kopia lustrzana https://github.com/cloudflare/wildebeest
316 wiersze
12 KiB
YAML
316 wiersze
12 KiB
YAML
name: Deploy
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
repository_dispatch:
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
steps:
|
|
- name: Ensure CF_DEPLOY_DOMAIN and CF_ZONE_ID are defined
|
|
run: |
|
|
if [ -z "$CF_ZONE_ID" ]
|
|
then
|
|
echo "CF_ZONE_ID not defined"
|
|
exit 1
|
|
fi
|
|
if [ -z "$CF_DEPLOY_DOMAIN" ]
|
|
then
|
|
echo "CF_DEPLOY_DOMAIN not defined"
|
|
exit 1
|
|
fi
|
|
env:
|
|
CF_ZONE_ID: ${{ vars.CF_ZONE_ID }}
|
|
CF_DEPLOY_DOMAIN: ${{ vars.CF_DEPLOY_DOMAIN }}
|
|
|
|
# this is needed to get the lowercase version of the repository_owner name
|
|
# and being able to override the suffix when mutliple instances are hosted
|
|
# by the same GitHub account.
|
|
- name: Set name suffix
|
|
run: |
|
|
if [ -z "$OVERRIDE_NAME_SUFFIX" ]
|
|
then
|
|
echo $GH_OWNER | awk '{ print "NAME_SUFFIX=" tolower($0) }' >> ${GITHUB_ENV}
|
|
else
|
|
echo $OVERRIDE_NAME_SUFFIX | awk '{ print "NAME_SUFFIX=" tolower($0) }' >> ${GITHUB_ENV}
|
|
fi
|
|
env:
|
|
GH_OWNER: ${{ github.repository_owner }}
|
|
OVERRIDE_NAME_SUFFIX: ${{ vars.OVERRIDE_NAME_SUFFIX }}
|
|
|
|
- uses: actions/checkout@v2
|
|
- uses: hashicorp/setup-terraform@v2
|
|
|
|
- name: Install package
|
|
run: |
|
|
sudo apt-get -y install jq
|
|
|
|
- name: Setup node.js
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: 18
|
|
|
|
- name: Configure Cloudflare Images variants
|
|
run: |
|
|
curl -XPOST https://api.cloudflare.com/client/v4/accounts/${{ secrets.CF_ACCOUNT_ID }}/images/v1/variants \
|
|
-d '{
|
|
"id": "avatar",
|
|
"options": {
|
|
"metadata": "copyright",
|
|
"width": 400,
|
|
"height": 400
|
|
}
|
|
}' \
|
|
-H 'Authorization: Bearer ${{ secrets.CF_API_TOKEN }}'
|
|
|
|
curl -XPOST https://api.cloudflare.com/client/v4/accounts/${{ secrets.CF_ACCOUNT_ID }}/images/v1/variants \
|
|
-d '{
|
|
"id": "header",
|
|
"options": {
|
|
"metadata": "copyright",
|
|
"width": 1500,
|
|
"height": 500
|
|
}
|
|
}' \
|
|
-H 'Authorization: Bearer ${{ secrets.CF_API_TOKEN }}'
|
|
|
|
curl -XPOST https://api.cloudflare.com/client/v4/accounts/${{ secrets.CF_ACCOUNT_ID }}/images/v1/variants \
|
|
-d '{
|
|
"id": "usercontent",
|
|
"options": {
|
|
"metadata": "copyright"
|
|
}
|
|
}' \
|
|
-H 'Authorization: Bearer ${{ secrets.CF_API_TOKEN }}'
|
|
|
|
- name: Create D1 database
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: d1 create wildebeest-${{ env.NAME_SUFFIX }}
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
continue-on-error: true
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: retrieve D1 database
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: d1 list --json | jq -r '.[] | select(.name == "wildebeest-${{ env.NAME_SUFFIX }}") | .uuid' | awk '{print "d1_id="$1}' >> $GITHUB_ENV
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
preCommands: |
|
|
echo "*** pre commands ***"
|
|
apt-get update && apt-get -y install jq
|
|
echo "******"
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: migrate D1 database
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: d1 migrations apply wildebeest-${{ env.NAME_SUFFIX }}
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
preCommands: |
|
|
echo "*** pre commands ***"
|
|
echo -e "[[d1_databases]]\nbinding=\"DATABASE\"\ndatabase_name=\"wildebeest-${{ env.NAME_SUFFIX }}\"\ndatabase_id=\"${{ env.d1_id }}\"" >> wrangler.toml
|
|
echo "******"
