[sc-15051] Truncate long names in last-resources table (#2939) #3096
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - dev | |
| env: | |
| APP_IMAGE_NAME: app | |
| MANAGER_IMAGE_NAME: manager | |
| RAO_IMAGE_NAME: rao | |
| PLATFORM_IMAGE_NAME: platform | |
| AUTH_IMAGE_NAME: auth | |
| CDN_STORAGE: ${{ github.ref == 'refs/heads/main' && secrets.CDN_STORAGE || secrets.CDN_STORAGE_DEV }} | |
| DOCS_STORAGE: ${{ github.ref == 'refs/heads/main' && secrets.DOCS_STORAGE || secrets.DOCS_STORAGE_DEV }} | |
| S3_CDN_STORAGE: ${{ github.ref == 'refs/heads/main' && secrets.S3_CDN_STORAGE || secrets.S3_CDN_STORAGE_DEV }} | |
| S3_DOCS_STORAGE: ${{ github.ref == 'refs/heads/main' && secrets.S3_DOCS_STORAGE || secrets.S3_DOCS_STORAGE_DEV }} | |
| S3_CDN_STORAGE_IAM_ROLE_ARN: ${{ github.ref == 'refs/heads/main' && secrets.AWS_DOCS_SYNC_ROLE || secrets.S3_CDN_STORAGE_IAM_ROLE_ARN_DEV }} | |
| GCP_WORKLOAD_IDENTITY_PROVIDER: 'projects/224545243904/locations/global/workloadIdentityPools/gh-nuclia/providers/gh-nuclia-provider' | |
| GCP_SERVICE_ACCOUNT: 'github-actions@nuclia-internal.iam.gserviceaccount.com' | |
| DEPLOYMENT_ENVIRONMENT: ${{ github.ref == 'refs/heads/main' && 'stage' || 'dev' }} | |
| PROMO_PRODUCTION: false | |
| jobs: | |
| build: | |
| runs-on: nuclia-base | |
| permissions: | |
| id-token: write # required by google-github-actions/auth (OIDC) | |
| contents: write # required by pkgdeps/git-tag-action and JamesIves/github-pages-deploy-action | |
| actions: read # required by nrwl/nx-set-shas to query previous workflow runs | |
| outputs: | |
| deploy-widget: ${{ steps.check-deploy.outputs.deploy-widget }} | |
| deploy-rao-widget: ${{ steps.check-deploy.outputs.deploy-rao-widget }} | |
| deploy-sdk: ${{ steps.check-deploy.outputs.deploy-sdk }} | |
| deploy-app: ${{ steps.check-deploy.outputs.deploy-app }} | |
| deploy-rao: ${{ steps.check-deploy.outputs.deploy-rao }} | |
| deploy-platform: ${{ steps.check-deploy.outputs.deploy-platform }} | |
| deploy-auth: ${{ steps.check-deploy.outputs.deploy-auth }} | |
| deploy-nucliadb-admin: ${{ steps.check-deploy.outputs.deploy-nucliadb-admin }} | |
| deploy-manager: ${{ steps.check-deploy.outputs.deploy-manager }} | |
| deploy-sistema: ${{ steps.check-deploy.outputs.deploy-sistema }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Authenticate to Google Cloud | |
| id: gcp-auth | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 | |
| with: | |
| workload_identity_provider: '${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}' | |
| service_account: '${{ env.GCP_SERVICE_ACCOUNT }}' | |
| token_format: access_token | |
| - name: 'Set up Cloud SDK' | |
| uses: 'google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db' # v3.0.1 | |
| - name: Login to Google Artifact Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: europe-west4-docker.pkg.dev | |
| username: oauth2accesstoken | |
| password: ${{ steps.gcp-auth.outputs.access_token }} | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1 | |
| if: github.ref == 'refs/heads/main' | |
| with: | |
| role-to-assume: '${{ env.S3_CDN_STORAGE_IAM_ROLE_ARN }}' | |
| aws-region: eu-central-1 | |
| - name: Configure AWS client | |
| uses: unfor19/install-aws-cli-action@f5b46b7f32cf5e7ebd652656c5036bf83dd1e60c # 1.0.8 | |
| if: github.ref == 'refs/heads/main' | |
| with: | |
| arch: amd64 | |
| - uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24 | |
| registry-url: 'https://registry.npmjs.org' | |
| cache: 'yarn' | |
| - name: Debug NPM version 1 | |
| run: |- | |
| npm -v | |
| - name: Debug NPM version | |
| run: |- | |
| npm install -g npm@11.6.4 | |
| - name: Debug NPM version 2 | |
| run: |- | |
| npm -v | |
| - name: Calculate short sha | |
| run: echo "SHORT_SHA=`echo hash${GITHUB_SHA} | cut -c1-12`" >> $GITHUB_ENV | |
| - name: Install project dependencies | |
| run: |- | |
| yarn install --immutable | |
| yarn missdev | |
