Build

Merge branch 'main' into develop #501

Workflow file for this run

	name: Build

	on:
	push:
	branches:
	- develop
	- main
	- 'release/**'
	- 'feature/**'
	- 'issue/**'
	- 'issues/**'
	- 'dependabot/**'
	workflow_dispatch:

	env:
	REGISTRY: ghcr.io
	IMAGE_NAME: ${{ github.repository }}
	PYTHON_VERSION: '3.12'
	POETRY_VERSION: '2.3.2'
	TERRAFORM_VERSION: '1.5.3'

	jobs:
	build:
	name: Build, Test, and Publish
	runs-on: ubuntu-latest

	permissions:
	contents: write
	packages: write
	id-token: write

	outputs:
	new_version: ${{ steps.build-outputs.outputs.new_version }}
	pyproject_name: ${{ steps.build-outputs.outputs.pyproject_name }}
	target_env_uppercase: ${{ steps.build-outputs.outputs.target_env_uppercase }}
	target_env_lowercase: ${{ steps.build-outputs.outputs.target_env_lowercase }}
	source: ${{ steps.build-outputs.outputs.source }}

	steps:
	- uses: actions/checkout@v6
	with:
	fetch-depth: 0 # Needed for proper versioning

	- name: Setup Python
	uses: actions/setup-python@v6
	with:
	python-version: ${{ env.PYTHON_VERSION }}
	cache: 'pip'

	- name: Setup Poetry
	uses: abatilo/actions-poetry@v4
	with:
	poetry-version: ${{ env.POETRY_VERSION }}

	- name: Configure Poetry
	run: \|
	poetry config virtualenvs.in-project true

	- name: Cache Poetry dependencies
	uses: actions/cache@v4
	with:
	path: .venv
	key: poetry-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}

	- name: Version Management
	id: versioning
	run: \|
	current_version=$(poetry version -s)
	base_version=$(echo "$current_version" \| grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')
	pyproject_name=$(poetry version \| awk '{print $1}')

	# Version calculation based on branch
	if [[ "${{ github.ref }}" =~ ^refs/heads/(issue\|feature\|dependabot)/ ]]; then
	TIMESTAMP=$(date -u +"%Y%m%d%H%M")
	new_version="${base_version}a${TIMESTAMP}"
	echo "TARGET_ENV_UPPERCASE=SIT" >> $GITHUB_ENV
	elif [[ "${{ github.ref }}" == "refs/heads/develop" ]]; then
	echo "TARGET_ENV_UPPERCASE=SIT" >> $GITHUB_ENV
	new_version=$(poetry version prerelease -s)
	elif [[ "${{ github.ref }}" =~ ^refs/heads/release/ ]]; then
	echo "TARGET_ENV_UPPERCASE=UAT" >> $GITHUB_ENV
	if [[ ${current_version} =~ rc ]]; then
	new_version=$(poetry version prerelease -s)
	else
	new_version="${GITHUB_REF#refs/heads/release/}rc1"
	fi
	elif [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
	echo "TARGET_ENV_UPPERCASE=OPS" >> $GITHUB_ENV
	new_version=${base_version}
	fi

	echo "new_version=${new_version}" >> $GITHUB_ENV
	echo "pyproject_name=${pyproject_name}" >> $GITHUB_ENV
	poetry version ${new_version}

	- name: Run Snyk as a blocking step
	uses: snyk/actions/python@master
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
	with:
	command: test
	args: >
	--org=${{ secrets.SNYK_ORG_ID }}
	--project-name=${{ github.repository }}
	--severity-threshold=high
	--fail-on=all

	- name: Run Snyk on Python
	uses: snyk/actions/python@master
	env:
	SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
	with:
	command: monitor
	args: >
	--org=${{ secrets.SNYK_ORG_ID }}
	--project-name=${{ github.repository }}

	- name: Run Poetry
	run: \|
	poetry build
	poetry install
	poetry run pylint podaac
	poetry run flake8 podaac
	poetry run pytest --junitxml=build/reports/pytest.xml --cov=podaac/ --cov-report=html -m "not aws and not integration" tests/

	- name: Quick check for changes
	id: check_changes
	if: \|
	github.ref == 'refs/heads/develop' \|\|
	github.ref == 'refs/heads/main' \|\|
	startsWith(github.ref, 'refs/heads/release')
	run: \|
	if [ -n "$(git status --porcelain)" ]; then
	echo "changes=true" >> $GITHUB_OUTPUT
	else
	echo "changes=false" >> $GITHUB_OUTPUT
	fi

	- name: Commit Version Bump
	# If building develop, a release branch, or main then we commit the version bump back to the repo
	if: steps.check_changes.outputs.changes == 'true'
	run: \|
	git config user.name "${GITHUB_ACTOR}"
	git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
	git commit -am "/version ${{ env.new_version }}"
	git push

