add the GC_ORGANISATIONS_BUCKET_NAME env variable to admin and api de… #441
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Merge to main (Staging)" | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "base/**" | |
| - ".github/workflows/merge_to_main_staging.yaml" | |
| - "env/staging/**" | |
| env: | |
| OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN_STAGING }} | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| kubectl-apply: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 | |
| with: | |
| # Fetches entire history, so we can analyze commits since last tag | |
| fetch-depth: 0 | |
| - name: Configure AWS credentials | |
| uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0 | |
| with: | |
| aws-access-key-id: ${{ secrets.STAGING_AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.STAGING_AWS_SECRET_ACCESS_KEY }} | |
| aws-region: ca-central-1 | |
| # I'm cheating and using this action to install kubectl | |
| - name: Setup helmfile | |
| uses: mamezou-tech/setup-helmfile@03233e1cd9b19b2ba320e431f7bcc0618db4248d # v2.0.0 | |
| with: | |
| install-kubectl: yes | |
| install-helm: yes | |
| - name: Install OpenVPN | |
| run: | | |
| sudo apt update | |
| sudo apt install -y openvpn openvpn-systemd-resolved | |
| - name: Setup Terraform tools | |
| uses: cds-snc/terraform-tools-setup@v1 | |
| env: # In case you want to override default versions | |
| CONFTEST_VERSION: 0.30.0 | |
| TERRAFORM_VERSION: 1.9.5 | |
| TERRAGRUNT_VERSION: 0.66.9 | |
| TF_SUMMARIZE_VERSION: 0.2.3 | |
| - name: Install 1Pass CLI | |
| run: | | |
| curl -o 1pass.deb https://downloads.1password.com/linux/debian/amd64/stable/1password-cli-amd64-latest.deb | |
| sudo dpkg -i 1pass.deb | |
| - name: Retrieve VPN Config | |
| run: | | |
| scripts/createVPNConfig.sh staging 2> /dev/null | |
| - name: Connect to VPN | |
| uses: "kota65535/github-openvpn-connect-action@cd2ed8a90cc7b060dc4e001143e811b5f7ea0af5" # v3.1.0 | |
| with: | |
| config_file: /var/tmp/staging.ovpn | |
| echo_config: false | |
| - name: Decrypt staging env | |
| run: | | |
| make decrypt-staging | |
| - name: Configure kubeconfig | |
| run: | | |
| aws eks update-kubeconfig --name notification-canada-ca-staging-eks-cluster | |
| - name: Apply changes | |
| run: | | |
| ./scripts/applyKube.sh env/staging --kubeconfig=/home/runner/.kube/config | |
| - name: Check for env changes | |
| working-directory: env/staging | |
| run: | | |
| aws ssm get-parameters --region ca-central-1 --with-decryption --names ENVIRONMENT_VARIABLES --query 'Parameters[*].Value' --output text > .previous.env | |
| DIFF="$(set +o pipefail && diff -B .env .previous.env | wc -l)" | |
| echo "::add-mask::$DIFF" | |
| echo "ENV_DIFF=$DIFF" >> $GITHUB_ENV | |
| - name: Update parameter store environment variable | |
| if: env.ENV_DIFF != '0' # Only update secrets when changes detected | |
| working-directory: env/staging | |
| run: | | |
| aws ssm put-parameter --region ca-central-1 --name ENVIRONMENT_VARIABLES --type SecureString --key-id alias/aws/ssm --value file://.env --tier "Intelligent-Tiering" --overwrite | |
| - name: Force api-lambda to redeploy on environment changes | |
| if: env.ENV_DIFF != '0' | |
| uses: ./.github/actions/update-lambda-function | |
| with: | |
| alias-name: latest | |
| function-name: api-lambda | |
| - name: Force heartbeat lambda to redeploy on environment changes | |
| if: env.ENV_DIFF != '0' | |
| uses: ./.github/actions/update-lambda-function | |
| with: | |
| alias-name: latest | |
| function-name: heartbeat | |
| - name: Force system_status to redeploy on environment changes | |
| if: env.ENV_DIFF != '0' | |
| uses: ./.github/actions/update-lambda-function | |
| with: | |
| alias-name: latest | |
| function-name: system_status | |
| - name: Bump version and push tag | |
| id: bump_and_push_tag | |
| uses: mathieudutour/github-tag-action@bcb832838e1612ff92089d914bccc0fd39458223 # v4.6 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| release_branches: main | |
| - name: Report deployment to Sentinel | |
| uses: cds-snc/sentinel-forward-data-action@main | |
| with: | |
| input_data: '{"product": "notify", "sha": "${{ github.sha }}", "version": "${{ steps.bump_and_push_tag.outputs.new_tag }}" "repository": "${{ github.repository }}", "environment": "staging"}' | |
| log_type: CDS_Product_Deployment_Data | |
| log_analytics_workspace_id: ${{ secrets.LOG_ANALYTICS_WORKSPACE_ID }} | |
| log_analytics_workspace_key: ${{ secrets.LOG_ANALYTICS_WORKSPACE_KEY }} | |
| - name: Notify Slack channel if this job failed | |
| if: ${{ failure() }} | |
| run: | | |
| json='{"text":"<!here> Manifests Merge To Staging CI is failing in <https://github.com/cds-snc/notification-manifests/|notification-manifests> !"}' | |
| curl -X POST -H 'Content-type: application/json' --data "$json" ${{ secrets.SLACK_WEBHOOK }} | |
| clear-cache: | |
| needs: kubectl-apply | |
| uses: ./.github/workflows/clear-notify-cache.yaml | |
| with: | |
| environment: staging | |
| cache_clear_user_name: CACHE_CLEAR_USER | |
| api_url: https://api.staging.notification.cdssandbox.xyz | |
| secrets: | |
| CACHE_CLEAR_CLIENT_SECRET: ${{ secrets.STAGING_CACHE_CLEAR_CLIENT_SECRET }} |