TEST GithubActions 2

MozillaFoundation · Oct 17, 2023 · 9d01eb7 · 9d01eb7
1 parent 1808df0
commit 9d01eb7
Show file tree

Hide file tree

Showing 2 changed files with 72 additions and 63 deletions.
diff --git a/.github/workflows/google-cloudrun-source.yml b/.github/workflows/google-cloudrun-source.yml
@@ -1,54 +1,8 @@
-# This workflow will deploy source code on Cloud Run when a commit is pushed to the "main" branch
-#
-# Overview:
-#
-# 1. Authenticate to Google Cloud
-# 2. Deploy it to Cloud Run
-#
-# To configure this workflow:
-#
-# 1. Ensure the required Google Cloud APIs are enabled:
-#
-#    Cloud Run            run.googleapis.com
-#    Cloud Build          cloudbuild.googleapis.com
-#    Artifact Registry    artifactregistry.googleapis.com
-#
-# 2. Create and configure Workload Identity Federation for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)
-#
-# 3. Ensure the required IAM permissions are granted
-#
-#    Cloud Run
-#      roles/run.admin
-#      roles/iam.serviceAccountUser     (to act as the Cloud Run runtime service account)
-#
-#    Cloud Build
-#      roles/cloudbuild.builds.editor
-#
-#    Cloud Storage
-#      roles/storage.objectAdmin
-#
-#    Artifact Registry
-#      roles/artifactregistry.admin     (project or repository level)
-#
-#    NOTE: You should always follow the principle of least privilege when assigning IAM roles
-#
-# 4. Create GitHub secrets for WIF_PROVIDER and WIF_SERVICE_ACCOUNT
-#
-# 5. Change the values for the SERVICE and REGION environment variables (below).
-#
-# For more support on how to run this workflow, please visit https://github.com/marketplace/actions/deploy-to-cloud-run
-#
-# Further reading:
-#   Cloud Run runtime service account   - https://cloud.google.com/run/docs/securing/service-identity
-#   Cloud Run IAM permissions           - https://cloud.google.com/run/docs/deploying-source-code#permissions_required_to_deploy
-#   Cloud Run builds from source        - https://cloud.google.com/run/docs/deploying-source-code
-#   Principle of least privilege        - https://cloud.google.com/blog/products/identity-security/dont-get-pwned-practicing-the-principle-of-least-privilege
-
 name: Deploy to Cloud Run from Source
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ['main']
 
 env:
   PROJECT_ID: regrets-reporter-dev # TODO: update Google Cloud project id
@@ -64,31 +18,69 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - id: checkout
+        name: Checkout
         uses: actions/checkout@v2
 
-      - name: Google Auth
-        id: auth
+      - id: auth
+        name: Google Auth
         uses: 'google-github-actions/auth@v0'
         with:
+          token_format: access_token
           workload_identity_provider: '${{ secrets.WIF_PROVIDER }}' # e.g. - projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider
           service_account: '${{ secrets.WIF_SERVICE_ACCOUNT }}' # e.g. - my-service-account@my-project.iam.gserviceaccount.com
+          access_token_lifetime: 300s
 
-      # NOTE: Alternative option - authentication via credentials json
-      # - name: Google Auth
-      #   id: auth
-      #   uses: 'google-github-actions/auth@v0'
-      #   with:
-      #     credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
+      - id: loginar
+        name: Login to Artifact Registry
+        uses: docker/login-action@v1
+        with:
+          registry: <gar-region>-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.auth.outputs.access_token }}
+
+      - id: get-tag
+        name: Get tag
+        run: echo ::set-output name=short_ref::${GITHUB_REF#refs/*/}
+
+      - id: docker-push-tagged
+        name: Tag Docker image and push to Google Artifact Registry
+        uses: docker/build-push-action@v2
+        with:
+          push: true
+          tags: |
+            europe-west1-docker.pkg.dev/regrets-reporter-dev/tiktok-reporter-app-be/regrets-reporter:${{ steps.get-tag.outputs.short_ref }}
+            europe-west1-docker.pkg.dev/regrets-reporter-dev/tiktok-reporter-app-be/regrets-reporter:latest
+
+      - id: populate-configs
+        uses: 73h/gae-app-yaml-replace-env-variables@v0.3
+        env:
+          PG_HOST: ${{ secrets.PG_HOST }}
+          PG_PORT: ${{ secrets.PG_PORT }}
+          PG_Type: ${{ secrets.PG_Type }}
+          PG_DATABASE: ${{ secrets.PG_DATABASE }}
+          PG_USERNAME: ${{ secrets.PG_USERNAME }}
+          PG_PASSWORD: ${{ secrets.PG_PASSWORD }}
+          PG_ROOT_PASSWORD: ${{ secrets.PG_ROOT_PASSWORD }}
+          PG_SYNCHRONIZE: ${{ secrets.PG_SYNCHRONIZE }}
+          PG_LOGGING: ${{ secrets.PG_LOGGING }}
+        with:
+          app_yaml_path: '.github/configs/app.yaml'
 
-      - name: Deploy to Cloud Run
-        id: deploy
-        uses: google-github-actions/deploy-cloudrun@v0
+      - id: deploy
+        name: Deploy Docker image to App Engine
+        uses: google-github-actions/deploy-appengine@v1
         with:
-          service: ${{ env.SERVICE }}
-          region: ${{ env.REGION }}
-          # NOTE: If required, update to the appropriate source folder
-          source: ./
+          deliverables: '.github/configs/app.yaml'
+
+      # - name: Deploy to Cloud Run
+      #   id: deploy
+      #   uses: google-github-actions/deploy-cloudrun@v0
+      #   with:
+      #     service: ${{ env.SERVICE }}
+      #     region: ${{ env.REGION }}
+      #     # NOTE: If required, update to the appropriate source folder
+      #     source: ./
 
       # If required, use the Cloud Run url output in later steps
       - name: Show Output

diff --git a/app.yaml b/app.yaml
@@ -0,0 +1,17 @@
+runtime: custom
+env: flex
+
+network:
+  forwarded_ports:
+    - 80:8080
+
+env_variables:
+  PG_HOST: $PG_HOST
+  PG_PORT: $PG_PORT
+  PG_Type: $PG_Type
+  PG_DATABASE: $PG_DATABASE
+  PG_USERNAME: $PG_USERNAME
+  PG_PASSWORD: $PG_PASSWORD
+  PG_ROOT_PASSWORD: $PG_ROOT_PASSWORD
+  PG_SYNCHRONIZE: $PG_SYNCHRONIZE
+  PG_LOGGING: $PG_LOGGING