| - name: Unit tests | |
| run: npx nx affected --target=test --parallel=3 --exclude=sdk-demo,search-widget-demo,core,sistema-demo,rao-widget,platform | |
| - name: Build affected apps | |
| run: |- | |
| npx nx affected --target=build --parallel=3 --configuration production --exclude=sdk-demo,search-widget-demo,rao-widget,platform | |
| # Check if there's any app that should be built because of chart or nginx changes and mark it to be built. | |
| # Unless it's already build by "npx nx affected" command | |
| APPS_TO_BUILD="" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^charts/app/' && ! test -d dist/apps/dashboard && APPS_TO_BUILD="$APPS_TO_BUILD dashboard" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^charts/rao/' && ! test -d dist/apps/rao && APPS_TO_BUILD="$APPS_TO_BUILD rao" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^charts/platform/' && ! test -d dist/apps/platform && APPS_TO_BUILD="$APPS_TO_BUILD platform" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^charts/auth/' && ! test -d dist/apps/auth && APPS_TO_BUILD="$APPS_TO_BUILD auth" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^charts/manager/' && ! test -d dist/apps/manager-v2 && APPS_TO_BUILD="$APPS_TO_BUILD manager-v2" | |
| # nginx conf changes require Docker rebuild — always rebuild the affected app (nginx is not tracked by nx affected) | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^nginx/app.default.conf' && APPS_TO_BUILD="$APPS_TO_BUILD dashboard" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^nginx/rao.default.conf' && APPS_TO_BUILD="$APPS_TO_BUILD rao" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^nginx/platform.default.conf' && APPS_TO_BUILD="$APPS_TO_BUILD platform" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^nginx/auth.default.conf' && APPS_TO_BUILD="$APPS_TO_BUILD auth" | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^nginx/manager.default.conf' && APPS_TO_BUILD="$APPS_TO_BUILD manager-v2" | |
| # mrs.developer.json changes affect dashboard dependencies — rebuild dashboard if not already built | |
| git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -q '^mrs\.developer\.json' && ! test -d dist/apps/dashboard && APPS_TO_BUILD="$APPS_TO_BUILD dashboard" | |
| if [ -n "$APPS_TO_BUILD" ]; then | |
| echo "Building apps with chart changes:$APPS_TO_BUILD" | |
| for app in $APPS_TO_BUILD; do | |
| npx nx build $app --configuration production | |
| done | |
| fi | |
| - name: Get package version | |
| run: node -p -e '`PACKAGE_VERSION=${require("./package.json").version}`' >> $GITHUB_ENV | |
| - name: Tag if new version | |
| uses: pkgdeps/git-tag-action@a5a161774bace8b4e1969dd850c67a7421f1b710 # v3.0.1 | |
| if: github.ref == 'refs/heads/main' | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| github_repo: ${{ github.repository }} | |
| version: ${{ env.PACKAGE_VERSION }} | |
| git_commit_sha: ${{ github.sha }} | |
| git_tag_prefix: 'v' | |
| - name: Check apps to deploy | |
| id: check-deploy | |
| run: |- | |
| (test -d dist/libs/search-widget && echo "deploy-widget=yes" >> $GITHUB_OUTPUT) || echo "Widget unchanged" | |
| (test -d dist/rao-widget && echo "deploy-rao-widget=yes" >> $GITHUB_OUTPUT) || echo "RAO Widget unchanged" | |
| (test -d dist/apps/dashboard && echo "deploy-app=yes" >> $GITHUB_OUTPUT) || echo "Dashboard unchanged" | |
| (test -d dist/apps/rao && echo "deploy-rao=yes" >> $GITHUB_OUTPUT) || echo "RAO app unchanged" | |
| (test -d dist/apps/platform && echo "deploy-platform=yes" >> $GITHUB_OUTPUT) || echo "Platform app unchanged" | |
| (test -d dist/apps/auth && echo "deploy-auth=yes" >> $GITHUB_OUTPUT) || echo "auth app unchanged" | |
| (test -d dist/apps/nucliadb-admin && echo "deploy-nucliadb-admin=yes" >> $GITHUB_OUTPUT) || echo "NucliaDB admin unchanged" | |
| (test -d dist/apps/manager-v2 && echo "deploy-manager=yes" >> $GITHUB_OUTPUT) || echo "Manager unchanged" | |
