Merge pull request #949 from mbta/github-actions-krj

Chore: Convert workflow to v2

.github/workflows/ci.yml

@@ -150,7 +150,7 @@ jobs:
           mix local.hex --force
       - name: Install NPM assets
         run: npm --prefix assets ci
-      - uses: mbta/setup-chromedriver@v1.0.5
+      - uses: mbta/setup-chromedriver@69cc01d772a1595b8aee87d52f53e71b3904d9d0
       - name: Run integration tests
         run: mix test.integration
 

.github/workflows/deploy-ecs.yml

@@ -14,12 +14,11 @@ on:
 
 jobs:
   call-workflow:
-    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@main
+    uses: mbta/workflows/.github/workflows/deploy-ecs.yml@v2
     with:
       app-name: arrow
       environment: ${{ github.event.inputs.environment || 'dev' }}
     secrets:
-      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
       docker-repo: ${{ secrets.DOCKER_REPO }}
       slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.tool-versions

@@ -1,3 +1,3 @@
-elixir 1.14.2-otp-25
-erlang 25.2
-nodejs 14.17.1
+elixir 1.14.5-otp-25
+erlang 25.3.2.7
+nodejs 20.8.1

Dockerfile

@@ -1,38 +1,67 @@
-FROM hexpm/elixir:1.14.2-erlang-25.2-debian-bullseye-20221004 as builder
+ARG ELIXIR_VERSION=1.14.5
+ARG ERLANG_VERSION=25.3.2.7
+ARG DEBIAN_VERSION=bullseye-20230612
+
+FROM hexpm/elixir:$ELIXIR_VERSION-erlang-$ERLANG_VERSION-debian-$DEBIAN_VERSION as elixir-builder
 
 ENV LANG=C.UTF-8 \
   MIX_ENV=prod
 
 RUN apt-get update --allow-releaseinfo-change && \
-  apt-get install -y --no-install-recommends ca-certificates curl git
+  apt-get install -y --no-install-recommends ca-certificates curl git gnupg
+
+RUN mix local.hex --force && \
+  mix local.rebar --force
 
 # Instructions from:
-# https://github.com/nodesource/distributions/blob/master/README.md
-RUN  curl -sL https://deb.nodesource.com/setup_14.x | bash - \
-  && apt-get install -y nodejs \
-  && npm install -g npm@latest
+# https://github.com/nodesource/distributions#debian-versions
 
-WORKDIR /root
-ADD . .
+ARG NODE_MAJOR=20
 
-RUN mix local.hex --force && \
-  mix local.rebar --force && \
-  mix do deps.get --only prod, compile --force && \
-  mix esbuild.install && \
-  npm --prefix assets ci && \
-  mix assets.deploy && \
-  mix release
+RUN mkdir -p /etc/apt/keyrings && \
+  curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
+RUN echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_${NODE_MAJOR}.x nodistro main" >> /etc/apt/sources.list.d/nodesource.list
+RUN apt-get update && \
+  apt-get install nodejs -y
+
+WORKDIR /app
+
+COPY mix.exs mix.exs
+COPY mix.lock mix.lock
+
+RUN mix do deps.get --only prod
+
+COPY config/config.exs config/
+COPY config/prod.exs config/
 
-FROM debian:bullseye-20221004
+RUN mix deps.compile
+
+COPY assets assets
+RUN npm ci --prefix assets
+RUN mix assets.deploy
+
+COPY lib lib
+COPY priv priv
+
+RUN mix phx.digest
+RUN mix compile
+
+COPY config/runtime.exs config
+
+RUN mix release
+
+FROM debian:$DEBIAN_VERSION
 
 RUN apt-get update --allow-releaseinfo-change && \
   apt-get install -y --no-install-recommends libssl1.1 libsctp1 curl && \
   rm -rf /var/lib/apt/lists/*
 
-WORKDIR /root
+WORKDIR /app
+RUN chown nobody /app
+
 EXPOSE 4000
-ENV MIX_ENV=prod TERM=xterm LANG="C.UTF-8" PORT=4000
+ENV MIX_ENV=prod TERM=xterm LANG="C.UTF-8" PORT=4000 PHX_SERVER=true
 
-COPY --from=builder /root/_build/prod/rel/arrow .
+COPY --from=elixir-builder --chown=nobody:root /app/_build/prod/rel/arrow .
 
-CMD ["bin/arrow", "start"]
+CMD ["/app/bin/arrow", "start"]