ci-infra/.github/workflows/_osdc-deploy.yml at f74c4584975d50614765b96d601282b859daec61 · pytorch/ci-infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
name: "~ OSDC: Deploy (reusable)"

on:
  workflow_call:
    inputs:
      cluster:
        description: "Cluster id from clusters.yaml (e.g. arc-staging, arc-cbr-production)"
        required: true
        type: string
      environment:
        description: "GitHub environment for deployment gating (empty = no gate)"
        required: false
        type: string
        default: ""
      taint_nodes:
        description: "Taint ARC runner nodes with NoSchedule before deploy for graceful refresh"
        required: false
        type: boolean
        default: true
      run_integration:
        description: "Run integration tests after deploy (requires CANARY_GITHUB_TOKEN)"
        required: false
        type: boolean
        default: true
      run_compactor:
        description: "Run compactor e2e tests after deploy"
        required: false
        type: boolean
        default: true
      skip_lint_test:
        description: "Skip `just lint` and `just test` pre-flight checks (firefighting only)"
        required: false
        type: boolean
        default: false
    secrets:
      META_AWS_ACC_ID:
        required: true
      META_AWS_DEPLOY_ROLE:
        description: "Role name in the Meta account to assume (caller picks staging vs prod)"
        required: true
      CANARY_GITHUB_TOKEN:
        description: "GitHub token for integration tests (required if run_integration=true)"
        required: false

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    name: Deploy ${{ inputs.cluster }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    timeout-minutes: 60
    defaults:
      run:
        working-directory: osdc
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install just
        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3.1.0

      - name: Install mise
        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
        with:
          install: true
          working_directory: osdc

      - name: Install Python dependencies
        run: uv sync

      - name: Lint
        if: ${{ !inputs.skip_lint_test }}
        run: just lint

      - name: Test
        if: ${{ !inputs.skip_lint_test }}
        run: just test

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
        with:
          role-to-assume: arn:aws:iam::${{ secrets.META_AWS_ACC_ID }}:role/${{ secrets.META_AWS_DEPLOY_ROLE }}
          aws-region: us-west-1
          role-duration-seconds: 7200

      - name: Deploy ${{ inputs.cluster }}
        run: just deploy "${{ inputs.cluster }}"
        env:
          OSDC_CONFIRM: "yes"
          # smoke runs as a dedicated job below, skip the in-deploy step
          OSDC_SMOKE: "no"
          OSDC_TAINT_NODES: ${{ inputs.taint_nodes && 'yes' || 'no' }}

  smoke:
    name: Smoke tests
    needs: deploy
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    timeout-minutes: 30
    defaults:
      run:
        working-directory: osdc
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install just
        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3.1.0

      - name: Install mise
        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
        with:
          install: true
          working_directory: osdc

      - name: Install Python dependencies
        run: uv sync

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
        with:
          role-to-assume: arn:aws:iam::${{ secrets.META_AWS_ACC_ID }}:role/${{ secrets.META_AWS_DEPLOY_ROLE }}
          aws-region: us-west-1
          role-duration-seconds: 7200

      - name: Run smoke tests
        run: just smoke "${{ inputs.cluster }}"

  compactor:
    name: Compactor e2e tests
    needs: deploy
    if: ${{ inputs.run_compactor }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    timeout-minutes: 30
    defaults:
      run:
        working-directory: osdc
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install just
        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3.1.0

      - name: Install mise
        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
        with:
          install: true
          working_directory: osdc

      - name: Install Python dependencies
        run: uv sync

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
        with:
          role-to-assume: arn:aws:iam::${{ secrets.META_AWS_ACC_ID }}:role/${{ secrets.META_AWS_DEPLOY_ROLE }}
          aws-region: us-west-1
          role-duration-seconds: 7200

      - name: Run compactor e2e tests
        run: just test-compactor "${{ inputs.cluster }}"

  integration:
    name: Integration tests
    needs: deploy
    if: ${{ inputs.run_integration }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    timeout-minutes: 60
    defaults:
      run:
        working-directory: osdc
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

      - name: Install just
        uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3.1.0

      - name: Install mise
        uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # v2.4.4
        with:
          install: true
          working_directory: osdc

      - name: Install Python dependencies
        run: uv sync

      - name: Verify gh CLI
        run: gh --version
        env:
          GH_TOKEN: ${{ secrets.CANARY_GITHUB_TOKEN }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
        with:
          role-to-assume: arn:aws:iam::${{ secrets.META_AWS_ACC_ID }}:role/${{ secrets.META_AWS_DEPLOY_ROLE }}
          aws-region: us-west-1
          role-duration-seconds: 7200

      - name: Run integration tests
        run: just integration-test "${{ inputs.cluster }}" --skip-drain --skip-smoke --skip-compactor
        env:
          GH_TOKEN: ${{ secrets.CANARY_GITHUB_TOKEN }}