Build & Deploy App to Production #148
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Deploy App to Production | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| # commit hash (for frontend deploy to fleek) | |
| commit: | |
| description: "Branch/Commit ref" | |
| default: "origin/master" | |
| type: string | |
| jobs: | |
| build-and-test: | |
| name: Build and Test | |
| # environment: production | |
| # run only when code is compiling and tests are passing | |
| runs-on: ubuntu-latest | |
| outputs: | |
| dockerTag: ${{ steps.compute.outputs.docker_tag }} | |
| services: | |
| # Label used to access the service container | |
| postgres: | |
| # Docker Hub image | |
| image: postgres:11.5 | |
| # Provide the password for postgres | |
| env: | |
| POSTGRES_DB: testdb | |
| # Set health checks to wait until postgres has started | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| # Maps tcp port 5432 on service container to the host | |
| - 5432:5432 | |
| redis: | |
| image: redis | |
| # Set health checks to wait until redis has started | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 6379:6379 | |
| env: | |
| DJANGO_SETTINGS_MODULE: app.settings | |
| SUPRESS_DEBUG_TOOLBAR: 1 | |
| GITCOIN_API_USER: ${{ secrets.GITCOIN_API_USER }} | |
| GITHUB_API_TOKEN: ${{ secrets.GITCOIN_API_TOKEN }} | |
| POLYGONSCAN_API_KEY: ${{ secrets.POLYGONSCAN_API_KEY }} | |
| # steps to perform in job | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v2 | |
| - name: Use Node.js 14 | |
| uses: actions/setup-node@v2 | |
| with: | |
| node-version: 14.20.1 | |
| cache: "yarn" | |
| - name: Use Python 3.7 | |
| uses: "actions/setup-python@v2" | |
| with: | |
| python-version: 3.7 | |
| cache: "pip" | |
| - name: Setup Env | |
| run: | | |
| echo "PYTHONPATH=/home/runner/work/web/web/app" >> $GITHUB_ENV | |
| cp app/app/ci.env app/app/.env | |
| pip install pip==20.0.2 setuptools wheel --upgrade | |
| - name: Fetch and Install GeoIP database files | |
| run: | | |
| sudo apt-get update && sudo apt-get install -y libmaxminddb-dev libsodium-dev libsecp256k1-dev | |
| cp dist/*.gz ./ | |
| gunzip GeoLite2-City.mmdb.tar.gz && gunzip GeoLite2-Country.mmdb.tar.gz | |
| tar -xvf GeoLite2-City.mmdb.tar && tar -xvf GeoLite2-Country.mmdb.tar | |
| sudo mkdir -p /opt/GeoIP/ | |
| sudo mv GeoLite2-City_20200128/*.mmdb /opt/GeoIP/ | |
| sudo mv GeoLite2-Country_20200128/*.mmdb /opt/GeoIP/ | |
| - name: Install libvips, Node, and Python dependencies | |
| run: | | |
| sudo apt-get install -y libvips libvips-dev | |
| node --version | |
| yarn install | |
| pip install -r requirements/test.txt | |
| yarn run eslint | |
| yarn run stylelint | |
| (cd app; python ./manage.py collectstatic --noinput --disable-collectfast) | |
| # - name: Run management commands | |
| # run: | | |
| # python app/manage.py migrate | |
| # python app/manage.py fetch_gas_prices | |
| # - name: Run Python and UI tests | |
| # run: | | |
| # pytest -p no:ethereum -p no:warnings | |
| # bin/ci/cypress-run | |
| # - name: Generate Markdown documentation and static docs page | |
| # run: pydocmd build | |
| # - name: Deploy to Github Pages 🚀 | |
| # uses: peaceiris/actions-gh-pages@v3 | |
| # if: github.ref == 'refs/heads/master' | |
| # with: | |