| (test -d dist/apps/sistema-demo && echo "deploy-sistema=yes" >> $GITHUB_OUTPUT) || echo "Sistema demo unchanged" | |
| (test -d dist/sdk-core && echo "deploy-sdk=yes" >> $GITHUB_OUTPUT) || echo "SDK unchanged" | |
| - name: Publish widget to GCS | |
| if: steps.check-deploy.outputs.deploy-widget == 'yes' && github.ref == 'refs/heads/dev' | |
| run: |- | |
| find dist/libs/search-widget -type f -name *.umd.js -exec sed -i.bak "s,__NUCLIA_DEV_VERSION__,$GITHUB_SHA,g" {} \; | |
| gsutil copy dist/libs/search-widget/*.umd.js gs://$CDN_STORAGE | |
| gsutil copy -r libs/search-widget/public/* gs://$CDN_STORAGE | |
| - name: Publish widget to S3 | |
| if: steps.check-deploy.outputs.deploy-widget == 'yes' && github.ref == 'refs/heads/main' | |
| run: |- | |
| find dist/libs/search-widget -type f -name *.umd.js -exec sed -i.bak "s,__NUCLIA_DEV_VERSION__,$GITHUB_SHA,g" {} \; | |
| aws s3 cp dist/libs/search-widget/ s3://$S3_CDN_STORAGE/ --recursive --exclude "*" --include "*.umd.js" | |
| aws s3 cp libs/search-widget/public/ s3://$S3_CDN_STORAGE/ --recursive | |
| - name: Publish RAO widget to GCS | |
| if: steps.check-deploy.outputs.deploy-rao-widget == 'yes' && github.ref == 'refs/heads/dev' | |
| run: |- | |
| find dist/rao-widget -type f -name *.umd.js -exec sed -i.bak "s,__NUCLIA_DEV_VERSION__,$GITHUB_SHA,g" {} \; | |
| gsutil copy dist/rao-widget/*.umd.js gs://$CDN_STORAGE | |
| - name: Publish widget to S3 | |
| if: steps.check-deploy.outputs.deploy-rao-widget == 'yes' && github.ref == 'refs/heads/main' | |
| run: |- | |
| find dist/rao-widget -type f -name *.umd.js -exec sed -i.bak "s,__NUCLIA_DEV_VERSION__,$GITHUB_SHA,g" {} \; | |
| aws s3 cp dist/rao-widget/ s3://$S3_CDN_STORAGE/ --recursive --exclude "*" --include "*.umd.js" | |
| - name: Publish SDK | |
| if: steps.check-deploy.outputs.deploy-sdk == 'yes' && github.ref == 'refs/heads/main' | |
| env: | |
| NPM_CONFIG_PROVENANCE: false | |
| NPM_CONFIG_REGISTRY: https://registry.npmjs.org/ | |
| run: |- | |
| cd ./dist/sdk-core | |
| npm publish || true | |
| cd - | |
| - name: Push SDK to GCP CDN | |
| if: steps.check-deploy.outputs.deploy-sdk == 'yes' && github.ref == 'refs/heads/dev' | |
| run: |- | |
| gsutil copy dist/sdk-core/umd/index.js gs://$CDN_STORAGE/nuclia-sdk.umd.js | |
| - name: Push SDK to S3 CDN | |
| if: steps.check-deploy.outputs.deploy-sdk == 'yes' && github.ref == 'refs/heads/main' | |
| run: |- | |
| aws s3 cp dist/sdk-core/umd/index.js s3://$S3_CDN_STORAGE/nuclia-sdk.umd.js | |
| - name: Invalidate CDN cache stage | |
| if: ${{ ( steps.check-deploy.outputs.deploy-widget == 'yes' || steps.check-deploy.outputs.deploy-rao-widget == 'yes' || steps.check-deploy.outputs.deploy-sdk == 'yes') && github.ref == 'refs/heads/dev' }} | |
| env: | |
| GCP_PROJECT: ${{ secrets.GCP_DEV_PROJECT_ID }} | |
| URL_MAP_NAME: ${{ secrets.CDN_URL_MAP_NAME_DEV }} | |
| run: | | |
| gcloud compute url-maps invalidate-cdn-cache ${URL_MAP_NAME} --path "/*" --global --project ${GCP_PROJECT} | |
| - name: Generate and push SDK docs to GCS | |
| if: steps.check-deploy.outputs.deploy-sdk == 'yes' && github.ref == 'refs/heads/dev' | |
| run: |- | |
| sh ./tools/build-sdk-docs.sh | |
| gsutil -m rsync -r ./libs/sdk-core/docs gs://$DOCS_STORAGE/js-sdk | |
| - name: Generate and push SDK docs to S3 | |
| if: steps.check-deploy.outputs.deploy-sdk == 'yes' && github.ref == 'refs/heads/main' | |
| run: |- | |
| sh ./tools/build-sdk-docs.sh | |
| aws s3 cp ./libs/sdk-core/docs s3://$S3_DOCS_STORAGE/js-sdk --recursive | |
| - name: Generate a token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| owner: nuclia | |
| repositories: tooling | |
| permission-contents: read | |
| - name: Checkout tooling repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: nuclia/tooling | |
| ref: main | |
| path: tooling | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: false | |
