Github workflows

DiamondLightSource · Apr 26, 2024 · c0e1b17 · c0e1b17
1 parent 300be5e
commit c0e1b17
Show file tree

Hide file tree

Showing 9 changed files with 336 additions and 24 deletions.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,43 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-artifacts:
+        patterns:
+          - actions/*-artifact
+      minor:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: devcontainers
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      minor:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      minor:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      patch:
+        update-types:
+          - patch
diff --git a/.github/workflows/code.yml b/.github/workflows/code.yml
@@ -0,0 +1,104 @@
+name: Backend Code
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint:
+    # Deduplicate jobs from pull requests and branch pushes within the same repo.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    services:
+      ispyb:
+        image: ghcr.io/diamondlightsource/ispyb-database:v3.0.0
+        ports:
+          - 3306:3306
+        env:
+          MARIADB_ROOT_PASSWORD: rootpassword
+        options: >
+          --health-cmd "/usr/local/bin/healthcheck.sh --defaults-file=/ispyb/.my.cnf --connect"
+    env:
+      DATABASE_URL: mysql://root:rootpassword@localhost/ispyb_build
+    steps:
+      - name: Checkout source
+        uses: actions/[email protected]
+
+      - name: Install dependencies
+        uses: awalsh128/[email protected]
+        with:
+          packages: libopencv-dev clang libclang-dev
+
+      - name: Install stable toolchain
+        uses: actions-rs/[email protected]
+        with:
+          toolchain: stable
+          default: true
+
+      - name: Cache Rust Build
+        uses: Swatinem/[email protected]
+
+      - name: Create models lib file
+        run: |
+          mkdir models/src
+          printf "\n" > models/src/lib.rs
+
+      - name: Check Formatting
+        uses: actions-rs/[email protected]
+        with:
+          command: fmt
+          args: >
+            --all
+            --check
+
+      - name: Lint with Clippy
+        uses: actions-rs/[email protected]
+        with:
+          command: clippy
+          args: >
+            --no-deps
+            --all-targets
+            --all-features
+            -- 
+            --deny warnings
+
+  test:
+    # Deduplicate jobs from pull requests and branch pushes within the same repo.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    services:
+      ispyb:
+        image: ghcr.io/diamondlightsource/ispyb-database:v3.0.0
+        ports:
+          - 3306:3306
+        env:
+          MARIADB_ROOT_PASSWORD: rootpassword
+        options: >
+          --health-cmd "/usr/local/bin/healthcheck.sh --defaults-file=/ispyb/.my.cnf --connect"
+    env:
+      DATABASE_URL: mysql://root:rootpassword@localhost/ispyb_build
+    steps:
+      - name: Checkout source
+        uses: actions/[email protected]
+
+      - name: Install dependencies
+        uses: awalsh128/[email protected]
+        with:
+          packages: libopencv-dev clang libclang-dev
+
+      - name: Install stable toolchain
+        uses: actions-rs/[email protected]
+        with:
+          toolchain: stable
+          default: true
+
+      - name: Cache Rust Build
+        uses: Swatinem/[email protected]
+
+      - name: Test
+        uses: actions-rs/[email protected]
+        with:
+          command: test
+          args: >
+            --all-targets
