staging | |
| if: | | |
| github.repository == 'OWASP/Nest' && | |
| github.ref == 'refs/heads/main' | |
| needs: | |
| - deploy-staging-nest | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Prepare SSH key | |
| run: | | |
| mkdir -m 700 ~/.ssh | |
| echo "${{ secrets.PROXY_SSH_PRIVATE_KEY }}" > ${{ env.PROXY_SSH_PRIVATE_KEY_PATH }} | |
| chmod 400 ${{ env.PROXY_SSH_PRIVATE_KEY_PATH }} | |
| - name: Run proxy deploy | |
| working-directory: .github/ansible | |
| run: ansible-playbook -i inventory.yaml staging/proxy.yaml -e "github_workspace=$GITHUB_WORKSPACE" | |
| build-docker-production-images: | |
| name: Build Docker Production Images | |
| environment: production | |
| if: | | |
| github.event_name == 'release' && | |
| github.event.action == 'published' | |
| needs: | |
| - run-backend-tests | |
| - run-frontend-e2e-tests | |
| - run-frontend-unit-tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 | |
| - name: Set up Docker buildx | |
| uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 | |
| with: | |
| username: ${{ env.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build backend image | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 | |
| with: | |
| cache-from: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:production | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:production-cache | |
| cache-to: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:production-cache,mode=max | |
| context: backend | |
| file: backend/docker/Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:production | |
| - name: Prepare frontend environment | |
| run: | | |
| touch frontend/.env | |
| echo "NEXT_PUBLIC_API_URL=${{ secrets.VITE_API_URL }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_CSRF_URL=${{ secrets.VITE_CSRF_URL }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_ENVIRONMENT=${{ secrets.VITE_ENVIRONMENT }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_GRAPHQL_URL=${{ secrets.VITE_GRAPHQL_URL }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_IDX_URL=${{ secrets.VITE_IDX_URL }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_RELEASE_VERSION=${{ github.event.release.tag_name }}" >> frontend/.env | |
| echo "NEXT_PUBLIC_SENTRY_DSN=${{ secrets.VITE_SENTRY_DSN }}" >> frontend/.env | |
| echo "NEXT_SERVER_CSRF_URL=${{ secrets.NEXT_SERVER_CSRF_URL }}" >> frontend/.env | |
| echo "NEXT_SERVER_GRAPHQL_URL=${{ secrets.NEXT_SERVER_GRAPHQL_URL }}" >> frontend/.env | |
| - name: Build frontend image | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 | |
| with: | |
| cache-from: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:production | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:production-cache | |
| cache-to: | | |
| type=registry,ref=${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:production-cache,mode=max | |
| context: frontend | |
| file: frontend/docker/Dockerfile | |
| platforms: linux/amd64 | |
| push: true | |
| tags: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:production | |
| scan-production-images: | |
| name: Scan Production Images | |
| needs: | |
| - build-docker-production-images | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Scan backend image | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 | |
| with: | |
| exit-code: 1 | |
| image-ref: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-backend:production | |
| trivy-config: trivy.yaml | |
| - name: Scan frontend image | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 | |
| with: | |
| exit-code: 1 | |
| image-ref: ${{ env.DOCKERHUB_USERNAME }}/owasp-nest-frontend:production | |
| trivy-config: trivy.yaml | |
| deploy-production-nest: | |
| name: Deploy Nest to Production | |
| env: | |
| ANSIBLE_HOST_KEY_CHECKING: false | |
| NEST_HOST_IP_ADDRESS: ${{ secrets.NEST_HOST_IP_ADDRESS }} | |
