|
1 | | -name: deploy-k8s |
2 | | -run-name: ${{ github.actor }} send deploy EKS 🚀 |
| 1 | +name: Build PM4 |
3 | 2 | on: |
4 | 3 | pull_request: |
5 | 4 | types: [opened, reopened, synchronize, edited, closed] |
6 | 5 | schedule: |
7 | 6 | - cron: '30 2 * * *' # run daily |
8 | 7 | workflow_dispatch: |
9 | 8 | workflow_call: |
10 | | -env: |
11 | | - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} |
12 | | - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} |
13 | | - aws-region: ${{ secrets.AWS_REGION }} |
14 | | - AWS_URL: ${{ secrets.AWS_URL }} |
15 | | - pull_req_id: ${{github.event.pull_request.number}} |
16 | | - DATE: $(date -d '-1 day' '+%Y-%m-%d'|sed 's/-//g') |
17 | | - CURRENT_DATE: $(date '+%Y-%m-%d %H:%M:%S'|sed 's/-//g') |
18 | | - CI_PACKAGE_BRANCH: ${{ github.event.pull_request.head.ref || github.event.ref || 'develop' }} |
19 | | - CI_PROJECT: ${{github.event.pull_request.head.repo.name || github.event.repository.name || 'processmaker' }} |
20 | | - CI_PR_BODY: ${{ github.event_name == 'schedule' && 'No ci tags needed here' || github.event.pull_request.body }} |
21 | | - IMAGE_TAG: $(echo "$CI_PROJECT-$CI_PACKAGE_BRANCH" | sed "s;/;-;g" | sed "s/refs-heads-//g") |
22 | | - DEPLOY: ${{ secrets.DEPLOY }} |
23 | | - GH_USER: ${{ secrets.GH_USER }} |
24 | | - GH_EMAIL: ${{ secrets.GH_EMAIL }} |
25 | | - GITHUB_COMMENT: ${{ secrets.GH_COMMENT }} |
26 | | - DOM_EKS: ${{ secrets.DOM_EKS }} |
27 | | - GITHUB_TOKEN: ${{ secrets.GIT_TOKEN }} |
28 | | - BUILD_BASE: ${{ (contains(github.event.pull_request.body, 'ci:build-base') || github.event_name == 'schedule') && '1' || '0' }} |
29 | | - BASE_IMAGE: ${{ secrets.REGISTRY_HOST }}/processmaker/processmaker:base |
30 | | - K8S_BRANCH: ${{ contains(github.event.pull_request.body, 'ci:next') && 'next' || 'release-2024-fall' }} |
31 | | -concurrency: |
32 | | - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} |
33 | | - cancel-in-progress: true |
34 | 9 | jobs: |
35 | | - imageEKS: |
36 | | - name: build-docker-image-EKS |
37 | | - if: github.event.action != 'closed' |
38 | | - runs-on: ${{ vars.RUNNER }} |
39 | | - steps: |
40 | | - - name: Set image name |
41 | | - run: | |
42 | | - RESOLVED_IMAGE_TAG=${{ env.IMAGE_TAG }} |
43 | | - echo "IMAGE=${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:$RESOLVED_IMAGE_TAG" >> $GITHUB_ENV |
44 | | - - name: Clone repo K8S |
45 | | - run: | |
46 | | - echo "IMAGE: ${{ env.IMAGE }}" |
47 | | - git clone --depth 1 -b "$K8S_BRANCH" "https://$GITHUB_TOKEN@github.com/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution |
48 | | - - name: Generate image EKS |
49 | | - run: | |
50 | | - cd pm4-k8s-distribution/images |
51 | | - branch=$(echo "${{ env.CI_PACKAGE_BRANCH }}" | sed 's/refs-heads-//g') tag=${{env.IMAGE_TAG}} bash build.k8s-cicd.sh |
52 | | - echo "VERSION=${{ env.IMAGE_TAG }}" >> $GITHUB_ENV |
53 | | - - name: List Images |
54 | | - run: | |
55 | | - docker images |
56 | | - # - name: Run Trivy vulnerability scanner |
