ci-infra/.github/workflows/osdc-deploy-prod.yml at 7a466cbbf442ee050df6af1984cd796ca07454b5 · pytorch/ci-infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: "OSDC: Deploy production"

# Manual rollout for prod. Protected by the `osdc-production` GitHub environment
# for both Meta and LF clusters. LF clusters pass `use_lf_credentials: true` to
# the reusable workflow, which selects LF_AWS_DEPLOY_ROLE_ARN over the Meta role.
#
# Default behavior (target = all): sequential rollout of all clusters.
#   Meta: arc-cbr-production-uw1 → arc-cbr-production → meta-prod-aws-ue1
#   LF:   lf-prod-aws-ue1 → lf-prod-aws-ue2 (runs in parallel with Meta)
#
# Use `all-meta` or `all-lf` to deploy only one account's clusters.
#
# Picking a specific cluster from the dropdown bypasses the sequencing and
# deploys only that one — useful for hotfixes or to recover from a partial
# rollout.
#
# Workflow-level concurrency prevents overlapping prod runs regardless of
# which target was chosen; a single-cluster dispatch waits for an in-flight
# `all` rollout to finish.
on:
  workflow_dispatch:
    inputs:
      target:
        description: "Cluster(s) to deploy"
        required: true
        type: choice
        default: all
        options:
          - all
          - all-meta
          - all-lf
          - arc-cbr-production-uw1
          - arc-cbr-production
          - meta-prod-aws-ue1
          - lf-prod-aws-ue1
          - lf-prod-aws-ue2
      taint_nodes:
        description: "Taint ARC runner nodes before deploy (graceful refresh)"
        required: false
        type: boolean
        default: false
      restart_listeners:
        description: "Delete and recreate ARC listeners (required when controller image changes)"
        required: false
        type: boolean
        default: false
      skip_lint_test:
        description: "Skip `just lint` and `just test` pre-flight checks (firefighting only)"
        required: false
        type: boolean
        default: false

concurrency:
  group: osdc-deploy-prod
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  # --- Meta clusters ---

  deploy_uw1:
    if: ${{ inputs.target == 'all' || inputs.target == 'all-meta' || inputs.target == 'arc-cbr-production-uw1' }}
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: arc-cbr-production-uw1
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  deploy_ue2:
    needs: deploy_uw1
    if: |
      !cancelled() && (
        inputs.target == 'arc-cbr-production' ||
        ((inputs.target == 'all' || inputs.target == 'all-meta') && needs.deploy_uw1.result == 'success')
      )
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: arc-cbr-production
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  deploy_ue1:
    needs: deploy_ue2
    if: |
      !cancelled() && (
        inputs.target == 'meta-prod-aws-ue1' ||
        ((inputs.target == 'all' || inputs.target == 'all-meta') && needs.deploy_ue2.result == 'success')
      )
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: meta-prod-aws-ue1
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  # --- LF clusters ---

  deploy_lf_ue1:
    if: ${{ inputs.target == 'all' || inputs.target == 'all-lf' || inputs.target == 'lf-prod-aws-ue1' }}
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: lf-prod-aws-ue1
      environment: osdc-production
      use_lf_credentials: true
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  deploy_lf_ue2:
    needs: deploy_lf_ue1
    if: |
      !cancelled() && (
        inputs.target == 'lf-prod-aws-ue2' ||
        ((inputs.target == 'all' || inputs.target == 'all-lf') && needs.deploy_lf_ue1.result == 'success')
      )
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: lf-prod-aws-ue2
      environment: osdc-production
      use_lf_credentials: true
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit