infra/.github/workflows/ci.yml at 3b1187a55985948d50aee0e197e4482402d92bc8 · trakrf/infra · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: ci

on:
  pull_request:
  push:
    branches: [main]

jobs:
  tofu-fmt:
    name: tofu fmt
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: opentofu/setup-opentofu@v1
        with:
          tofu_version_file: .opentofu-version
      - run: tofu fmt -check -recursive
        working-directory: terraform

  tofu-validate:
    name: tofu validate (${{ matrix.dir }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        dir: [aws, azure, cloudflare, bootstrap, gcp]
    steps:
      - uses: actions/checkout@v4
      - uses: opentofu/setup-opentofu@v1
        with:
          tofu_version_file: .opentofu-version
      - run: tofu init -backend=false -input=false
        working-directory: terraform/${{ matrix.dir }}
      - run: tofu validate
        working-directory: terraform/${{ matrix.dir }}

  helm:
    name: helm lint + template (${{ matrix.chart }} / ${{ matrix.cluster }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        chart:
          # helm/monitoring/ is a values-only wrapper (no Chart.yaml) for the
          # upstream kube-prometheus-stack chart — applied via 'just
          # monitoring-bootstrap CLUSTER', not lintable as a standalone chart.
          # helm/cnpg/ is similar (values-only for upstream cnpg/cloudnative-pg).
          # helm/trakrf-mosquitto/ is GKE-only (no eks/aks overlays) — linted in
          # its own helm-mosquitto job below.
          - cert-manager-config
          - traefik-config
          - trakrf-backend
          - trakrf-db
        cluster: [eks, aks]
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
      - name: Lint chart with cluster overlay
        run: |
          helm lint helm/${{ matrix.chart }} \
            -f helm/${{ matrix.chart }}/values.yaml \
            -f helm/${{ matrix.chart }}/values-${{ matrix.cluster }}.yaml
      - name: Template chart with cluster overlay
        run: |
          helm template helm/${{ matrix.chart }} \
            -f helm/${{ matrix.chart }}/values.yaml \
            -f helm/${{ matrix.chart }}/values-${{ matrix.cluster }}.yaml

  helm-mosquitto:
    # GKE-only broker chart (TRA-907) — not part of the eks/aks matrix above.
    name: helm lint + template (trakrf-mosquitto / gke)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
      - name: Lint chart with GKE overlay
        run: |
          helm lint helm/trakrf-mosquitto \
            -f helm/trakrf-mosquitto/values.yaml \
            -f helm/trakrf-mosquitto/values-gke.yaml
      - name: Template chart with GKE overlay
        run: |
          helm template helm/trakrf-mosquitto \
            -f helm/trakrf-mosquitto/values.yaml \
            -f helm/trakrf-mosquitto/values-gke.yaml \
            --set hostname=mqtt.preview.gke.trakrf.id \
            --set loadBalancerIP=1.2.3.4

  argocd-root:
    name: helm template argocd/root (${{ matrix.cluster }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        cluster: [eks, aks]
    steps:
      - uses: actions/checkout@v4
      - uses: azure/setup-helm@v4
      - name: Template root app-of-apps
        run: |
          helm template trakrf-root argocd/root \
            --set cluster=${{ matrix.cluster }} \
            --set certManagerIdentityClientId=fake \
            --set tenantId=fake \
            --set subscriptionId=fake \
            --set dnsZoneResourceGroup=fake \
            --set traefikLbIp=1.2.3.4 \
            --set mainResourceGroupName=fake

  # Back-compat aliases for branch-protection required contexts that
  # predate TRA-438's cluster-overlay split. Each depends on both
  # cluster variants of its chart's lint+template job and just reports
  # success — remove these once branch protection is updated to require
  # the new "chart / cluster" named checks instead.
  helm-required-backend:
    name: helm lint + template (trakrf-backend)
    runs-on: ubuntu-latest
    needs: helm
    if: always()
    steps:
      - name: Verify prerequisite jobs succeeded
        run: |
          if [[ "${{ needs.helm.result }}" != "success" ]]; then
            echo "helm matrix failed: ${{ needs.helm.result }}"
            exit 1
          fi

  # The trakrf-ingester chart was retired in TRA-907 (replaced by the in-backend
  # subscriber + the standalone helm/trakrf-mosquitto chart). This shim is kept
  # ONLY so the legacy required status context stays green; drop it once branch
  # protection no longer requires "helm lint + template (trakrf-ingester)".
  helm-required-ingester:
    name: helm lint + template (trakrf-ingester)
    runs-on: ubuntu-latest
    needs: helm
    if: always()
    steps:
      - name: Verify prerequisite jobs succeeded
        run: |
          if [[ "${{ needs.helm.result }}" != "success" ]]; then
            echo "helm matrix failed: ${{ needs.helm.result }}"
            exit 1
          fi