Webchat Deploy #85
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (C) 2021-2023 Technology Matters | |
| # This program is free software: you can redistribute it and/or modify | |
| # it under the terms of the GNU Affero General Public License as published | |
| # by the Free Software Foundation, either version 3 of the License, or | |
| # (at your option) any later version. | |
| # | |
| # This program is distributed in the hope that it will be useful, | |
| # but WITHOUT ANY WARRANTY; without even the implied warranty of | |
| # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
| # GNU Affero General Public License for more details. | |
| # | |
| # You should have received a copy of the GNU Affero General Public License | |
| # along with this program. If not, see https://www.gnu.org/licenses/. | |
| # Upload Webchat to S3 bucket with Github Actions | |
| name: Webchat Deploy | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| helpline_code: | |
| description: "The short (usually 2 character) upper case code used to identify the helpline internally, e.g. ZA, IN, BR." | |
| required: true | |
| type: string | |
| environment: | |
| description: "Helpline Environment: development, staging, production" | |
| required: true | |
| type: string | |
| recaptcha_verify_url: | |
| description: "Recaptcha Verify URL" | |
| required: false | |
| type: string | |
| workflow_call: | |
| inputs: | |
| helpline_code: | |
| description: "The short (usually 2 character) upper case code used to identify the helpline internally, e.g. ZA, IN, BR." | |
| required: true | |
| type: string | |
| environment: | |
| description: "Helpline Environment" | |
| required: true | |
| type: string | |
| recaptcha_verify_url: | |
| description: "Recaptcha Verify URL" | |
| required: false | |
| type: string | |
| send-slack-message: | |
| description: If set to false a slack message will not be sent - useful for E2E test deploys. | |
| default: 'true' | |
| type: string | |
| env: | |
| recaptcha_verify_url_default: https://hrm-${{ inputs.environment }}.tl.techmatters.org/lambda/recaptchaVerify | |
| # this is part of a dirty hack to get the right recaptcha_verify_url | |
| recaptcha_verify_url_ca: https://hrm-production-ca.tl.techmatters.org/lambda/recaptchaVerify | |
| # A workflow run is made up of one or more jobs that can run sequentially or in parallel | |
| jobs: | |
| # This workflow contains a single job called "build" | |
| build: | |
| # The type of runner that the job will run on | |
| runs-on: ubuntu-latest | |
| # Steps represent a sequence of tasks that will be executed as part of the job | |
| steps: | |
| # Change String Case for Helpline Code | |
| - name: Change String Case for Helpline Code | |
| id: helpline_code | |
| uses: "ASzc/change-string-case-action@v6" | |
| with: | |
| string: "${{ inputs.helpline_code }}" | |
| # Set SHORT_ENVIRONMENT_CODE | |
| - name: Production Environment | |
| if: inputs.environment == 'production' | |
| run: echo "SHORT_ENVIRONMENT_CODE=prod" >> $GITHUB_ENV | |
| - name: Staging Environment | |
| if: inputs.environment == 'staging' | |
| run: echo "SHORT_ENVIRONMENT_CODE=stg" >> $GITHUB_ENV | |
| - name: Development Environment | |
| if: inputs.environment == 'development' | |
| run: echo "SHORT_ENVIRONMENT_CODE=dev" >> $GITHUB_ENV | |
| # Setup credentials to access AWS for parameters | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: "us-east-1" | |
| # Get AWS parameters | |