+            --all-features
diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
@@ -0,0 +1,64 @@
+name: Container
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build:
+    # Deduplicate jobs from pull requests and branch pushes within the same repo.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    services:
+      ispyb:
+        image: ghcr.io/diamondlightsource/ispyb-database:v3.0.0
+        ports:
+          - 3306:3306
+        env:
+          MARIADB_ROOT_PASSWORD: rootpassword
+        options: >
+          --health-cmd "/usr/local/bin/healthcheck.sh --defaults-file=/ispyb/.my.cnf --connect"
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout Code
+        uses: actions/[email protected]
+
+      - name: Generate Image Name
+        run: echo IMAGE_REPOSITORY=ghcr.io/$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]' | tr '[_]' '[\-]') >> $GITHUB_ENV
+
+      - name: Log in to GitHub Docker Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/[email protected]
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker Metadata
+        id: meta
+        uses: docker/[email protected]
+        with:
+          images: ${{ env.IMAGE_REPOSITORY }}
+          tags: |
+            type=ref,event=tag
+            type=raw,value=latest
+
+      - name: Set up Docker Buildx
+        uses: docker/[email protected]
+        with:
+          driver-opts: network=host
+
+      - name: Build Image
+        uses: docker/[email protected]
+        with:
+          build-args: DATABASE_URL=mysql://root:rootpassword@localhost:3306/ispyb_build
+          target: deploy
+          push: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags') }}
+          load: ${{ !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags')) }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml
@@ -0,0 +1,23 @@
+name: Dev Container CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  build:
+    # pull requests are a duplicate of a branch push if within the same repo.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
+
+      - name: Set up Docker Buildx
+        uses: docker/[email protected]
+
+      - name: Create .env file
+        run: touch .devcontainer/opa.env
+
+      - name: Build dev container
+        uses: devcontainers/[email protected]
diff --git a/.github/workflows/schema.yml b/.github/workflows/schema.yml
@@ -0,0 +1,83 @@
+name: Schema
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  generate:
+    # Deduplicate jobs from pull requests and branch pushes within the same repo.
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    services:
+      ispyb:
+        image: ghcr.io/diamondlightsource/ispyb-database:v3.0.0
+        ports:
+          - 3306:3306
+        env:
+          MARIADB_ROOT_PASSWORD: rootpassword
+        options: >
+          --health-cmd "/usr/local/bin/healthcheck.sh --defaults-file=/ispyb/.my.cnf --connect"
+    env:
+      DATABASE_URL: mysql://root:rootpassword@localhost:3306/ispyb_build
+    steps:
+      - name: Checkout source
+        uses: actions/[email protected]
+
+      - name: Install stable toolchain
+        uses: actions-rs/[email protected]
+        with:
+          toolchain: stable
+          default: true
+
+      - name: Cache Rust Build
+        uses: Swatinem/[email protected]
+
+      - name: Generate Schema
+        uses: actions-rs/[email protected]
+        with:
+          command: run
+          args: >
+            schema
+            --path fluorescence_scan.graphql
+
+      - name: Upload Schema Artifact
