test_deploy.yml

# run locally with https://github.com/nektos/act
# sudo rm -r /github/workspace && sudo cp -r ./ /github/workspace && act run --job test --bind --directory /github/workspace
name: ci

# Run this workflow every time a new commit pushed to your repository
on: 
  push:
    branches:
      - main
      - master
    tags:
      - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
env:
  # target value can be subzerocloud or fargate
  DEPLOY_TARGET: subzerocloud
  # to use the production image, replace value with production
  # you'll need a "On Premise" subscription
  ENVIRONMENT: development

  # set to false if the database state is managed by external tooling
  DEPLOY_DATABASE_MIGRATIONS: true

  # subzero.cloud settings
  SUBZERO_API_ENDPOINT: https://app.subzero.cloud
  SUBZERO_EMAIL: ${{ secrets.SUBZERO_EMAIL }}
  SUBZERO_PASSWORD: ${{ secrets.SUBZERO_PASSWORD }}

  # AWS settings
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
  AWS_VPC_ID: ${{ secrets.AWS_VPC_ID }}
  AWS_SUBNET_ID: ${{ secrets.AWS_SUBNET_ID }}

  # application settings
  APP_ID:
  APP_DOMAIN: ${{ secrets.APP_DOMAIN }}
  APP_NAME: "my application"
  APP_DB_HOST: ${{ secrets.APP_DB_HOST }}
  APP_DB_PORT: ${{ secrets.APP_DB_PORT }}
  APP_DB_NAME: ${{ secrets.APP_DB_NAME }}
  APP_DB_MASTER_USER: ${{ secrets.APP_DB_MASTER_USER }}
  APP_DB_MASTER_PASSWORD: ${{ secrets.APP_DB_MASTER_PASSWORD }}
  APP_DB_AUTHENTICATOR_USER: ${{ secrets.APP_DB_AUTHENTICATOR_USER }}
  APP_DB_AUTHENTICATOR_PASSWORD: ${{ secrets.APP_DB_AUTHENTICATOR_PASSWORD }}
  APP_DB_SCHEMA: api
  APP_DB_ANON_ROLE: anonymous
  APP_JWT_SECRET: ${{ secrets.APP_JWT_SECRET }}
  
  # static content upload settings
  UPLOAD_STATIC_FILES: false
  SFTP_HOST: sftp.app.subzero.cloud
  SFTP_PORT: 2323
  SFTP_USER: ${{ secrets.SUBZERO_EMAIL }}.${{ secrets.APP_DOMAIN }}
  SFTP_PASSWORD: ${{ secrets.SUBZERO_PASSWORD }}

  # helper vars
  MASTER_DB_CONNECTION_STRING: "${{ secrets.APP_DB_MASTER_USER }}:${{ secrets.APP_DB_MASTER_PASSWORD }}@${{ secrets.APP_DB_HOST }}:${{ secrets.APP_DB_PORT }}/${{ secrets.APP_DB_NAME }}?sslmode=prefer"
  AUTHENTICATOR_DB_CONNECTION_STRING: "${{ secrets.APP_DB_AUTHENTICATOR_USER }}:${{ secrets.APP_DB_AUTHENTICATOR_PASSWORD }}@${{ secrets.APP_DB_HOST }}:${{ secrets.APP_DB_PORT }}/${{ secrets.APP_DB_NAME }}?sslmode=prefer"
  SUBZERO: ".github/workflows/subzero.sh"

jobs:

  test:
    runs-on: ubuntu-latest
    steps:

      - name: checkout repository
        uses: actions/checkout@v2

      - name: bring up docker-compose
        run: |
          docker-compose down
          docker-compose up -d

      - name: run tests
        run: |
          yarn install
          yarn test

      - name: shutdown test stack
        run: docker-compose down

  deploy:
    runs-on: ubuntu-latest
    needs: test
    if: startsWith(github.ref, 'refs/tags/v')
    steps:

      - name: checkout repository
        uses: actions/checkout@v2

      - name: check correct configuration
        run: |
          chmod +x $SUBZERO
          $SUBZERO check_configuration
          if [ $DEPLOY_DATABASE_MIGRATIONS ]; then
            $SUBZERO check_database_connection "postgres://$MASTER_DB_CONNECTION_STRING"
          fi

      - name: login to subzero.cloud
        if: ${{ env.DEPLOY_TARGET == 'subzerocloud' }}
        run: $SUBZERO login "$SUBZERO_EMAIL" "$SUBZERO_PASSWORD"