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: retrieve Zero Trust organization
|
|
run: |
|
|
auth_domain=$(curl https://api.cloudflare.com/client/v4/accounts/${{ secrets.CF_ACCOUNT_ID }}/access/organizations \
|
|
-H 'Authorization: Bearer ${{ secrets.CF_API_TOKEN }}' | jq -r '.result.auth_domain')
|
|
printf "auth_domain=$auth_domain" >> $GITHUB_ENV
|
|
|
|
- name: retrieve Terraform state KV namespace
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: kv:namespace list | jq -r '.[] | select( .title == "wildebeest-terraform-${{ env.NAME_SUFFIX }}-state" ) | .id' | awk '{print "tfstate_kv="$1}' >> $GITHUB_ENV
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
preCommands: |
|
|
echo "*** pre commands ***"
|
|
apt-get update && apt-get -y install jq
|
|
echo "******"
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: Init
|
|
run: terraform init
|
|
working-directory: ./tf
|
|
|
|
- name: download Terraform state
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: kv:key get --namespace-id=${{ env.tfstate_kv }} terraform.tfstate > ./tf/terraform.tfstate
|
|
postCommands: |
|
|
echo "*** post commands ***"
|
|
chmod 777 ./tf/terraform.tfstate
|
|
echo "******"
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
if: ${{ env.tfstate_kv != '' }}
|
|
|
|
- name: download VAPID keys
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: kv:key get --namespace-id=${{ env.tfstate_kv }} vapid_jwk | jq . > ./tf/vapid_jwk
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
preCommands: |
|
|
echo "*** pre commands ***"
|
|
apt-get update && apt-get -y install jq
|
|
echo "******"
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
continue-on-error: true
|
|
if: ${{ env.tfstate_kv != '' }}
|
|
|
|
- name: generate VAPID keys if needed
|
|
run: |
|
|
sudo chmod 777 ./tf/vapid_jwk || true
|
|
|
|
if [ ! -s ./tf/vapid_jwk ]
|
|
then
|
|
node ./scripts/generate-vapid-keys.mjs > ./tf/vapid_jwk
|
|
echo "VAPID keys generated"
|
|
fi
|
|
|
|
- name: Publish DO
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
command: publish --config do/wrangler.toml
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: Retrieve DO namespace
|
|
run: |
|
|
curl https://api.cloudflare.com/client/v4/accounts/${{ secrets.CF_ACCOUNT_ID }}/workers/durable_objects/namespaces \
|
|
-H 'Authorization: Bearer ${{ secrets.CF_API_TOKEN }}' \
|
|
| jq -r '.result[] | select( .script == "wildebeest-do" ) | .id' | awk '{print "do_cache_id="$1}' >> $GITHUB_ENV
|
|
|
|
- name: Configure
|
|
run: terraform plan && terraform apply -auto-approve
|
|
working-directory: ./tf
|
|
env:
|
|
TF_VAR_cloudflare_account_id: ${{ secrets.CF_ACCOUNT_ID }}
|
|
TF_VAR_cloudflare_api_token: ${{ secrets.CF_API_TOKEN }}
|
|
TF_VAR_cloudflare_zone_id: ${{ vars.CF_ZONE_ID }}
|
|
TF_VAR_cloudflare_deploy_domain: ${{ vars.CF_DEPLOY_DOMAIN }}
|
|
TF_VAR_name_suffix: ${{ env.NAME_SUFFIX }}
|
|
TF_VAR_d1_id: ${{ env.d1_id }}
|
|
TF_VAR_do_cache_id: ${{ env.do_cache_id }}
|
|
TF_VAR_access_auth_domain: ${{ env.auth_domain }}
|
|
TF_VAR_wd_instance_title: ${{ vars.INSTANCE_TITLE }}
|
|
TF_VAR_wd_admin_email: ${{ vars.ADMIN_EMAIL }}
|
|
TF_VAR_wd_instance_description: ${{ vars.INSTANCE_DESCR }}
|
|
TF_VAR_sentry_dsn: ${{ secrets.SENTRY_DSN }}
|
|
TF_VAR_sentry_access_client_id: ${{ secrets.SENTRY_ACCESS_CLIENT_ID }}
|
|
TF_VAR_sentry_access_client_secret: ${{ secrets.SENTRY_ACCESS_CLIENT_SECRET }}
|
|
|
|
- name: retrieve Terraform state KV namespace