| # github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # publish_dir: _build/site | |
| # cname: docs.gitcoin.coind | |
| - name: Compute some values | |
| id: compute | |
| run: | | |
| echo "::set-output name=docker_tag::gitcoin/web:${GITHUB_SHA: -10}" | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v1 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@v1 | |
| - name: Deploy to Docker Hub 🚀 | |
| uses: docker/build-push-action@v2 | |
| with: | |
| context: ./ | |
| file: ./Dockerfile-prod | |
| builder: ${{ steps.buildx.outputs.name }} | |
| push: true | |
| tags: | | |
| ${{ steps.compute.outputs.docker_tag }} | |
| gitcoin/web:production-gha | |
| cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/web:buildcache-production | |
| cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/web:buildcache-production,mode=max | |
| - run: | | |
| npm install | |
| pulumi stack select -c gitcoin/production/dev | |
| pulumi config -s gitcoin/production/dev set aws:region us-west-2 --non-interactive | |
| working-directory: infra/production | |
| env: | |
| PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} | |
| # Run pulumi actions | |
| # - uses: pulumi/actions@v3 | |
| # id: pulumi | |
| # with: | |
| # command: preview | |
| # stack-name: gitcoin/production/dev | |
| # upsert: false | |
| # work-dir: infra/production | |
| # env: | |
| # PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} | |
| # PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }} | |
| # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| # AWS_REGION: ${{ secrets.AWS_REGION }} | |
| # DB_NAME: ${{ secrets.DB_NAME }} | |
| # DB_PASSWORD: ${{ secrets.DB_PASSWORD }} | |
| # DB_USER: ${{ secrets.DB_USER }} | |
| # DOCKER_GTC_WEB_IMAGE: ${{ needs.build-and-test.outputs.dockerTag }} | |
| # DATADOG_KEY: ${{ secrets.DATADOG_KEY }} | |
| # ROUTE_53_ZONE: ${{ secrets.ROUTE_53_ZONE }} | |
| # DOMAIN: ${{ secrets.DOMAIN }} | |
| # SENTRY_DSN: ${{ secrets.SENTRY_DSN }} | |
| # GITHUB_CLIENT_ID: ${{ secrets.GTC_GITHUB_CLIENT_ID }} | |
| # GITHUB_CLIENT_SECRET: ${{ secrets.GTC_GITHUB_CLIENT_SECRET }} | |
| # TEMP_DATABASE: ${{ secrets.TEMP_DATABASE }} | |
| # DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| # READ_REPLICA_1_DATABASE_URL: ${{secrets.READ_REPLICA_1_DATABASE_URL}} | |
| # READ_REPLICA_2_DATABASE_URL: ${{secrets.READ_REPLICA_2_DATABASE_URL}} | |
| # READ_REPLICA_3_DATABASE_URL: ${{secrets.READ_REPLICA_3_DATABASE_URL}} | |
| # READ_REPLICA_4_DATABASE_URL: ${{secrets.READ_REPLICA_4_DATABASE_URL}} | |
| # GITHUB_API_TOKEN: ${{ secrets.GTC_GITHUB_API_TOKEN }} | |
| # GITHUB_API_USER: ${{ secrets.GTC_GITHUB_API_USER }} | |
| # GITHUB_APP_NAME: ${{ secrets.GTC_GITHUB_APP_NAME }} | |
| deploy: | |
| name: Deploy | |
| needs: build-and-test | |
| environment: production | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v2 | |
| - name: Use Node.js | |
| uses: actions/setup-node@v2 | |
| with: | |
| # node-version: ${{ matrix.node-version }} | |
| cache: "npm" | |
| cache-dependency-path: infra/production/package-lock.json | |
| # Install pulumi dependencies | |
| # Select the new pulumi stack | |
| - run: | | |
| npm install | |
| pulumi stack select -c gitcoin/production/dev | |