      - name: install dependencies
        run: |
          # apt-get update -y
          sudo apt-get install -y sshpass sqitch
          # docker pull sqitch/sqitch
          # curl -s -L https://git.io/JJKCn -o /usr/local/bin/sqitch && chmod +x /usr/local/bin/sqitch

      - name: setup authenticator db role
        if: ${{ env.DEPLOY_DATABASE_MIGRATIONS == 'true' }}
        run: |
          $SUBZERO setup_authenticator_role "$APP_DB_AUTHENTICATOR_USER" "$APP_DB_AUTHENTICATOR_PASSWORD" "postgres://$MASTER_DB_CONNECTION_STRING"

      - name: setup subzero app
        if: ${{ env.DEPLOY_TARGET == 'subzerocloud' && ! env.APP_ID }}
        run : |
          $SUBZERO create_application

      - name: deploy database migrations
        if: ${{ env.DEPLOY_DATABASE_MIGRATIONS == 'true' }}
        working-directory: ./db/migrations
        run: |
          sqitch deploy "db:pg://$MASTER_DB_CONNECTION_STRING"

      - name: upload static content
        if: ${{ env.SUBZERO_UPLOAD_STATIC_FILES }}
        working-directory: ./html
        run : |
          sshpass -p "$SFTP_PASSWORD" scp -o StrictHostKeyChecking=no -P $SFTP_PORT -r ./ $SFTP_USER@$SFTP_HOST:/

      - name: store jwt secret in database
        if: ${{ env.DEPLOY_DATABASE_MIGRATIONS == 'true' }}
        run: |
          # $SUBZERO store_jwt_secret_as_guc "$APP_DB_AUTHENTICATOR_USER" "$APP_JWT_SECRET" "postgres://$MASTER_DB_CONNECTION_STRING"
          $SUBZERO store_jwt_secret_in_settings "$APP_DB_AUTHENTICATOR_USER" "$APP_JWT_SECRET" "postgres://$MASTER_DB_CONNECTION_STRING"

      - name: update authenticator role password
        if: ${{ env.DEPLOY_DATABASE_MIGRATIONS == 'true' }}
        run: |
          $SUBZERO update_authenticator_role_password "$APP_DB_AUTHENTICATOR_USER" "$APP_DB_AUTHENTICATOR_PASSWORD" "postgres://$MASTER_DB_CONNECTION_STRING"

      - name: trigger subzero.cloud schema cache refresh
        if: ${{ env.DEPLOY_TARGET == 'subzerocloud' }}
        run: |
          # update_configuration will also trigger db schema refresh
          $SUBZERO update_configuration

          # you can also use this to trigger schema refresh without updating the configuration
          $SUBZERO reload_db_schema

      - name: deploy container to fargate
        if: ${{ env.DEPLOY_TARGET == 'fargate' }}
        run: |
          CLOUDFORMATION_ACTION=create-stack
          CLOUDFORMATION_STACK_NAME=${APP_DOMAIN//./-}
          if aws cloudformation describe-stacks --stack-name $CLOUDFORMATION_STACK_NAME ; then
            CLOUDFORMATION_ACTION=update-stack
          fi
          aws cloudformation $CLOUDFORMATION_ACTION \
            --stack-name $CLOUDFORMATION_STACK_NAME \
            --template-body file://.github/workflows/fargate_single_container.yml \
            --capabilities CAPABILITY_IAM \
            --parameters \
                ParameterKey=VpcId,ParameterValue=$AWS_VPC_ID \
                ParameterKey=SubnetId,ParameterValue=$AWS_SUBNET_ID \
                ParameterKey=DomainName,ParameterValue=$APP_DOMAIN \
                ParameterKey=DbHost,ParameterValue=$APP_DB_HOST \
                ParameterKey=DbPort,ParameterValue=$APP_DB_PORT \
                ParameterKey=DbName,ParameterValue=$APP_DB_NAME \
                ParameterKey=DbAuthenticatorUser,ParameterValue=$APP_DB_AUTHENTICATOR_USER \
                ParameterKey=DbAuthenticatorUserPass,ParameterValue=$APP_DB_AUTHENTICATOR_PASSWORD \
                ParameterKey=DbSchema,ParameterValue=$APP_DB_SCHEMA \
                ParameterKey=DbAnonRole,ParameterValue=$APP_DB_ANON_ROLE \
                ParameterKey=JwtSecret,ParameterValue=$APP_JWT_SECRET \
                ParameterKey=EnvironmentName,ParameterValue=$ENVIRONMENT \
                ParameterKey=SubzeroEmail,ParameterValue=$SUBZERO_EMAIL \
                ParameterKey=SubzeroPassword,ParameterValue=$SUBZERO_PASSWORD