| - name: Push dashboard image to registries | |
| uses: ./tooling/.github/actions/build-img-regcache | |
| if: steps.check-deploy.outputs.deploy-app == 'yes' | |
| with: | |
| build-arg: | | |
| appId=app | |
| appFolder=dashboard | |
| noRelativeCss=true | |
| file: docker/Dockerfile | |
| image-name: ${{ env.APP_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| aws-ecr-role: ${{ secrets.AWS_ECR_ROLE }} | |
| push: true | |
| tag-latest: main | |
| ghapp-nuclia-service-bot-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| ghapp-nuclia-service-bot-pk: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| - name: Publish NucliaDB admin app | |
| if: steps.check-deploy.outputs.deploy-nucliadb-admin == 'yes' && github.ref == 'refs/heads/main' | |
| run: |- | |
| sed -i.bak "s,STF_DOCKER_CONFIG_VERSION,$GITHUB_SHA,g" dist/apps/nucliadb-admin/assets/deployment/app-config.json | |
| cp -r dist/apps/nucliadb-admin/* tools/python-nucliadb-admin-dist/nucliadb_admin_assets/ | |
| make -C tools/python-nucliadb-admin-dist/ publish ARGS="--build=${{github.run_number}}" | |
| env: | |
| TWINE_USERNAME: __token__ | |
| TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }} | |
| - name: Push manager image to registries | |
| uses: ./tooling/.github/actions/build-img-regcache | |
| if: steps.check-deploy.outputs.deploy-manager == 'yes' | |
| with: | |
| build-arg: | | |
| appId=manager | |
| appFolder=manager-v2 | |
| noRelativeCss=true | |
| file: docker/Dockerfile | |
| image-name: ${{ env.MANAGER_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| aws-ecr-role: ${{ secrets.AWS_ECR_ROLE }} | |
| skip-context-creation: ${{ steps.check-deploy.outputs.deploy-app == 'yes' }} | |
| push: true | |
| tag-latest: main | |
| ghapp-nuclia-service-bot-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| ghapp-nuclia-service-bot-pk: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| - name: Push RAO image to registries | |
| uses: ./tooling/.github/actions/build-img-regcache | |
| if: steps.check-deploy.outputs.deploy-rao == 'yes' | |
| with: | |
| build-arg: | | |
| appId=rao | |
| appFolder=rao | |
| noRelativeCss=true | |
| file: docker/Dockerfile | |
| image-name: ${{ env.RAO_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| aws-ecr-role: ${{ secrets.AWS_ECR_ROLE }} | |
| skip-context-creation: ${{ steps.check-deploy.outputs.deploy-manager == 'yes' || steps.check-deploy.outputs.deploy-app == 'yes' }} | |
| push: true | |
| tag-latest: main | |
| ghapp-nuclia-service-bot-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| ghapp-nuclia-service-bot-pk: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| - name: Push Platform image to registries | |
| uses: ./tooling/.github/actions/build-img-regcache | |
| if: steps.check-deploy.outputs.deploy-platform == 'yes' | |
| with: | |
| build-arg: | | |
| appId=platform | |
| appFolder=platform | |
| noRelativeCss=true | |
| file: docker/Dockerfile | |
| image-name: ${{ env.PLATFORM_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| aws-ecr-role: ${{ secrets.AWS_ECR_ROLE }} | |
| skip-context-creation: ${{ steps.check-deploy.outputs.deploy-manager == 'yes' || steps.check-deploy.outputs.deploy-app == 'yes' }} | |
| push: true | |
| tag-latest: main | |
| ghapp-nuclia-service-bot-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| ghapp-nuclia-service-bot-pk: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| - name: Push auth image to registries | |
| uses: ./tooling/.github/actions/build-img-regcache | |
| if: steps.check-deploy.outputs.deploy-auth == 'yes' | |
| with: | |
| build-arg: | | |
| appId=auth | |
| appFolder=auth | |
| noRelativeCss=true | |
| file: docker/Dockerfile | |
| image-name: ${{ env.AUTH_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| aws-ecr-role: ${{ secrets.AWS_ECR_ROLE }} | |
