ci-infra/.github/workflows/osdc-deploy-prod.yml at d51d8f41557a1ada4e6acff16204621f83f5b9c3 · pytorch/ci-infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
name: "OSDC: Deploy production"

# Manual rollout for prod. Protected by the `osdc-production` GitHub
# environment (configure required reviewers in repo Settings → Environments) —
# the prod IAM role additionally trusts only tokens with
# `environment:osdc-production` in the sub claim, so IAM enforces the gate too.
#
# Default behavior (target = all): sequential rollout.
#   1. Deploy arc-cbr-production-uw1 + smoke.
#   2. Deploy arc-cbr-production (ue2) + smoke.
#   3. Deploy meta-prod-aws-ue1 + smoke.
#
# Picking a specific cluster from the dropdown bypasses the sequencing and
# deploys only that one — useful for hotfixes or to recover from a partial
# rollout.
#
# Workflow-level concurrency prevents overlapping prod runs regardless of
# which target was chosen; a single-cluster dispatch waits for an in-flight
# `all` rollout to finish.
on:
  workflow_dispatch:
    inputs:
      target:
        description: "Cluster(s) to deploy"
        required: true
        type: choice
        default: all
        options:
          - all
          - meta-prod-aws-ue1
          - arc-cbr-production-uw1
          - arc-cbr-production
      taint_nodes:
        description: "Taint ARC runner nodes before deploy (graceful refresh)"
        required: false
        type: boolean
        default: false
      restart_listeners:
        description: "Delete and recreate ARC listeners (required when controller image changes)"
        required: false
        type: boolean
        default: false
      skip_lint_test:
        description: "Skip `just lint` and `just test` pre-flight checks (firefighting only)"
        required: false
        type: boolean
        default: false

concurrency:
  group: osdc-deploy-prod
  cancel-in-progress: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy_uw1:
    if: ${{ inputs.target == 'all' || inputs.target == 'arc-cbr-production-uw1' }}
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: arc-cbr-production-uw1
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  deploy_ue2:
    needs: deploy_uw1
    if: |
      !cancelled() && (
        inputs.target == 'arc-cbr-production' ||
        (inputs.target == 'all' && needs.deploy_uw1.result == 'success')
      )
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: arc-cbr-production
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit

  deploy_ue1:
    needs: deploy_ue2
    if: |
      !cancelled() && (
        inputs.target == 'meta-prod-aws-ue1' ||
        (inputs.target == 'all' && needs.deploy_ue2.result == 'success')
      )
    uses: ./.github/workflows/_osdc-deploy.yml
    with:
      cluster: meta-prod-aws-ue1
      environment: osdc-production
      taint_nodes: ${{ inputs.taint_nodes }}
      restart_listeners: ${{ inputs.restart_listeners }}
      skip_lint_test: ${{ inputs.skip_lint_test }}
      run_smoke: true
    secrets: inherit