build(deps): bump org.keycloak:keycloak-services from 26.6.1 to 26.6.… #139
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Container Image Deployment CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - v*.*.* | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| env: | |
| - ${{ startsWith(github.ref, 'refs/tags/v') && 'off-auth-org' || 'off-auth-net' }} | |
| environment: ${{ matrix.env }} | |
| concurrency: ${{ matrix.env }} | |
| steps: | |
| - name: Set various variable for staging deployment | |
| if: matrix.env == 'off-auth-net' | |
| run: | | |
| echo "SSH_PROXY_HOST=ovh1.openfoodfacts.org" >> $GITHUB_ENV | |
| echo "SSH_USERNAME=off" >> $GITHUB_ENV | |
| echo "SSH_PROXY_USERNAME=off" >> $GITHUB_ENV | |
| echo "SSH_HOST=10.1.0.200" >> $GITHUB_ENV | |
| echo "KC_HOSTNAME=https://auth.openfoodfacts.net" >> $GITHUB_ENV | |
| echo "KC_DB_URL_HOST=postgresql" >> $GITHUB_ENV | |
| echo "REDIS_URL=redis://redis:6379" >> $GITHUB_ENV | |
| echo "COMMON_NET_NAME=po_webnet" >> $GITHUB_ENV | |
| echo "KEYCLOAK_STARTUP=staging" >> $GITHUB_ENV | |
| - name: Set various variable for production deployment | |
| if: matrix.env == 'off-auth-org' | |
| run: | | |
| echo "SSH_PROXY_HOST=scaleway-02.infra.openfoodfacts.org" >> $GITHUB_ENV | |
| echo "SSH_USERNAME=off" >> $GITHUB_ENV | |
| echo "SSH_PROXY_USERNAME=off" >> $GITHUB_ENV | |
| echo "SSH_HOST=10.13.1.200" >> $GITHUB_ENV | |
| echo "KC_HOSTNAME=https://auth.openfoodfacts.org" >> $GITHUB_ENV | |
| # for now this is the stunnel | |
| echo "KC_DB_URL_HOST=10.13.1.101" >> $GITHUB_ENV | |
| echo "REDIS_URL=10.13.1.200:6379" >> $GITHUB_ENV | |
| echo "COMMON_NET_NAME=common_net" >> $GITHUB_ENV | |
| echo "KEYCLOAK_STARTUP=prod" >> $GITHUB_ENV | |
| - name: Wait for container build workflow | |
| uses: fountainhead/action-wait-for-check@v1.2.0 | |
| id: wait-build | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| checkName: push-images | |
| ref: ${{ github.sha }} | |
| intervalSeconds: 30 | |
| timeoutSeconds: 2400 # 40m | |
| - name: Do something if build fail | |
| if: steps.wait-build.outputs.conclusion == 'failure' | |
| run: echo fail && false # fail if build fail | |
| - name: Do something if build timeout | |
| if: steps.wait-build.outputs.conclusion == 'timed_out' | |
| run: echo Timeout && false # fail if build time out | |
| - name: Checkout git repository | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_PROXY_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script: | | |
| # Clone Git repository if not already there | |
| [ ! -d '${{ matrix.env}}' ] && git clone --depth 1 https://github.com/${{ github.repository }} ${{ matrix.env }} --no-single-branch 2>&1 | |
| # Go to repository directory | |
| cd ${{ matrix.env}} | |
| # Fetch newest commits (in case it wasn't freshly cloned) | |
| git fetch --depth 1 | |
| # Checkout current commit SHA | |
| git checkout -qf ${{ github.sha }} | |
| - name: Set environment variables | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_PROXY_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script: | | |
| # Go to repository directory | |
| cd ${{ matrix.env}} | |
| # Set environment variables | |
| echo "KC_BOOTSTRAP_ADMIN_USERNAME=root" > .env | |
| echo "KC_BOOTSTRAP_ADMIN_PASSWORD=${{ secrets.KC_BOOTSTRAP_ADMIN_PASSWORD }}" >> .env | |
| echo "KC_HOSTNAME=${{ env.KC_HOSTNAME }}" >> .env | |
| echo "KEYCLOAK_REALM_NAME=openfoodfacts" >> .env | |
| echo "COMPOSE_PROJECT_NAME=openfoodfacts-auth" >> .env | |
| echo "COMPOSE_PATH_SEPARATOR=," >> .env | |
| echo "COMPOSE_FILE=docker-compose.yml,docker/prod.yml" >> .env | |
| echo "PG_BOOTSTRAP_USERNAME=bootstrap" >> .env | |
| echo "PG_BOOTSTRAP_PASSWORD=${{ secrets.PG_BOOTSTRAP_PASSWORD }}" >> .env | |
| echo "KC_DB_URL_HOST=${{ env.KC_DB_URL_HOST }}" >> .env | |
| echo "KC_DB_USERNAME=keycloak" >> .env | |
| echo "KC_DB_PASSWORD=${{ secrets.KC_DB_PASSWORD }}" >> .env | |
| echo "REDIS_URL=${{ env.REDIS_URL }}" >> .env | |
| echo "SMTP_SERVER=in-v3.mailjet.com" >> .env | |
| echo "SMTP_PORT=587" >> .env | |
| echo "SMTP_AUTH=true" >> .env | |
| echo "SMTP_USER=${{ secrets.SMTP_USER }}" >> .env | |
| echo "SMTP_PASSWORD=${{ secrets.SMTP_PASSWORD }}" >> .env | |
| echo "KEYCLOAK_HTTP_PORT=5600" >> .env | |
| echo "KEYCLOAK_MANAGEMENT_PORT=5602" >> .env | |
| echo "KEYCLOAK_STARTUP=${{env.KEYCLOAK_STARTUP}}" >> .env | |
| echo "KEYCLOAK_TAG=sha-${{ github.sha }}" >> .env | |
| echo "RESTART_POLICY=always" >> .env | |
| echo "COMMON_NET_NAME=${{ env.COMMON_NET_NAME }}" >> .env | |
| - name: Create staging database and user | |
| if: matrix.env == 'off-auth-net' | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_PROXY_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script: | | |
| # Need to run this from shared-net so that script can access the bootstrap password | |
| cd shared-net | |
| make create_user username=keycloak password=${{ secrets.KC_DB_PASSWORD }} | |
| - name: Create production database and user | |
| if: matrix.env == 'off-auth-org' | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_PROXY_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script: | | |
| cd ${{ matrix.env }} | |
| make create_user_prod | |
| - name: Create common net | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_PROXY_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script: | | |
| cd ${{ matrix.env }} | |
| # if common net exists, it won't fail | |
| make create_common_net | |
| - name: Start services | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_PROXY_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script: | | |
| cd ${{ matrix.env }} | |
| make _up | |
| - name: Cleanup obsolete Docker objects | |
| uses: appleboy/ssh-action@master | |
| if: ${{ always() }} | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_PROXY_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script: | | |
| cd ${{ matrix.env }} | |
| make prune | |