| pulumi config -s gitcoin/production/dev set aws:region us-west-2 --non-interactive | |
| working-directory: infra/production | |
| env: | |
| PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} | |
| # Run pulumi actions | |
| - uses: pulumi/actions@v3 | |
| id: pulumi | |
| with: | |
| command: up | |
| stack-name: gitcoin/production/dev | |
| upsert: false | |
| work-dir: infra/production | |
| env: | |
| PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }} | |
| PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }} | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| AWS_REGION: ${{ secrets.AWS_REGION }} | |
| DB_NAME: ${{ secrets.DB_NAME }} | |
| DB_PASSWORD: ${{ secrets.DB_PASSWORD }} | |
| DB_USER: ${{ secrets.DB_USER }} | |
| DOCKER_GTC_WEB_IMAGE: ${{ needs.build-and-test.outputs.dockerTag }} | |
| DATADOG_KEY: ${{ secrets.DATADOG_KEY }} | |
| ROUTE_53_ZONE: ${{ secrets.ROUTE_53_ZONE }} | |
| DOMAIN: ${{ secrets.DOMAIN }} | |
| SENTRY_DSN: ${{ secrets.SENTRY_DSN }} | |
| GITHUB_CLIENT_ID: ${{ secrets.GTC_GITHUB_CLIENT_ID }} | |
| GITHUB_CLIENT_SECRET: ${{ secrets.GTC_GITHUB_CLIENT_SECRET }} | |
| TEMP_DATABASE: ${{ secrets.TEMP_DATABASE }} | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| READ_REPLICA_1_DATABASE_URL: ${{secrets.READ_REPLICA_1_DATABASE_URL}} | |
| READ_REPLICA_2_DATABASE_URL: ${{secrets.READ_REPLICA_2_DATABASE_URL}} | |
| READ_REPLICA_3_DATABASE_URL: ${{secrets.READ_REPLICA_3_DATABASE_URL}} | |
| READ_REPLICA_4_DATABASE_URL: ${{secrets.READ_REPLICA_4_DATABASE_URL}} | |
| GITHUB_API_TOKEN: ${{ secrets.GTC_GITHUB_API_TOKEN }} | |
| GITHUB_API_USER: ${{ secrets.GTC_GITHUB_API_USER }} | |
| GITHUB_APP_NAME: ${{ secrets.GTC_GITHUB_APP_NAME }} | |
| OLD_REDIS_URL: ${{ secrets.OLD_REDIS_URL }} | |
| SECRET_KEY: ${{ secrets.SECRET_KEY }} | |
| ETHERSCAN_API_KEY: ${{ secrets.ETHERSCAN_API_KEY }} | |
| GTC_DIST_KEY: ${{ secrets.GTC_DIST_KEY }} | |
| GTC_DIST_API_URL: ${{ secrets.GTC_DIST_API_URL }} | |
| BRIGHTID_PRIVATE_KEY: ${{ secrets.BRIGHTID_PRIVATE_KEY }} | |
| ALCHEMY_KEY: ${{ secrets.ALCHEMY_KEY }} | |
| AWS_STAR_GITCOIN_CERT: ${{ secrets.AWS_STAR_GITCOIN_CERT }} | |
| SENDGRID_API_KEY: ${{ secrets.SENDGRID_API_KEY }} | |
| # The static files are already bundled and located in the folder /code/app/static in the container | |
| - name: Copy static files to bucket | |
| run: | | |
| mkdir static_files_to_deploy | |
| mkdir docker_bin | |
| cat <<EOT >> docker_bin/static_files.sh | |
| #!/bin/bash | |
| cp -Rf /code/app/static/* /static_files_to_deploy/ | |
| EOT | |
| docker run -v $(pwd)/static_files_to_deploy:/static_files_to_deploy -v $(pwd)/docker_bin:/code/app/bin -e DATABASE_URL=${{ steps.pulumi.outputs.rdsConnectionUrl }} ${{ needs.build-and-test.outputs.dockerTag }} sh /code/app/bin/static_files.sh | |
| echo "Syncing to bucket: ${{ steps.pulumi.outputs.bucketName }}" | |
| echo "Source folder: $(pwd)/static_files_to_deploy" | |
| aws s3 sync $(pwd)/static_files_to_deploy s3://${{ steps.pulumi.outputs.bucketName }}/static --acl public-read --delete | |
| env: | |
| # We need AWS_EC2_METADATA_DISABLED, because: https://github.com/actions/checkout/issues/440 | |
| AWS_EC2_METADATA_DISABLED: true | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| BUNDLE_USE_CHECKSUM: 'false' | |