+        uses: actions/[email protected]
+        with:
+          name: fluorescence_scan.graphql
+          path: fluorescence_scan.graphql
+
+  publish:
+      # Deduplicate jobs from pull requests and branch pushes within the same repo.
+      if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
+      needs:
+        - generate
+      runs-on: ubuntu-latest
+      steps:
+        - name: Install Rover CLI
+          run: |
+            curl -sSL https://rover.apollo.dev/nix/v0.23.0-rc.3 | sh
+            echo "$HOME/.rover/bin" >> $GITHUB_PATH
+
+        - name: Download Schema Artifact
+          uses: actions/[email protected]
+          with:
+            name: fluorescence_scan.graphql
+
+        - name: Check Subgraph Schema
+          run: >
+            rover subgraph check data-gateway-n63jcf@current
+            --schema fluorescence_scan.graphql
+            --name fluorescence-scan
+          env:
+            APOLLO_KEY: ${{ secrets.APOLLO_STUDIO }}
+
+        - name: Publish Subgraph Schema to Apollo Studio
+          if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags') }}
+          run: >
+            rover subgraph publish data-gateway-n63jcf@current 
+            --routing-url http://fluorescence-scan:80 
+            --schema fluorescence_scan.graphql
+            --name fluorescence-scan
+          env:
+            APOLLO_KEY: ${{ secrets.APOLLO_STUDIO }} 
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/charts/fluorescence_scan/templates/ispyb-secret.yaml b/charts/fluorescence_scan/templates/ispyb-secret.yaml
@@ -1,19 +1,14 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
-  annotations:
-    sealedsecrets.bitnami.com/namespace-wide: "true"
   creationTimestamp: null
-  name: flourescence-scan-ispyb
+  name: fluorescence-scan-ispyb-secret
   namespace: graph
 spec:
   encryptedData:
-    password: AgAE9My2sdmPfJCuKFPt5O6CBCAGytIlcrChly3IH2s70PlM/B41Lj4dXId1pCGsZkCtx0CTOfDp6+oJbyP0LA8i7qJkZFqBB/bZpsEU3HR/ki/5//xXyepKoUSbFd3Gu3UFNBVZCTqnMClms9HFVyFaoARYKc3gKLO/CqSbFl+7dWurXO4DC0VvQpmHEZ3MVIrU7b53YPV9r1VbrTntvFwvdM/SBXhNuZVQVeHJmrdbiewSbRLUxSoRWy394PfdHV05LWOVcKkGOHbh9PoJuefu+5j6Xc3H1P1YWteH/0/u67Cnjx2193LU4GJxexoQjBUY6O5EkeOwE5N1hM7xyNPPndCQEHYfSHSZWKR9m6Q8OGAMp/JHIiOiwX/li81Q9s30x0pcNRNjr//+Bxo1eVI1TzXlQ1M8RO2r4q774p7jGtXzo7fhBfjPHm3K0LD4WJovemVybjj2eAwlI+i3b3K56/s6JqdOa42LydxjxZu6LXlWLUKpxE3uQ9SE7RyHq1thWdD2OnR+BjXfoYIaoGVcTiJQpk34zorSgIpwN4WqdTFFM9x/yCrMTAl2gA7AjTNGrTlaTjU7ypbzjwubGDwxCW3XXRTqdlTi0ShEsyT2yqIZQWvibbTUc5GICHsyfcjudmarWZ4VDR9UV4XPRb8cHEJehVhBC8ugxg3ioCv3+AsLv5MOLZfVC+vAHDGyJ6x+XRRZdY8BwJOzEss=
+    password: AgCG6GFJ9T/6vp2rz/iOvPeUMAWfpDilvY9SVD9u4tTm04pDiJ+eyxQOgRofKYPVePQgoDFDhcXdItKZbUvZNacK8EvSq4Jy5PF+hZWJpk3OTRWlb34iuNAbJBJAmzFXra1nXF2Pg4Pt8fYknxEH5mMEdchjMs2vyiq/+DBP8Bc8dmGIMdPBVG/w2dCpImSEppKrjPmsif/AYc9joLIZDpPFfXy15FAQRSUw1CYetieNh3Gz1o6rAaIzBLK2q08J0uCXLct1gcHy2pNNWP4YiQBbDVPmD+KNMCaCnOuaA9VObNiK9y0B/wbCls5ekO/HDznms3MOHx36H0/KljtA0/IadKjVCa+vopL0dOdOxMizhLk+tqSfHy8mwr0tUoKIgpHgbgP1Iid2QCTryRl/NMrcU8ckMNZQDc5oicNTAhwJ1R48XHOTUnt1DLu6aJd8EjB3fIcPzNkQK0rmYoAyCG434YYpul5BHhZTvQ4ewPw4tMaM7SXjtmkWCjEcteiMGwjoJhLcqirX7nrtg1OoSy4xi6G3UOczD8dyUxOeawoO9LT2H22EQOsFgTaLo5hRyM8YnxIumCHC6jn9OULb491MJ371mZc71B7YClSz/hozMtyjN2ZJXALq2vJclXD2uyK28L9EAZF9ywgWJ949vHOezwtSDOfrW+z29atvJVdUaLC7NmzslClssMgdQatd73TdfkfMKMoCD7i8/g==
   template:
     metadata:
-      annotations:
-        sealedsecrets.bitnami.com/namespace-wide: "true"
       creationTimestamp: null
-      name: flourescence-scan-ispyb
+      name: fluorescence-scan-ispyb-secret
       namespace: graph
-