| NEST_SSH_PRIVATE_KEY_PATH: ${{ vars.NEST_SSH_PRIVATE_KEY_PATH }} | |
| environment: production | |
| if: | | |
| github.event_name == 'release' && | |
| github.event.action == 'published' | |
| needs: | |
| - build-docker-production-images | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Prepare SSH key | |
| run: | | |
| mkdir -m 700 ~/.ssh | |
| echo "${{ secrets.NEST_SSH_PRIVATE_KEY }}" > ${{ env.NEST_SSH_PRIVATE_KEY_PATH }} | |
| chmod 400 ${{ env.NEST_SSH_PRIVATE_KEY_PATH }} | |
| - name: Prepare secrets | |
| run: | | |
| # Backend | |
| touch .env.backend | |
| echo "DJANGO_ALGOLIA_APPLICATION_ID=${{ secrets.DJANGO_ALGOLIA_APPLICATION_ID }}" >> .env.backend | |
| echo "DJANGO_ALGOLIA_WRITE_API_KEY=${{ secrets.DJANGO_ALGOLIA_WRITE_API_KEY }}" >> .env.backend | |
| echo "DJANGO_ALLOWED_HOSTS=${{ secrets.DJANGO_ALLOWED_HOSTS }}" >> .env.backend | |
| echo "DJANGO_AWS_ACCESS_KEY_ID=${{ secrets.DJANGO_AWS_ACCESS_KEY_ID }}" >> .env.backend | |
| echo "DJANGO_AWS_SECRET_ACCESS_KEY=${{ secrets.DJANGO_AWS_SECRET_ACCESS_KEY }}" >> .env.backend | |
| echo "DJANGO_CONFIGURATION=${{ secrets.DJANGO_CONFIGURATION }}" >> .env.backend | |
| echo "DJANGO_DB_HOST=${{ secrets.DJANGO_DB_HOST }}" >> .env.backend | |
| echo "DJANGO_DB_NAME=${{ secrets.DJANGO_DB_NAME }}" >> .env.backend | |
| echo "DJANGO_DB_PASSWORD=${{ secrets.DJANGO_DB_PASSWORD }}" >> .env.backend | |
| echo "DJANGO_DB_PORT=${{ secrets.DJANGO_DB_PORT }}" >> .env.backend | |
| echo "DJANGO_DB_USER=${{ secrets.DJANGO_DB_USER }}" >> .env.backend | |
| echo "DJANGO_OPEN_AI_SECRET_KEY=${{ secrets.DJANGO_OPEN_AI_SECRET_KEY }}" >> .env.backend | |
| echo "DJANGO_REDIS_HOST=${{ secrets.DJANGO_REDIS_HOST }}" >> .env.backend | |
| echo "DJANGO_REDIS_PASSWORD=${{ secrets.DJANGO_REDIS_PASSWORD }}" >> .env.backend | |
| echo "DJANGO_RELEASE_VERSION=${{ github.event.release.tag_name }}" >> .env.backend | |
| echo "DJANGO_SECRET_KEY=${{ secrets.DJANGO_SECRET_KEY }}" >> .env.backend | |
| echo "DJANGO_SENTRY_DSN=${{ secrets.DJANGO_SENTRY_DSN }}" >> .env.backend | |
| echo "DJANGO_SETTINGS_MODULE=${{ secrets.DJANGO_SETTINGS_MODULE }}" >> .env.backend | |
| echo "DJANGO_SLACK_BOT_TOKEN=${{ secrets.DJANGO_SLACK_BOT_TOKEN }}" >> .env.backend | |
| echo "DJANGO_SLACK_SIGNING_SECRET=${{ secrets.DJANGO_SLACK_SIGNING_SECRET }}" >> .env.backend | |
| echo "GITHUB_TOKEN=${{ secrets.DJANGO_GITHUB_TOKEN }}" >> .env.backend | |
| # Cache | |
| touch .env.cache | |
| echo "REDIS_PASSWORD=${{ secrets.DJANGO_REDIS_PASSWORD }}" >> .env.cache | |
| # Database | |
| touch .env.db | |
| echo "POSTGRES_DB=${{ secrets.DJANGO_DB_NAME }}" >> .env.db | |
| echo "POSTGRES_PASSWORD=${{ secrets.DJANGO_DB_PASSWORD }}" >> .env.db | |
| echo "POSTGRES_USER=${{ secrets.DJANGO_DB_USER }}" >> .env.db | |
| - name: Run Nest deploy | |
| working-directory: .github/ansible | |
| run: ansible-playbook -i inventory.yaml production/nest.yaml -e "github_workspace=$GITHUB_WORKSPACE" | |
| deploy-production-nest-proxy: | |
| name: Deploy Production Nest Proxy | |
| env: | |
| ANSIBLE_HOST_KEY_CHECKING: false | |
| PROXY_HOST_IP_ADDRESS: ${{ secrets.PROXY_HOST_IP_ADDRESS }} | |
| PROXY_SSH_PRIVATE_KEY_PATH: ${{ vars.PROXY_SSH_PRIVATE_KEY_PATH }} | |
| environment: production | |
| if: | | |
| github.event_name == 'release' && | |
| github.event.action == 'published' | |
| needs: | |
| - deploy-production-nest | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 | |
| - name: Prepare SSH key | |
| run: | | |
| mkdir -m 700 ~/.ssh | |
| echo "${{ secrets.PROXY_SSH_PRIVATE_KEY }}" > ${{ env.PROXY_SSH_PRIVATE_KEY_PATH }} | |
| chmod 400 ${{ env.PROXY_SSH_PRIVATE_KEY_PATH }} | |
| - name: Run proxy deploy | |
| working-directory: .github/ansible | |
| run: ansible-playbook -i inventory.yaml production/proxy.yaml -e "github_workspace=$GITHUB_WORKSPACE" |