	- name: Push Tag
	env:
	VERSION: ${{ env.new_version }}
	if: \|
	github.ref == 'refs/heads/develop' \|\|
	github.ref == 'refs/heads/main' \|\|
	startsWith(github.ref, 'refs/heads/release')
	run: \|
	git config user.name "${GITHUB_ACTOR}"
	git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
	git tag -a "${VERSION}" -m "Version ${VERSION}"
	git push origin "${VERSION}"

	- name: Create Zip release
	run: \|
	cd terraform
	zip -r ../tig-terraform-${{ env.new_version }}.zip *

	- name: Upload Release Artifacts
	if: \|
	github.ref == 'refs/heads/develop' \|\|
	github.ref == 'refs/heads/main' \|\|
	startsWith(github.ref, 'refs/heads/release') \|\|
	github.event.head_commit.message == '/deploy sit' \|\|
	github.event.head_commit.message == '/deploy uat'
	uses: ncipollo/release-action@v1
	with:
	tag: ${{ env.new_version }}
	artifacts: "*.zip"
	token: ${{ secrets.GITHUB_TOKEN }}
	body: "Version ${{ env.new_version }}"
	makeLatest: "${{ github.ref == 'refs/heads/main' }}"
	prerelease: "${{ github.ref != 'refs/heads/main' }}"

	- name: Publish to test.pypi.org
	id: pypi-test-publish
	if: \|
	github.ref == 'refs/heads/develop' \|\|
	startsWith(github.ref, 'refs/heads/release') \|\|
	github.event.head_commit.message == '/deploy sit' \|\|
	github.event.head_commit.message == '/deploy uat'
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	repository-url: https://test.pypi.org/legacy/

	- name: Publish to pypi.org
	if: \|
	github.ref == 'refs/heads/main'
	id: pypi-publish
	uses: pypa/gh-action-pypi-publish@release/v1

	- name: Wait for package
	if: \|
	github.ref == 'refs/heads/develop' \|\|
	github.ref == 'refs/heads/main' \|\|
	startsWith(github.ref, 'refs/heads/release/') \|\|
	github.event.head_commit.message == '/deploy sit' \|\|
	github.event.head_commit.message == '/deploy uat'
	run: \|
	pip install tenacity logging
	python3 ${GITHUB_WORKSPACE}/.github/workflows/wait-for-pypi.py ${{env.pyproject_name}}[harmony]==${{ env.new_version }}

	- name: Deploy Env Override
	if: \|
	github.event.head_commit.message == '/deploy sit' \|\|
	github.event.head_commit.message == '/deploy uat'
	run: \|
	message="${{ github.event.head_commit.message }}"
	trimmed_message=${message:1} # Remove leading slash
	override_env=$(echo "$trimmed_message" \| grep -oE '[^[:space:]]+$')
	override_env_upper=$(echo "$trimmed_message" \| awk '{print toupper($NF)}')
	echo "THE_ENV=${override_env}" >> $GITHUB_ENV
	echo "TARGET_ENV_UPPERCASE=${override_env_upper}" >> $GITHUB_ENV

	- name: Lower Case Target Env
	run: \|
	original_env_value="${TARGET_ENV_UPPERCASE}"
	lowercase_value=$(echo "${original_env_value}" \| tr '[:upper:]' '[:lower:]')
	echo "TARGET_ENV_LOWERCASE=${lowercase_value}" >> $GITHUB_ENV

	- name: Set Build Source
	id: set-source
	run: \|
	# Use test PyPI package format (Dockerfile will find it via extra-index-url)
	echo "SOURCE=${{ env.pyproject_name }}==${{ env.new_version }}" >> $GITHUB_ENV

	- name: Set build outputs
	id: build-outputs
	run: \|
	echo "new_version=${{ env.new_version }}" >> $GITHUB_OUTPUT
	echo "pyproject_name=${{ env.pyproject_name }}" >> $GITHUB_OUTPUT
	echo "target_env_uppercase=${{ env.TARGET_ENV_UPPERCASE }}" >> $GITHUB_OUTPUT
	echo "target_env_lowercase=${{ env.TARGET_ENV_LOWERCASE }}" >> $GITHUB_OUTPUT
	echo "source=${{ env.SOURCE }}" >> $GITHUB_OUTPUT