| skip-context-creation: ${{ steps.check-deploy.outputs.deploy-manager == 'yes' || steps.check-deploy.outputs.deploy-app == 'yes' || steps.check-deploy.outputs.deploy-rao == 'yes' }} | |
| push: true | |
| tag-latest: main | |
| ghapp-nuclia-service-bot-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| ghapp-nuclia-service-bot-pk: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| - name: Create 404 page for gh-pages | |
| if: steps.check-deploy.outputs.deploy-sistema == 'yes' && github.ref == 'refs/heads/main' | |
| run: |- | |
| cp dist/apps/sistema-demo/index.html dist/apps/sistema-demo/404.html | |
| - name: Deploy sistema-demo to GH pages | |
| if: steps.check-deploy.outputs.deploy-sistema == 'yes' && github.ref == 'refs/heads/main' | |
| uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0 | |
| with: | |
| folder: dist/apps/sistema-demo | |
| - name: Upload sourcemaps to Sentry | |
| uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3.7.0 | |
| if: github.ref == 'refs/heads/main' | |
| env: | |
| SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }} | |
| SENTRY_ORG: nuclia | |
| SENTRY_PROJECT: application | |
| deploy-app: | |
| name: Deploy dashboard | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: needs.build.outputs.deploy-app == 'yes' | |
| permissions: | |
| id-token: write # required by google-github-actions/auth (OIDC) | |
| contents: read # required by actions/checkout | |
| outputs: | |
| json-summary: | | |
| { | |
| "components": [ | |
| { | |
| "component": "app", | |
| "chart-version": "${{ steps.chart-version-app.outputs.chart-version }}", | |
| "component-type": "global" | |
| } | |
| ] | |
| } | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Authenticate to Google Cloud | |
| id: gcp-auth | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 | |
| with: | |
| workload_identity_provider: '${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}' | |
| service_account: '${{ env.GCP_SERVICE_ACCOUNT }}' | |
| token_format: access_token | |
| - name: Login to Google Artifact Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: europe-west4-docker.pkg.dev | |
| username: oauth2accesstoken | |
| password: ${{ steps.gcp-auth.outputs.access_token }} | |
| - name: Calculate short sha | |
| run: echo "SHORT_SHA=`echo hash${GITHUB_SHA} | cut -c1-12`" >> $GITHUB_ENV | |
| - name: Generate a token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| owner: nuclia | |
| repositories: tooling | |
| permission-contents: read | |
| - name: Checkout tooling repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: nuclia/tooling | |
| ref: main | |
| path: tooling | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: false | |
| - name: Get chart version | |
| id: chart-version-app | |
| run: | | |
| VERSION=`cat apps/dashboard/VERSION` | |
| echo "chart-version=$VERSION-${SHORT_SHA}" >> $GITHUB_OUTPUT | |
| - name: Build and push helm chart | |
| uses: ./tooling/.github/actions/build-helm-chart | |
| with: | |
| component: ${{ env.APP_IMAGE_NAME }} | |
| chart-version: ${{ steps.chart-version-app.outputs.chart-version }} | |
| image-name: ${{ env.APP_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| hash: ${{ env.SHORT_SHA }} | |
| helm-chart-url: ${{ secrets.HELM_CHART_URL }} | |
| chart-dir: './charts/${{ env.APP_IMAGE_NAME }}' | |
| helm-version: v3.15.3 | |
| push-to-artifact-registry: true | |
| deploy-manager: | |
| name: Deploy manager | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: needs.build.outputs.deploy-manager == 'yes' | |
| permissions: | |
| id-token: write # required by google-github-actions/auth (OIDC) | |
| contents: read # required by actions/checkout | |
| outputs: | |
| json-summary: | | |
| { | |
| "components": [ | |
| { | |
| "component": "manager", | |
| "chart-version": "${{ steps.chart-version-manager.outputs.chart-version }}", | |
| "component-type": "global" | |
| } | |
| ] | |
| } | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Authenticate to Google Cloud | |