57 | | - # uses: aquasecurity/trivy-action@master |
58 | | - # with: |
59 | | - # image-ref: processmaker/enterprise:${{ env.VERSION }} |
60 | | - # format: 'table' |
61 | | - # exit-code: '0' |
62 | | - # ignore-unfixed: false |
63 | | - # vuln-type: 'os,library' |
64 | | - # scanners: 'vuln,secret' |
65 | | - # severity: 'MEDIUM,HIGH,CRITICAL' |
66 | | - # env: |
67 | | - # TRIVY_TIMEOUT: 30m |
68 | | - - name: Login to Harbor |
69 | | - uses: docker/login-action@v2 |
70 | | - with: |
71 | | - registry: ${{ secrets.REGISTRY_HOST }} |
72 | | - username: ${{ secrets.REGISTRY_USERNAME }} |
73 | | - password: ${{ secrets.REGISTRY_PASSWORD }} |
74 | | - - name: Push Enterprise Image to Harbor |
75 | | - run: | |
76 | | - docker tag processmaker/enterprise:${{env.IMAGE_TAG}} ${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}} |
77 | | - docker push ${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}} |
78 | | - deployEKS: |
79 | | - name: build-deploy-EKS |
80 | | - if: contains(github.event.pull_request.body, 'ci:deploy') |
81 | | - needs: imageEKS |
82 | | - runs-on: ${{ vars.RUNNER }} |
83 | | - steps: |
84 | | - - name: Clone private repository |
85 | | - run: | |
86 | | - git clone --depth 1 -b eng "https://$GITHUB_TOKEN@github.com/ProcessMaker/argocd.git" argocd |
87 | | - - name: Install pm4-tools |
88 | | - run: | |
89 | | - git clone --depth 1 -b "$K8S_BRANCH" "https://$GITHUB_TOKEN@github.com/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution |
90 | | - echo "versionHelm=$(grep "version:" "pm4-k8s-distribution/charts/enterprise/Chart.yaml" | awk '{print $2}' | sed 's/\"//g')" >> $GITHUB_ENV |
91 | | - cd pm4-k8s-distribution/images/pm4-tools |
92 | | - composer install --no-interaction |
93 | | - cd .. |
94 | | - - name: Configure AWS credentials |
95 | | - uses: aws-actions/configure-aws-credentials@v1 |
96 | | - with: |
97 | | - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID1 }} |
98 | | - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY1 }} |
99 | | - aws-region: ${{ secrets.AWS_REGION }} |
100 | | - - name: Set up kubectl |
101 | | - run: | |
102 | | - curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" |
103 | | - chmod +x kubectl |
104 | | - sudo mv kubectl /usr/local/bin/ |
105 | | - - name: Authenticate with Amazon EKS |
106 | | - run: aws eks update-kubeconfig --region us-east-1 --name pm4-eng |
107 | | - - name: Deploy instance EKS |
108 | | - run: | |
109 | | - cd argocd |
110 | | - deploy=$(echo -n ${{env.IMAGE_TAG}} | md5sum | head -c 10) |
111 | | - current_datetime=$(echo -n ${{env.CURRENT_DATE}} | md5sum | head -c 10) |
112 | | - echo "NAMESPACE : ci-$deploy-ns-pm4" |
113 | | - helm repo add processmaker ${{ secrets.HELM_REPO }} --username ${{ secrets.HELM_USERNAME }} --password ${{ secrets.HELM_PASSWORD }} && helm repo update |
114 | | - if ! kubectl get namespace/ci-$deploy-ns-pm4 ; then |
115 | | - echo "Creating DB" |
116 | | - sed -i "s/{{instance}}/ci-$deploy/" template-db.yaml |
117 | | - kubectl apply -f template-db.yaml |