| - name: Set GITHUB_ACTIONS_SLACK_BOT_TOKEN | |
| uses: "marvinpinto/action-inject-ssm-secrets@latest" | |
| with: | |
| ssm_parameter: "GITHUB_ACTIONS_SLACK_BOT_TOKEN" | |
| env_variable_name: "GITHUB_ACTIONS_SLACK_BOT_TOKEN" | |
| - name: Set ASELO_DEPLOYS_CHANNEL_ID | |
| uses: "marvinpinto/action-inject-ssm-secrets@latest" | |
| with: | |
| ssm_parameter: "ASELO_DEPLOYS_CHANNEL_ID" | |
| env_variable_name: "ASELO_DEPLOYS_CHANNEL_ID" | |
| - name: Set IP_FIND_API_KEY | |
| uses: "marvinpinto/action-inject-ssm-secrets@latest" | |
| with: | |
| ssm_parameter: "IP_FIND_API_KEY" | |
| env_variable_name: "IP_FIND_API_KEY" | |
| - name: Set ACCOUNT_SID | |
| uses: "marvinpinto/action-inject-ssm-secrets@latest" | |
| with: | |
| ssm_parameter: "/${{ inputs.environment }}/twilio/${{ inputs.helpline_code }}/account_sid" | |
| env_variable_name: "ACCOUNT_SID" | |
| - name: Set SERVERLESS_URL | |
| uses: "marvinpinto/action-inject-ssm-secrets@latest" | |
| with: | |
| ssm_parameter: "/${{ inputs.environment }}/serverless/${{ env.ACCOUNT_SID }}/base_url" | |
| env_variable_name: "SERVERLESS_URL" | |
| - name: Set RECAPTCHA_KEY | |
| uses: "marvinpinto/action-inject-ssm-secrets@latest" | |
| with: | |
| ssm_parameter: "/global/google/recaptcha/site_key" | |
| env_variable_name: "RECAPTCHA_KEY" | |
| # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it | |
| - uses: actions/checkout@v4 | |
| - name: Use Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "18.x" | |
| # Create and fill secret.ts | |
| - name: Create secret.ts | |
| run: | | |
| touch ./private/secret.ts | |
| working-directory: ./webchat | |
| # this is part of a dirty hack to get the right recaptcha_verify_url | |
| - name: set FALLBACK_RECAPTCHA_VERIFY_URL | |
| id: set_fallback_recaptcha_verify_url | |
| run: echo "FALLBACK_RECAPTCHA_VERIFY_URL=${{ inputs.helpline_code == 'CA' && env.recaptcha_verify_url_ca || env.recaptcha_verify_url_default }}" >> $GITHUB_ENV | |
| # This includes a dirty hack to get the recaptcha_verify_url into the secret.ts file with the correct region for CA | |
| # We should really start adding a helpline specific HRM url to the SSM parameters as part of twilio_iac and pulling | |
| # that in here, but this will do for now. | |
| - name: Fill secret.ts | |
| run: | | |
| cat <<EOT >> ./private/secret.ts | |
| export const API_KEY = '${{ env.IP_FIND_API_KEY }}'; | |
| export const SERVERLESS_URL = '${{ env.SERVERLESS_URL }}'; | |
| export const RECAPTCHA_KEY = '${{ env.RECAPTCHA_KEY }}'; | |
| export const RECAPTCHA_VERIFY_URL = '${{ inputs.recaptcha_verify_url || env.FALLBACK_RECAPTCHA_VERIFY_URL }}'; | |
| EOT | |
| working-directory: ./webchat | |
| # Run a single command using the runners shell to install dependencies | |
| - name: Install dependencies | |
| run: npm ci | |
| working-directory: ./webchat | |
| # Get the blockedIps for as-dev account | |
| - name: Get blockedIps for as-dev | |
| if: ${{ steps.helpline_code.outputs.lowercase }}-$SHORT_ENVIRONMENT_CODE == as-dev | |
| run: curl -o ./src/blockedIps.json https://tl-public-chat-as-dev.s3.amazonaws.com/blockedIps.json | |
| working-directory: ./webchat | |
| shell: bash | |
| # Get the blockedIps for jm-prod account | |
| - name: Get blockedIps for jm-prod | |
| if: ${{ steps.helpline_code.outputs.lowercase }}-$SHORT_ENVIRONMENT_CODE == jm-prod | |
| run: curl -o ./src/blockedIps.json https://tl-public-chat-jm-prod.s3.amazonaws.com/blockedIps.json | |