| id: gcp-auth | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 | |
| with: | |
| workload_identity_provider: '${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}' | |
| service_account: '${{ env.GCP_SERVICE_ACCOUNT }}' | |
| token_format: access_token | |
| - name: Login to Google Artifact Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: europe-west4-docker.pkg.dev | |
| username: oauth2accesstoken | |
| password: ${{ steps.gcp-auth.outputs.access_token }} | |
| - name: Calculate short sha | |
| run: echo "SHORT_SHA=`echo hash${GITHUB_SHA} | cut -c1-12`" >> $GITHUB_ENV | |
| - name: Generate a token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| owner: nuclia | |
| repositories: tooling | |
| permission-contents: read | |
| - name: Checkout tooling repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: nuclia/tooling | |
| ref: main | |
| path: tooling | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: false | |
| - name: Get chart version | |
| id: chart-version-manager | |
| run: | | |
| VERSION=`cat apps/manager-v2/VERSION` | |
| echo "chart-version=$VERSION-${SHORT_SHA}" >> $GITHUB_OUTPUT | |
| - name: Build and push helm chart | |
| uses: ./tooling/.github/actions/build-helm-chart | |
| with: | |
| component: ${{ env.MANAGER_IMAGE_NAME }} | |
| chart-version: ${{ steps.chart-version-manager.outputs.chart-version }} | |
| image-name: ${{ env.MANAGER_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| hash: ${{ env.SHORT_SHA }} | |
| helm-chart-url: ${{ secrets.HELM_CHART_URL }} | |
| chart-dir: './charts/${{ env.MANAGER_IMAGE_NAME }}' | |
| helm-version: v3.15.3 | |
| push-to-artifact-registry: true | |
| deploy-rao: | |
| name: Deploy rao | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: needs.build.outputs.deploy-rao == 'yes' | |
| permissions: | |
| id-token: write # required by google-github-actions/auth (OIDC) | |
| contents: read # required by actions/checkout | |
| outputs: | |
| json-summary: | | |
| { | |
| "components": [ | |
| { | |
| "component": "rao", | |
| "chart-version": "${{ steps.chart-version-rao.outputs.chart-version }}", | |
| "component-type": "global" | |
| } | |
| ] | |
| } | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Authenticate to Google Cloud | |
| id: gcp-auth | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 | |
| with: | |
| workload_identity_provider: '${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}' | |
| service_account: '${{ env.GCP_SERVICE_ACCOUNT }}' | |
| token_format: access_token | |
| - name: Login to Google Artifact Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: europe-west4-docker.pkg.dev | |
| username: oauth2accesstoken | |
| password: ${{ steps.gcp-auth.outputs.access_token }} | |
| - name: Calculate short sha | |
| run: echo "SHORT_SHA=`echo hash${GITHUB_SHA} | cut -c1-12`" >> $GITHUB_ENV | |
| - name: Generate a token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| owner: nuclia | |
| repositories: tooling | |
| permission-contents: read | |
| - name: Checkout tooling repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: nuclia/tooling | |
| ref: main | |
| path: tooling | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: false | |
| - name: Get chart version | |
| id: chart-version-rao | |
| run: | | |
| VERSION=`cat apps/rao/VERSION` | |
| echo "chart-version=$VERSION-${SHORT_SHA}" >> $GITHUB_OUTPUT | |
| - name: Build and push helm chart | |
| uses: ./tooling/.github/actions/build-helm-chart | |
| with: | |
| component: ${{ env.RAO_IMAGE_NAME }} | |
| chart-version: ${{ steps.chart-version-rao.outputs.chart-version }} | |
| image-name: ${{ env.RAO_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| hash: ${{ env.SHORT_SHA }} | |
| helm-chart-url: ${{ secrets.HELM_CHART_URL }} | |
| chart-dir: './charts/${{ env.RAO_IMAGE_NAME }}' | |
| helm-version: v3.15.3 | |