118 | | - echo "Creating Deploy :: $deploy" |
119 | | - #Sed PMAI |
120 | | - if [[ $K8S_BRANCH == "develop" ]] ; then |
121 | | - sed -i "s/{{pmai-system}}/pmai-system/" template-instance.yaml |
122 | | - else |
123 | | - sed -i "s/{{pmai-system}}/pmai-system-next/" template-instance.yaml |
124 | | - fi |
125 | | - sed -i "s/{{instance}}/ci-$deploy/" template-instance.yaml |
126 | | - sed -i "s/{{image}}/${{env.IMAGE_TAG}}/" template-instance.yaml |
127 | | - cat template-instance.yaml |
128 | | - helm install --timeout 60m -f template-instance.yaml ci-$deploy processmaker/enterprise |
129 | | - #Add cert |
130 | | - sed -i "s/{{instance}}/ci-$deploy/" template-cert.yaml |
131 | | - sed -i "s/{{tls-crt}}/${{ secrets.TLS_CRT }}/" template-cert.yaml |
132 | | - sed -i "s/{{tls-key}}/${{ secrets.TLS_KEY }}/" template-cert.yaml |
133 | | - kubectl apply -f template-cert.yaml |
134 | | - else |
135 | | - echo "Bouncing Instance "; |
136 | | - sed -i "s/{{instance}}/ci-$deploy/g" template-bounce.yaml |
137 | | - sed -i "s/{{current_datetime}}/$current_datetime/g" template-bounce.yaml |
138 | | - helm upgrade --timeout 60m ci-$deploy processmaker/enterprise --version ${{ env.versionHelm }} |
139 | | - kubectl apply -f template-bounce.yaml |
140 | | - fi |
141 | | - export INSTANCE_URL=https://ci-$deploy$DOM_EKS |
142 | | - echo "INSTANCE_URL=${INSTANCE_URL}" >> "$GITHUB_ENV" |
143 | | - ../pm4-k8s-distribution/images/pm4-tools/pm wait-for-instance-ready |
144 | | - - name: Comment Instance |
145 | | - run: | |
146 | | - echo "Instance URL: '${INSTANCE_URL}'" |
147 | | - bash argocd/gh_comment.sh "$CI_PROJECT" "$pull_req_id" |
148 | | - runAPITest: |
149 | | - name: Run API Tests |
150 | | - needs: [deployEKS] |
151 | | - if: contains(github.event.pull_request.body, 'ci:api-test') |
152 | | - runs-on: self-hosted |
153 | | - steps: |
154 | | - - name: Clone private repository |
155 | | - run: | |
156 | | - git clone --depth 1 -b eng "https://$GITHUB_TOKEN@github.com/ProcessMaker/argocd.git" argocd |
157 | | - - name: Install pm4-tools |
158 | | - run: | |
159 | | - git clone --depth 1 -b "$K8S_BRANCH" "https://$GITHUB_TOKEN@github.com/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution |
160 | | - echo "versionHelm=$(grep "version:" "pm4-k8s-distribution/charts/enterprise/Chart.yaml" | awk '{print $2}' | sed 's/\"//g')" >> $GITHUB_ENV |
161 | | - cd pm4-k8s-distribution/images/pm4-tools |
162 | | - composer install --no-interaction |
163 | | - cd .. |
164 | | - - name: Configure AWS credentials |
165 | | - uses: aws-actions/configure-aws-credentials@v1 |
166 | | - with: |
167 | | - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID1 }} |
168 | | - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY1 }} |
169 | | - aws-region: ${{ secrets.AWS_REGION }} |
170 | | - - name: Set up kubectl |
171 | | - run: | |
172 | | - curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" |
173 | | - chmod +x kubectl |
174 | | - sudo mv kubectl /usr/local/bin/ |