	- name: Upload terraform zip artifact
	if: \|
	github.ref == 'refs/heads/develop' \|\|
	github.ref == 'refs/heads/main' \|\|
	startsWith(github.ref, 'refs/heads/release') \|\|
	github.event.head_commit.message == '/deploy sit' \|\|
	github.event.head_commit.message == '/deploy uat'
	uses: actions/upload-artifact@v4
	with:
	name: terraform-zip
	path: tig-terraform-${{ env.new_version }}.zip
	retention-days: 1

	deploy:
	name: Deploy Docker and Terraform
	runs-on: ubuntu-24.04-arm
	needs: build
	if: \|
	github.ref == 'refs/heads/develop' \|\|
	github.ref == 'refs/heads/main' \|\|
	startsWith(github.ref, 'refs/heads/release') \|\|
	github.event.head_commit.message == '/deploy sit' \|\|
	github.event.head_commit.message == '/deploy uat'
	permissions:
	contents: read
	packages: write
	id-token: write

	steps:
	- uses: actions/checkout@v6
	with:
	fetch-depth: 0

	- name: Set deployment variables from build outputs
	run: \|
	echo "NEW_VERSION=${{ needs.build.outputs.new_version }}" >> $GITHUB_ENV
	echo "PYPROJECT_NAME=${{ needs.build.outputs.pyproject_name }}" >> $GITHUB_ENV
	echo "TARGET_ENV_UPPERCASE=${{ needs.build.outputs.target_env_uppercase }}" >> $GITHUB_ENV
	echo "TARGET_ENV_LOWERCASE=${{ needs.build.outputs.target_env_lowercase }}" >> $GITHUB_ENV
	echo "SOURCE=${{ needs.build.outputs.source }}" >> $GITHUB_ENV

	- name: Log in to the Container registry
	uses: docker/login-action@v3
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Extract metadata (tags, labels) for Docker
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
	flavor: \|
	latest=${{ github.ref == 'refs/heads/main' }}
	tags: \|
	type=pep440,pattern={{version}},value=${{ env.NEW_VERSION }}
	type=raw,value=${{ env.TARGET_ENV_LOWERCASE }}

	- name: Build and Push Docker Image
	uses: docker/build-push-action@v6
	with:
	context: .
	file: ./docker/lambdaDockerfileArm
	push: true
	pull: true
	tags: ${{ steps.meta.outputs.tags }}
	labels: ${{ steps.meta.outputs.labels }}
	platforms: linux/arm64
	build-args: \|
	SOURCE=${{ env.SOURCE }}

	- name: Setup Terraform
	uses: hashicorp/setup-terraform@v3
	with:
	terraform_version: 1.5.3

	- name: Get Docker image tag
	id: docker-tag
	run: \|
	# Extract the first tag (version tag) from metadata output
	DOCKER_IMAGE_TAG=$(echo "${{ steps.meta.outputs.tags }}" \| head -n1)
	echo "DOCKER_IMAGE_TAG=${DOCKER_IMAGE_TAG}" >> $GITHUB_ENV
	echo "DOCKER_IMAGE_TAG=${DOCKER_IMAGE_TAG}" >> $GITHUB_OUTPUT

	- name: Deploy Terraform
	working-directory: terraform_deploy/
	env:
	AWS_ACCESS_KEY_ID: ${{ secrets[format('AWS_ACCESS_KEY_ID_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets[format('AWS_SECRET_ACCESS_KEY_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }}
	AWS_ACCOUNT_ID: ${{ secrets[format('AWS_ACCOUNT_ID_SERVICES_{0}', env.TARGET_ENV_UPPERCASE)] }}
	AWS_DEFAULT_REGION: us-west-2

	TF_VAR_tig_docker_image: ${{ env.DOCKER_IMAGE_TAG }}
	TF_VAR_EARTH_DATA_LOGIN_CLIENT_ID: ${{ secrets[format('EARTH_DATA_LOGIN_CLIENT_ID_{0}', env.TARGET_ENV_UPPERCASE)] }}
	TF_VAR_EARTH_DATA_LOGIN_PASSWORD: ${{ secrets[format('EARTH_DATA_LOGIN_PASSWORD_{0}', env.TARGET_ENV_UPPERCASE)] }}
	run: \|
	python3 override.py https://github.com/podaac/tig/releases/download/${{ env.NEW_VERSION }}/tig-terraform-${{ env.NEW_VERSION }}.zip "${{ env.DOCKER_IMAGE_TAG }}"
	source bin/config.sh ${{ env.TARGET_ENV_LOWERCASE }}
	terraform plan -var-file=tfvars/"${{ env.TARGET_ENV_LOWERCASE }}".tfvars -var="app_version=${{ env.NEW_VERSION }}" -out="tfplan"
	terraform apply -auto-approve tfplan > /dev/null

Navigation Menu

Uh oh!

Merge branch 'main' into develop #501

Workflow file

Merge branch 'main' into develop #501

Uh oh!

Workflow file for this run