| push-to-artifact-registry: true | |
| deploy-platform: | |
| name: Deploy platform | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: needs.build.outputs.deploy-platform == 'yes' | |
| permissions: | |
| id-token: write # required by google-github-actions/auth (OIDC) | |
| contents: read # required by actions/checkout | |
| outputs: | |
| json-summary: | | |
| { | |
| "components": [ | |
| { | |
| "component": "platform", | |
| "chart-version": "${{ steps.chart-version-platform.outputs.chart-version }}", | |
| "component-type": "global" | |
| } | |
| ] | |
| } | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Authenticate to Google Cloud | |
| id: gcp-auth | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 | |
| with: | |
| workload_identity_provider: '${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}' | |
| service_account: '${{ env.GCP_SERVICE_ACCOUNT }}' | |
| token_format: access_token | |
| - name: Login to Google Artifact Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: europe-west4-docker.pkg.dev | |
| username: oauth2accesstoken | |
| password: ${{ steps.gcp-auth.outputs.access_token }} | |
| - name: Calculate short sha | |
| run: echo "SHORT_SHA=`echo hash${GITHUB_SHA} | cut -c1-12`" >> $GITHUB_ENV | |
| - name: Generate a token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| owner: nuclia | |
| repositories: tooling | |
| permission-contents: read | |
| - name: Checkout tooling repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: nuclia/tooling | |
| ref: main | |
| path: tooling | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: false | |
| - name: Get chart version | |
| id: chart-version-platform | |
| run: | | |
| VERSION=`cat apps/platform/VERSION` | |
| echo "chart-version=$VERSION-${SHORT_SHA}" >> $GITHUB_OUTPUT | |
| - name: Build and push helm chart | |
| uses: ./tooling/.github/actions/build-helm-chart | |
| with: | |
| component: ${{ env.PLATFORM_IMAGE_NAME }} | |
| chart-version: ${{ steps.chart-version-platform.outputs.chart-version }} | |
| image-name: ${{ env.PLATFORM_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| hash: ${{ env.SHORT_SHA }} | |
| helm-chart-url: ${{ secrets.HELM_CHART_URL }} | |
| chart-dir: './charts/${{ env.PLATFORM_IMAGE_NAME }}' | |
| helm-version: v3.15.3 | |
| push-to-artifact-registry: true | |
| deploy-auth: | |
| name: Deploy auth | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: needs.build.outputs.deploy-auth == 'yes' | |
| permissions: | |
| id-token: write # required by google-github-actions/auth (OIDC) | |
| contents: read # required by actions/checkout | |
| outputs: | |
| json-summary: | | |
| { | |
| "components": [ | |
| { | |
| "component": "auth", | |
| "chart-version": "${{ steps.chart-version-auth.outputs.chart-version }}", | |
| "component-type": "global" | |
| } | |
| ] | |
| } | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Authenticate to Google Cloud | |
| id: gcp-auth | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 | |
| with: | |
| workload_identity_provider: '${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}' | |
| service_account: '${{ env.GCP_SERVICE_ACCOUNT }}' | |
| token_format: access_token | |
| - name: Login to Google Artifact Registry | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: europe-west4-docker.pkg.dev | |
| username: oauth2accesstoken | |
| password: ${{ steps.gcp-auth.outputs.access_token }} | |
| - name: Calculate short sha | |
| run: echo "SHORT_SHA=`echo hash${GITHUB_SHA} | cut -c1-12`" >> $GITHUB_ENV | |
| - name: Generate a token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| owner: nuclia | |
| repositories: tooling | |
| permission-contents: read | |
| - name: Checkout tooling repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| repository: nuclia/tooling | |
| ref: main | |
| path: tooling | |
| token: ${{ steps.app-token.outputs.token }} | |