175 | | - - name: Authenticate with Amazon EKS |
176 | | - run: aws eks update-kubeconfig --region us-east-1 --name pm4-eng |
177 | | - - name: Run the API tests |
178 | | - run: | |
179 | | - cd argocd |
180 | | - deploy=$(echo -n ${{env.IMAGE_TAG}} | md5sum | head -c 10) |
181 | | - namespace="ci-$deploy-ns-pm4" |
182 | | - pr_body=$(jq -r .pull_request.body < "$GITHUB_EVENT_PATH" | base64) |
183 | | - kubectl get pods --namespace=$namespace |
184 | | - pod_names=$(kubectl get pods --namespace=$namespace --field-selector=status.phase=Running -o jsonpath="{.items[*].metadata.name}" | tr ' ' '\n' | grep -E '(-processmaker-scheduler-)') |
185 | | - for pod in $pod_names; do |
186 | | - code=' |
187 | | - has_processmaker=$(ls /opt | grep processmaker) |
188 | | - has_sudo=$(ls /usr/bin | grep sudo) |
189 | | - has_php=$(ls /usr/bin | grep php) |
190 | | - if [ ! -z "$has_processmaker" ] && [ ! -z "$has_sudo" ] && [ ! -z "$has_php" ]; then |
191 | | - echo $pr_body | base64 -d > /tmp/pr_body |
192 | | - cd /opt/processmaker |
193 | | - sudo -u nginx php artisan package-api-testing:run --body="$pr_body" |
194 | | - else |
195 | | - exit 1 |
196 | | - fi' |
197 | | - kubectl exec -n $namespace $pod -- /bin/sh -c "pr_body='${pr_body}';${code}" | tee /tmp/comment.md && break || true |
198 | | - done |
199 | | - # Send the content of /tmp/comment.md as a PR comment |
200 | | - MESSAGE=$(cat /tmp/comment.md) |
201 | | - GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }} |
202 | | - GITHUB_REPOSITORY=${{ github.repository }} |
203 | | - PR_NUMBER=$(jq -r .number < "$GITHUB_EVENT_PATH") |
204 | | -
|
205 | | - if [ -z "$PR_NUMBER" ]; then |
206 | | - echo "The PR number is not available. Make sure this script is executed in a context of Pull Request." |
207 | | - exit 1 |
208 | | - fi |
209 | | -
|
210 | | - URL="https://api.github.com/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" |
211 | | - json_payload=$(jq -n --arg message "$MESSAGE" '{"body": $message}') |
212 | | -
|
213 | | - curl -s \ |
214 | | - -H "Authorization: token ${GITHUB_TOKEN}" \ |
215 | | - -H "Accept: application/vnd.github.v3+json" \ |
216 | | - -d "$json_payload" \ |
217 | | - "${URL}" |
218 | | - deleteEKS: |
219 | | - name: Delete Instance |
220 | | - if: github.event.action == 'closed' |
221 | | - runs-on: self-hosted |
222 | | - steps: |
223 | | - - name: Delete instance EKS |
224 | | - run: | |
225 | | - deploy=$(echo -n ${{env.IMAGE_TAG}} | md5sum | head -c 10) |
226 | | - if kubectl get namespace/ci-$deploy-ns-pm4 ; then |
227 | | - echo "Deleting Instace :: ci-$deploy" |
228 | | - helm delete ci-$deploy |
229 | | - kubectl delete namespace ci-$deploy-ns-pm4 |
230 | | - #Drop database |
231 | | - deploy_db="\`pm4_ci-$deploy\`" |
232 | | - deploy_ai="\`pm4_ci-${deploy}_ai\`" |
233 | | - mysql -u${{ secrets.USER_MYSQL_ENG }} -p${{ secrets.PASS_MYSQL_ENG }} -e "DROP DATABASE $deploy_db" -h ${{ secrets.RDS_ENG }} |