| working-directory: ./webchat | |
| shell: bash | |
| # Build and compile Webchat using the corresponding config file | |
| - name: Run build command | |
| run: CONFIG=${{ steps.helpline_code.outputs.lowercase }}-${{ inputs.environment }} npm run build | |
| working-directory: ./webchat | |
| # Rename the builded js file | |
| - name: Rename js | |
| run: mv bundle.js aselo-chat.min.js | |
| working-directory: ./webchat/build | |
| # Upload Webchat to S3 bucket | |
| - name: Upload Webchat to S3 bucket | |
| uses: jakejarvis/s3-sync-action@master | |
| with: | |
| args: --acl public-read --follow-symlinks --exclude '*' --include '*.js' --content-type 'application/javascript; charset=utf-8' | |
| env: | |
| AWS_S3_BUCKET: tl-public-chat-${{ steps.helpline_code.outputs.lowercase }}-$SHORT_ENVIRONMENT_CODE | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| AWS_REGION: "${{ secrets.AWS_DEFAULT_REGION }}" | |
| SOURCE_DIR: "webchat/build" | |
| - name: Upload Webchat bundle to assets S3 bucket | |
| uses: jakejarvis/s3-sync-action@master | |
| with: | |
| args: --acl public-read --follow-symlinks --exclude '*' --include '*.js' --content-type 'application/javascript; charset=utf-8' | |
| env: | |
| AWS_S3_BUCKET: assets-${{ inputs.environment }}.tl.techmatters.org | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| AWS_REGION: "${{ secrets.AWS_DEFAULT_REGION }}" | |
| SOURCE_DIR: "webchat/build" | |
| DEST_DIR: "webchat/${{ steps.helpline_code.outputs.lowercase }}" | |
| - name: Upload e2e-chat html file to assets S3 bucket | |
| uses: jakejarvis/s3-sync-action@master | |
| with: | |
| args: --acl public-read --follow-symlinks --exclude '*' --include 'e2e-chat.html' --include 'test-chat.html' --content-type 'text/html; charset=utf-8' | |
| env: | |
| AWS_S3_BUCKET: assets-${{ inputs.environment }}.tl.techmatters.org | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| AWS_REGION: "${{ secrets.AWS_DEFAULT_REGION }}" | |
| SOURCE_DIR: "webchat/build" | |
| DEST_DIR: "webchat/${{ steps.helpline_code.outputs.lowercase }}" | |
| - name: Clear cloudfront cache | |
| run: | | |
| CF_DISTRO=$(aws cloudfront list-distributions --query "DistributionList.Items[*].{id:Id,origin:Origins.Items[0].DomainName}[?origin=='assets-${{ inputs.environment }}.tl.techmatters.org.s3-website.us-east-1.amazonaws.com'].id" --output text) | |
| aws cloudfront create-invalidation --distribution-id $CF_DISTRO --paths /webchat/${{ steps.helpline_code.outputs.lowercase }}/* | |
| # Send Slack notifying success | |
| - name: Slack Aselo channel | |
| id: slack | |
| uses: slackapi/slack-github-action@v2.0.0 | |
| if: ${{ inputs.send-slack-message != 'false' }} | |
| with: | |
| method: chat.postMessage | |
| token: ${{ env.GITHUB_ACTIONS_SLACK_BOT_TOKEN }} | |
| payload: | | |
| channel: ${{ env.ASELO_DEPLOYS_CHANNEL_ID }} | |
| text: '`[WEBCHAT]` Deployment to `${{inputs.helpline_code}}-${{inputs.environment}}` of ${{ github.ref_type }} `${{ github.ref_name }}` requested by `${{ github.triggering_actor }}` completed using workflow '${{ github.workflow }}' with SHA ${{ github.sha }} :rocket:.' | |
| # Update deployment matrix | |
| - name: Update deployment matrix | |
| uses: ./.github/actions/deployment-matrix | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ secrets.AWS_DEFAULT_REGION }} | |
| identifier: ${{ inputs.helpline_code }} | |
| environment: ${{ inputs.environment}} | |
| service_repo: 'webchat' | |
| version_tag: ${{ github.ref_name }} |