Run runic in pre-commit.ci #3751
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create Docker Image and optionally deploy to Dagster | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| inputs: | |
| build_image: | |
| type: choice | |
| description: "Should the container be built?" | |
| options: | |
| - "yes" | |
| - "no" | |
| default: "yes" | |
| push_to_dagster: | |
| type: choice | |
| description: "Should the container be pushed to the dagster prod server?" | |
| options: | |
| - "no" | |
| - "yes" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| IMAGE_NAME: cfa-stf-routine-forecasting | |
| AZURE_REGISTRY: cfaprdbatchcr.azurecr.io | |
| jobs: | |
| # This can be used as a template, later: https://github.com/CDCgov/cfa-epinow2-pipeline/blob/main/.github/workflows/containers-and-az-pool.yaml | |
| build-pipeline-image: | |
| runs-on: ubuntu-latest | |
| name: Build image | |
| outputs: | |
| tag: ${{ steps.image-tag.outputs.tag }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Extract branch name | |
| shell: bash | |
| run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT | |
| id: branch-name | |
| - name: Figure out tag (either latest if it is main or the branch name) | |
| shell: bash | |
| id: image-tag | |
| run: | | |
| if [ "${{ steps.branch-name.outputs.branch }}" = "main" ]; then | |
| echo "tag=latest" >> $GITHUB_OUTPUT | |
| else | |
| echo "tag=$(echo "${{ steps.branch-name.outputs.branch }}" | tr '/' '-')" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Docker Login | |
| if: github.event.inputs.build_image != 'no' | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up Docker Buildx | |
| if: github.event.inputs.build_image != 'no' | |
| id: buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Docker build and push | |
| if: github.event.inputs.build_image != 'no' | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| push: true | |
| builder: ${{ steps.buildx.outputs.name }} | |
| tags: | | |
| ghcr.io/cdcgov/${{ env.IMAGE_NAME }}:${{ steps.image-tag.outputs.tag }} | |
| cache-from: | | |
| type=registry,ref=ghcr.io/cdcgov/${{ env.IMAGE_NAME }}:${{ steps.image-tag.outputs.tag }}-cache | |
| type=registry,ref=ghcr.io/cdcgov/${{ env.IMAGE_NAME }}:latest-cache | |
| cache-to: type=registry,ref=ghcr.io/cdcgov/${{ env.IMAGE_NAME }}:${{ steps.image-tag.outputs.tag }}-cache,mode=max | |
| acr-import: | |
| needs: build-pipeline-image | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write # This is required for requesting the JWT | |
| contents: read # This is required for actions/checkout | |
| packages: write # This is required for ACR import | |
| # If we're on the main branch, the deployment environment (for use with OIDC cred on the SP) will be main, | |
| # otherwise it will be test | |
| environment: |- | |
| ${{ (github.ref_name == 'main') && 'production' || 'test' }} | |
| name: Copy image from GHCR to ACR | |
| outputs: | |
| tag: ${{ needs.build-pipeline-image.outputs.tag }} | |
| steps: | |
| # From: https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#requesting-the-jwt-using-the-actions-core-toolkit | |
| - name: Install OIDC Client from Core Package | |
| run: npm install @actions/core@1.6.0 @actions/http-client | |
| - name: Get Id Token | |
| uses: actions/github-script@v9 | |
| id: idtoken | |
| with: | |
| script: | | |
| const coredemo = require('@actions/core') | |
| const id_token = await coredemo.getIDToken('api://AzureADTokenExchange') | |
| coredemo.setOutput('id_token', id_token) | |
| - name: ACR Import | |
| uses: CDCgov/cfa-actions/runner-action@v1.5.0 | |
| with: | |
| github_app_id: ${{ secrets.REPO_CDCENT_ACTOR_APP_ID }} | |
| github_app_pem: ${{ secrets.REPO_CDCENT_ACTOR_APP_PEM }} | |
| wait_for_completion: true | |
| print_logs: true | |
| script: | | |
| echo "Logging into Azure CLI" | |
| az login --service-principal \ | |
| --username ${{ secrets.AZURE_STFT_SP_CLIENT_ID }} \ | |
| --tenant ${{ secrets.AZURE_TENANT_ID }} \ | |
| --federated-token ${{ steps.idtoken.outputs.id_token }} \ | |
| --output none | |
| echo "Importing image" | |
| IMAGE_WITH_TAG=${{ env.IMAGE_NAME }}:${{ needs.build-pipeline-image.outputs.tag }} | |
| az acr import --name ${{ env.AZURE_REGISTRY }} \ | |
| --source "ghcr.io/cdcgov/$IMAGE_WITH_TAG" \ | |
| --username ${{ github.actor }} \ | |
| --password ${{ secrets.GITHUB_TOKEN }} \ | |
| --image "$IMAGE_WITH_TAG" \ | |
| --force && echo 'Copied image!' | |
| if [ $? -ne 0 ]; then | |
| echo "Failed to copy image" | |
| exit 1 | |
| fi | |
| check_and_deploy_dagster_code: | |
| needs: [ build-pipeline-image, acr-import ] | |
| # Conditional step execution that runs only when: | |
| # the workflow is manually dispatched and the 'push_to_dagster' input is set to 'yes' | |
| # OR | |
| # the event is a push to main where the dagster_defs_changed | |
| runs-on: ubuntu-latest | |
| name: Check Dagster Changes and Update Prod Server | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check if dagster defs changed | |
| id: dagster_changed | |
| if: github.event_name == 'push' || github.event_name == 'pull_request' | |
| shell: bash | |
| run: | | |
| if [ "${{ github.event_name }}" == "push" ]; then | |
| BASE="${{ github.event.before }}" | |
| else | |
| BASE="${{ github.event.pull_request.base.sha }}" | |
| fi | |
| HEAD="${{ github.sha }}" | |
| if git diff --name-only "$BASE" "$HEAD" | grep -q 'dagster_defs\.py'; then | |
| echo "changed=true" >> $GITHUB_OUTPUT | |
| echo "Dagster defs changed: true" | |
| else | |
| echo "changed=false" >> $GITHUB_OUTPUT | |
| echo "Dagster defs changed: false" | |
| fi | |
| - name: Run update script with cfa runner-action | |
| uses: CDCgov/cfa-actions/runner-action@v1.5.0 | |
| if: >- | |
| ( github.event_name == 'workflow_dispatch' && github.event.inputs.push_to_dagster == 'yes' ) || | |
| ( github.event_name == 'push' && github.ref_name == 'main' && steps.dagster_changed.outputs.changed == 'true' ) | |
| with: | |
| github_app_id: ${{ secrets.REPO_CDCENT_ACTOR_APP_ID }} | |
| github_app_pem: ${{ secrets.REPO_CDCENT_ACTOR_APP_PEM }} | |
| script: | | |
| echo "Running update script" | |
| IMAGE_WITH_TAG=${{ env.IMAGE_NAME }}:${{ needs.build-pipeline-image.outputs.tag }} | |
| echo $IMAGE_WITH_TAG | |
| uv run \ | |
| https://raw.githubusercontent.com/CDCgov/cfa-dagster/refs/heads/main/scripts/update_code_location.py \ | |
| --registry_image "${{ env.AZURE_REGISTRY }}/$IMAGE_WITH_TAG" |