234 | | - mysql -u${{ secrets.USER_MYSQL_ENG }} -p${{ secrets.PASS_MYSQL_ENG }} -e "DROP DATABASE $deploy_ai" -h ${{ secrets.RDS_ENG }} |
235 | | - #Drop image Harbor |
236 | | - curl -X DELETE -u ${{ secrets.REGISTRY_USERNAME }}:${{ secrets.REGISTRY_PASSWORD }} "https://${{ secrets.REGISTRY_HOST }}/api/v2.0/projects/processmaker/repositories/enterprise/artifacts/${{env.IMAGE_TAG}}" |
237 | | - echo "The instance [https://ci-$deploy.engk8s.processmaker.net] was deleted!!" |
238 | | - else |
239 | | - echo "The pull request does not have an instance on K8s [https://ci-$deploy.engk8s.processmaker.net] not found!!" |
240 | | - fi |
241 | | - runPhpUnit: |
242 | | - name: run-phpunit |
243 | | - if: github.event.action != 'closed' |
244 | | - needs: imageEKS |
245 | | - runs-on: ${{ vars.RUNNER }} |
246 | | - steps: |
247 | | - - name: Export Params |
248 | | - run: | |
249 | | - echo "IMAGE=${{ secrets.REGISTRY_HOST }}/processmaker/enterprise:${{env.IMAGE_TAG}}" >> $GITHUB_ENV |
250 | | - - uses: actions/checkout@v2 |
251 | | - with: |
252 | | - fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis |
253 | | - - name: Clone repo K8S |
254 | | - run: | |
255 | | - echo "IMAGE: ${{ env.IMAGE }}" |
256 | | - git clone --depth 1 -b "$K8S_BRANCH" "https://$GITHUB_TOKEN@github.com/ProcessMaker/pm4-k8s-distribution.git" pm4-k8s-distribution |
257 | | - - name: Login to Harbor |
258 | | - uses: docker/login-action@v2 |
259 | | - with: |
260 | | - registry: ${{ secrets.REGISTRY_HOST }} |
261 | | - username: ${{ secrets.REGISTRY_USERNAME }} |
262 | | - password: ${{ secrets.REGISTRY_PASSWORD }} |
263 | | - - name: PHPUnits |
264 | | - run: | |
265 | | - cd pm4-k8s-distribution/images/pm4-tools |
266 | | - docker pull $IMAGE |
267 | | - docker compose down -v |
268 | | - docker compose build phpunit |
269 | | - docker compose run phpunit |
270 | | - CONTAINER_ID=$(docker ps -a --filter ancestor=pm4-eks-phpunit:latest --format "{{.ID}}" | head -n 1) |
271 | | - docker cp $CONTAINER_ID:/opt/processmaker/coverage.xml coverage.xml |
272 | | - - name: Archive code coverage |
273 | | - uses: actions/upload-artifact@v4 |
274 | | - with: |
275 | | - name: code-coverage |
276 | | - path: ./pm4-k8s-distribution/images/pm4-tools/coverage.xml |
277 | | - - name: SonarQube Coverage Report |
278 | | - uses: sonarsource/sonarqube-scan-action@master |
279 | | - env: |
280 | | - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
281 | | - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} |
282 | | - SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} |
283 | | - with: |
284 | | - args: > |
285 | | - -Dsonar.projectKey=${{ secrets.SONAR_PROJECT_KEY }} |
286 | | - -Dsonar.sources=. |
287 | | - -Dsonar.tests=. |
288 | | - -Dsonar.test.inclusions=**/*Test.php |
289 | | - -Dsonar.php.coverage.reportPaths=./pm4-k8s-distribution/images/pm4-tools/coverage.xml |
| 10 | + run: |
| 11 | + name: Run PM4-workflow |
| 12 | + uses: processmaker/.github/.github/workflows/deploy-pm4.yml@main |
| 13 | + secrets: inherit |
0 commit comments