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: kv:namespace list | jq -r '.[] | select( .title == "wildebeest-terraform-${{ env.NAME_SUFFIX }}-state" ) | .id' | awk '{print "tfstate_kv="$1}' >> $GITHUB_ENV
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
preCommands: |
|
|
echo "*** pre commands ***"
|
|
apt-get update && apt-get -y install jq
|
|
echo "******"
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
if: ${{ env.tfstate_kv == '' }}
|
|
|
|
- name: store VAPID keys state
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: kv:key put --namespace-id=${{ env.tfstate_kv }} vapid_jwk --path=./tf/vapid_jwk
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: store Terraform state
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: kv:key put --namespace-id=${{ env.tfstate_kv }} terraform.tfstate --path=./tf/terraform.tfstate
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: Create Queue
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
command: queues create wildebeest-${{ env.NAME_SUFFIX }}
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
continue-on-error: true
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: Publish consumer
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
preCommands: |
|
|
echo "*** pre commands ***"
|
|
echo -e "name = \"wildebeest-consumer-${{ env.NAME_SUFFIX }}\"\n" >> consumer/wrangler.toml
|
|
|
|
echo -e "[[queues.consumers]]\n" >> consumer/wrangler.toml
|
|
echo -e "max_batch_size = 10\n" >> consumer/wrangler.toml
|
|
echo -e "max_batch_timeout = 30\n" >> consumer/wrangler.toml
|
|
echo -e "max_retries = 10\n" >> consumer/wrangler.toml
|
|
echo -e "queue = \"wildebeest-${{ env.NAME_SUFFIX }}\"\n" >> consumer/wrangler.toml
|
|
|
|
echo -e "[[d1_databases]]\nbinding=\"DATABASE\"\ndatabase_name=\"wildebeest-${{ env.NAME_SUFFIX }}\"\ndatabase_id=\"${{ env.d1_id }}\"\n" >> consumer/wrangler.toml
|
|
|
|
echo -e "[durable_objects]\n" >> consumer/wrangler.toml
|
|
echo -e "bindings=[" >> consumer/wrangler.toml
|
|
echo -e "{name=\"DO_CACHE\",class_name=\"WildebeestCache\",script_name=\"wildebeest-do\"}," >> consumer/wrangler.toml
|
|
echo -e "]" >> consumer/wrangler.toml
|
|
|
|
echo -e "[vars]\n" >> consumer/wrangler.toml
|
|
echo -e "DOMAIN=\"${{ vars.CF_DEPLOY_DOMAIN }}\"\n" >> consumer/wrangler.toml
|
|
echo -e "ADMIN_EMAIL=\"${{ vars.ADMIN_EMAIL }}\"\n" >> consumer/wrangler.toml
|
|
|
|
yarn
|
|
yarn --cwd consumer/
|
|
echo "******"
|
|
command: publish --config consumer/wrangler.toml
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
|
|
- name: add Queue producer to Pages
|
|
run: |
|
|
curl https://api.cloudflare.com/client/v4/accounts/${{ secrets.CF_ACCOUNT_ID }}/pages/projects/wildebeest-${{ env.NAME_SUFFIX }} \
|
|
-XPATCH \
|
|
-H 'Authorization: Bearer ${{ secrets.CF_API_TOKEN }}' \
|
|
-d '{
|
|
"deployment_configs": {
|
|
"production": {
|
|
"queue_producers": {
|
|
"QUEUE": {
|
|
"name": "wildebeest-${{ env.NAME_SUFFIX }}"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}' > /dev/null
|
|
|
|
- name: Publish
|
|
uses: cloudflare/wrangler-action@2.0.0
|
|
with:
|
|
apiToken: ${{ secrets.CF_API_TOKEN }}
|
|
preCommands: |
|
|
echo "*** pre commands ***"
|
|
yarn
|
|
yarn build
|
|
cp -rv ./frontend/dist/* .
|
|
# remove folder that aren't needed in Pages before we upload
|
|
rm -rf ./tf ./scripts ./.github ./.npm ./consumer ./*.md
|
|
echo "******"
|
|
command: pages publish --project-name=wildebeest-${{ env.NAME_SUFFIX }} .
|
|
env:
|
|
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
|
|
COMMIT_HASH: ${{ github.sha }}
|