Rill cloud continuous deployment (#1804)

* Rill cloud continuous deployment

.github/workflows/cli-release.yml

@@ -5,20 +5,23 @@
 # Caching of the release artifacts are intentionally disabled at the bucket level by setting the Cache-Control header of the objects to 'no-store',
 # this is done because the files are cached at the CDN layer instead and multiple caching layers makes invalidating the cache difficult.
 # The CDN cache is explicitly invalidated as part of the release process, to prevent old versions from being accidentally served after the release is done.
+
 name: Release Rill CLI
 on:
-  # Trigger a full release on new Git tag
   push:
+    # Trigger a full release on new Git tag
     tags:
       - "**"
   # Trigger a nightly release at midnight
   schedule:
     - cron: '0 0 * * *'
   # Trigger a nightly release manually
   workflow_dispatch:
+
 env:
-  # PUBLISH_NIGHTLY becomes a string with values 'true' or 'false'
-  PUBLISH_NIGHTLY: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+  PUBLISH_NIGHTLY: ${{ contains(fromJSON('["schedule", "workflow_dispatch"]'), github.event_name) }}
+  PUBLISH_RELEASE: ${{ contains('refs/tags', github.ref_name) }}
+
 jobs:
   release:
     name: Release rill-developer
@@ -49,16 +52,17 @@ jobs:
       - name: Build and embed static UI
         run: make cli.prepare
 
-      - name: Set up release environment
+      - name: Build Rill using Goreleaser
         run: |-
           echo '${{ secrets.RILL_BINARY_SA }}' > rill-binary-sa.json
+
           echo 'GITHUB_TOKEN=${{ secrets.GORELEASER_ACCESS_TOKEN }}' > .release-env
           echo 'GOOGLE_APPLICATION_CREDENTIALS=/rill-binary-sa.json' >> .release-env
           echo 'DOCKERHUB_USER=${{ secrets.DOCKERHUB_USER }}' >> .release-env
           echo 'DOCKERHUB_PASS=${{ secrets.DOCKERHUB_PASS }}' >> .release-env
 
-      - name: Release Publish
-        run: |-
+          echo '${{ github.ref_name }}' >> latest.txt
+
           if [[ ${{ env.PUBLISH_NIGHTLY }} == 'true' ]]; then
             export NIGHTLY="--snapshot"
           fi
@@ -81,21 +85,18 @@ jobs:
         with:
           credentials_json: "${{ secrets.RILL_BINARY_SA }}"
 
-      - name: Upload install script to CDN bucket
+
+      - name: Release - Upload install script to CDN bucket
         uses: google-github-actions/upload-cloud-storage@v1
+        if: env.PUBLISH_RELEASE == 'true'
         with:
           path: scripts/install.sh
           destination: prod-cdn.rilldata.com/
           headers: |-
             cache-control: no-store
 
-      - name: Create latest version file
-        if: env.PUBLISH_NIGHTLY == 'false'
-        run: |-
-          echo '${{ github.ref_name }}' >> latest.txt
-
-      - name: Upload latest version file to CDN bucket
-        if: env.PUBLISH_NIGHTLY == 'false'
+      - name: Release - Upload latest version file to CDN bucket
+        if: env.PUBLISH_RELEASE == 'true'
         uses: google-github-actions/upload-cloud-storage@v1
         with:
           path: latest.txt
@@ -110,14 +111,14 @@ jobs:
           docker tag rilldata/rill:latest rilldata/rill:nightly
           docker push rilldata/rill:nightly
 
-      - name: Prepare for nightly GCS upload
+      - name: Nightly - Prepare for nightly GCS upload
         if: env.PUBLISH_NIGHTLY == 'true'
         run: |-
           mkdir nightly
           cp dist/*.zip nightly/
           cp dist/checksums.txt nightly/
 
-      - name: Upload nightly to CDN bucket
+      - name: Nightly - Upload nightly to CDN bucket
         if: env.PUBLISH_NIGHTLY == 'true'
         uses: google-github-actions/upload-cloud-storage@v1
         with:
@@ -129,7 +130,7 @@ jobs:
       - name: Set up Cloud SDK
         uses: 'google-github-actions/setup-gcloud@v1'
 
-      - name: Explicitly invalidate the old artifacts from CDN cache
+      - name: CDN - Explicitly invalidate the old artifacts from CDN cache
         run: |-
           gcloud compute url-maps invalidate-cdn-cache prod --path "/install.sh" --async
           gcloud compute url-maps invalidate-cdn-cache prod --path "/rill/latest.txt" --async

.github/workflows/rill-cloud.yml

@@ -0,0 +1,53 @@
+# This workflow triggers deployment with Rill Cloud helm charts
+# Each merge to main branch is build with github sha tag and published to Rill Cloud.
+name: Deploy to Rill Cloud
+on:
+  push:
+    tags:
+      - "**"
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  RELEASE: ${{ contains('refs/tags', github.ref_name) }}
+
+jobs:
+  release:
+    name: Deploy to Rill Cloud
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.19.2
+
+      - name: Authenticate GCloud
+        uses: google-github-actions/auth@v1
+        with:
+          credentials_json: "${{ secrets.RILL_BINARY_SA }}"
+
+      - name: Set up GCloud SDK
+        uses: google-github-actions/setup-gcloud@v1
+
+      - name: Build & Publish Rill docker image
+        run: |-
+          git fetch --all --tags
+
+          go build -o rill -mod=readonly -ldflags="-s -w -X main.Version=$(git describe --tags `git rev-list --tags --max-count=1`)-headless -X main.Commit=${GITHUB_SHA} -X main.BuildDate=$(date +%FT%T)" cli/main.go
+
+          gcloud auth configure-docker
+
+          docker build -t gcr.io/rilldata/rill-headless:${GITHUB_SHA} .
+          docker push gcr.io/rilldata/rill-headless:${GITHUB_SHA}
+
+      - name: Trigger Rill Cloud deployment
+        run: |-
+          set -e
+          curl -X POST https://api.github.com/repos/rilldata/rill-helm-charts/dispatches \
+          -H "Accept: application/vnd.github.everest-preview+json" \
+          -H "Authorization: token ${{ secrets.GORELEASER_ACCESS_TOKEN }}" \
+          --data '{"event_type": "Deploying Tag: '"${GITHUB_REF_NAME}"'", "client_payload": { "github_sha": "'"${GITHUB_SHA}"'", "tag": "'"${GITHUB_REF_NAME}"'", "release": "${{ env.RELEASE }}"}}'

Dockerfile

@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.1-experimental
-FROM ubuntu:focal
+FROM ubuntu
 
 RUN apt-get update && apt-get install -y ca-certificates