| persist-credentials: false | |
| - name: Get chart version | |
| id: chart-version-auth | |
| run: | | |
| VERSION=`cat apps/auth/VERSION` | |
| echo "chart-version=$VERSION-${SHORT_SHA}" >> $GITHUB_OUTPUT | |
| - name: Build and push helm chart | |
| uses: ./tooling/.github/actions/build-helm-chart | |
| with: | |
| component: ${{ env.AUTH_IMAGE_NAME }} | |
| chart-version: ${{ steps.chart-version-auth.outputs.chart-version }} | |
| image-name: ${{ env.AUTH_IMAGE_NAME }} | |
| image-version: ${{ env.SHORT_SHA }} | |
| hash: ${{ env.SHORT_SHA }} | |
| helm-chart-url: ${{ secrets.HELM_CHART_URL }} | |
| chart-dir: './charts/${{ env.AUTH_IMAGE_NAME }}' | |
| helm-version: v3.15.3 | |
| push-to-artifact-registry: true | |
| send-to-promotion: | |
| runs-on: ubuntu-latest | |
| needs: [deploy-manager, deploy-app, deploy-rao, deploy-platform, deploy-auth] | |
| permissions: {} # no GITHUB_TOKEN scopes needed; dispatch uses a scoped GitHub App token | |
| if: | | |
| !failure() && !cancelled() && github.event_name == 'push' && | |
| ( needs.deploy-manager.result != 'skipped' || | |
| needs.deploy-app.result != 'skipped' || | |
| needs.deploy-auth.result != 'skipped' || | |
| needs.deploy-rao.result != 'skipped' || | |
| needs.deploy-platform.result != 'skipped' ) | |
| steps: | |
| - name: Generate a token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }} | |
| private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }} | |
| owner: nuclia | |
| repositories: core-apps | |
| # POST /repos/{owner}/{repo}/dispatches requires contents: write | |
| permission-contents: write | |
| - name: Create components promotion summary. Trigger1 | |
| env: | |
| SKIP_QUEUE: ${{ contains(github.event.pull_request.labels.*.name, 'skip-promo-queue') }} | |
| SKIP_ARGO_HEALTH: false | |
| ENVIRONMENT: ${{ github.ref == 'refs/heads/main' && 'stage' || 'dev' }} | |
| PROMO_PRODUCTION: ${{ env.PROMO_PRODUCTION }} | |
| TEAM: ${{ secrets.TEAM_NAME }} | |
| SLACK_TEAM: ${{ secrets.SLACK_TEAM }} | |
| NEEDS_DEPLOY_RAO_OUTPUTS_JSON_SUMMARY: ${{ needs.deploy-rao.outputs.json-summary }} | |
| NEEDS_DEPLOY_PLATFORM_OUTPUTS_JSON_SUMMARY: ${{ needs.deploy-platform.outputs.json-summary }} | |
| NEEDS_DEPLOY_MANAGER_OUTPUTS_JSON_SUMMARY: ${{ needs.deploy-manager.outputs.json-summary }} | |
| NEEDS_DEPLOY_APP_OUTPUTS_JSON_SUMMARY: ${{ needs.deploy-app.outputs.json-summary }} | |
| NEEDS_DEPLOY_AUTH_OUTPUTS_JSON_SUMMARY: ${{ needs.deploy-auth.outputs.json-summary }} | |
| run: | | |
| MERGED_JSON=$(jq -cs \ | |
| --arg environment "$ENVIRONMENT" \ | |
| --arg skip_queue "$SKIP_QUEUE" \ | |
| --arg promo_production "$PROMO_PRODUCTION" \ | |
| --arg team "$TEAM" \ | |
| --arg slack_team "$SLACK_TEAM" \ | |
| --arg skip_argo_health "$SKIP_ARGO_HEALTH" \ | |
| --arg commit_sha "${{ github.sha }}" \ | |
| '{ | |
| components: map(.components) | add | |
| } + { | |
| skip_promo_queue: ($skip_queue == "true") | |
| } + { | |
| skip_argo_health: ($skip_argo_health == "true") | |
| } + { | |
| environment: $environment | |
| } + { | |
| promo_production: ($promo_production == "true") | |
| } + { | |
| team: $team | |
| } + { | |
| slack_team: $slack_team | |
| } + { | |
| tests: { | |
| "run-e2e": true, | |
| "run-nuclia-e2e": false | |
| } | |
| } + { | |
| "commit-sha": $commit_sha | |
| }' \ | |
| <(echo "${NEEDS_DEPLOY_RAO_OUTPUTS_JSON_SUMMARY}") \ | |
| <(echo "${NEEDS_DEPLOY_PLATFORM_OUTPUTS_JSON_SUMMARY}") \ | |
| <(echo "${NEEDS_DEPLOY_MANAGER_OUTPUTS_JSON_SUMMARY}") \ | |
| <(echo "${NEEDS_DEPLOY_APP_OUTPUTS_JSON_SUMMARY}") \ | |
| <(echo "${NEEDS_DEPLOY_AUTH_OUTPUTS_JSON_SUMMARY}") | |
| ) | |
| echo "JSON_PROMO_SUMMARY=$MERGED_JSON" >> $GITHUB_ENV | |
| - name: Send to promotion queue | |
| id: send-to-promo | |
| uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| repository: nuclia/core-apps | |
| event-type: promotions | |
| client-payload: '${{ env.JSON_PROMO_SUMMARY }}' |