chore(main): release 1.48.0 (#563) #539
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Container Image Deployment CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - deploy-* | |
| tags: | |
| - v*.*.* | |
| # Note on secrets used for connection | |
| # They are configured as environment secrets | |
| # HOST is the internal ip of VM containing docker | |
| # PROXY_HOST is the host of VMs | |
| # USERNAME is the user used for operations | |
| # SSH_PRIVATE_KEY is the private key (shared between VM and host) | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| env: | |
| # Note: env is also the name of the directory on the server | |
| - ${{ startsWith(github.ref, 'refs/tags/v') && 'open-prices-org' || 'open-prices-net' }} | |
| environment: ${{ matrix.env }} | |
| concurrency: ${{ matrix.env }} | |
| steps: | |
| - name: Set common variables | |
| run: | | |
| # We use the prod oauth server for all environments | |
| echo "SSH_PROXY_HOST=ovh1.openfoodfacts.org" >> $GITHUB_ENV | |
| echo "SSH_USERNAME=off" >> $GITHUB_ENV | |
| - name: Set various variable for staging (net) deployment | |
| if: matrix.env == 'open-prices-net' | |
| run: | | |
| echo "SSH_HOST=10.1.0.200" >> $GITHUB_ENV | |
| echo "ENVIRONMENT=net" >> $GITHUB_ENV | |
| - name: Set various variable for production deployment | |
| if: matrix.env == 'open-prices-org' | |
| run: | | |
| echo "SSH_HOST=10.1.0.201" >> $GITHUB_ENV | |
| echo "ENVIRONMENT=org" >> $GITHUB_ENV | |
| - name: Wait for docker image container build workflow | |
| uses: tomchv/[email protected] | |
| id: wait-build | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| checkName: build (api) | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| intervalSeconds: 10 | |
| timeoutSeconds: 600 # 10m | |
| - name: Do something if build isn't launch | |
| if: steps.wait-build.outputs.conclusion == 'does not exist' | |
| run: echo job does not exist && true | |
| - name: Do something if build fail | |
| if: steps.wait-build.outputs.conclusion == 'failure' | |
| run: echo fail && false # fail if build fail | |
| - name: Do something if build timeout | |
| if: steps.wait-build.outputs.conclusion == 'timed_out' | |
| run: echo Timeout && false # fail if build time out | |
| - name: Checkout git repository | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| # Clone Git repository if not already there | |
| [ ! -d '${{ matrix.env }}' ] && git clone --depth 1 https://github.com/${{ github.repository }} ${{ matrix.env }} --no-single-branch 2>&1 | |
| # Go to repository directory | |
| cd ${{ matrix.env }} | |
| # Fetch newest commits (in case it wasn't freshly cloned) | |
| git fetch --depth 1 | |
| # Checkout current commit SHA | |
| git checkout -qf ${{ github.sha }} | |
| - name: Set environment variables | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| # Go to repository directory | |
| cd ${{ matrix.env }} | |
| mv .env .env-dev | |
| # init .env | |
| echo "# Env file generated by container-deploy action"> .env | |
| # Set Docker Compose variables | |
| echo "DOCKER_CLIENT_TIMEOUT=180" >> .env | |
| echo "COMPOSE_HTTP_TIMEOUT=180" >> .env | |
| echo "COMPOSE_PROJECT_NAME=open_prices" >> .env | |
| echo "COMPOSE_PATH_SEPARATOR=;" >> .env | |
| echo "COMPOSE_FILE=docker-compose.yml;docker/prod.yml" >> .env | |
| # Set docker variables | |
| echo "TAG=sha-${{ github.sha }}" >> .env | |
| echo "RESTART_POLICY=always" >> .env | |
| # Set App variables | |
| echo "API_PORT=8190" >> .env | |
| echo "DEBUG=False" >> .env | |
| echo 'ALLOWED_HOSTS=openfoodfacts-explorer.vercel.app,prices.openfoodfacts.net,prices.openfoodfacts.org' >> .env | |
| echo "OAUTH2_SERVER_URL=https://world.openfoodfacts.org/cgi/auth.pl" >> .env | |
| echo "SECRET_KEY=${{ secrets.DJANGO_SECRET_KEY }}" >> .env | |
| echo "SENTRY_DSN=${{ secrets.SENTRY_DSN }}" >> .env | |
| echo "POSTGRES_EXPOSE=127.0.0.1:5433" >> .env | |
| echo "POSTGRES_HOST=postgres.open_prices_default" >> .env | |
| echo "POSTGRES_DB=postgres" >> .env | |
| echo "POSTGRES_USER=postgres" >> .env | |
| echo "POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}" >> .env | |
| echo "ENVIRONMENT=${{ env.ENVIRONMENT }}" >> .env | |
| echo "GOOGLE_CLOUD_VISION_API_KEY=${{ secrets.GOOGLE_CLOUD_VISION_API_KEY }}" >> .env | |
| echo "GOOGLE_GEMINI_API_KEY=${{ secrets.GOOGLE_GEMINI_API_KEY }}" >> .env | |
| - name: Create Docker volumes | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| cd ${{ matrix.env }} | |
| make create_external_volumes | |
| - name: Start services | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| cd ${{ matrix.env }} | |
| # Get the latest version (to apply migration next) | |
| make pull | |
| # Apply migrations | |
| make migrate-db | |
| # Launch new version | |
| make up | |
| # copy static files so they can be served by nginx | |
| make cp-static-files | |
| - name: Check services are up | |
| uses: appleboy/ssh-action@master | |
| id: livecheck | |
| if: ${{ always() }} | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| cd ${{ matrix.env }} | |
| # Let 10s to the API to be up | |
| sleep 10 | |
| make livecheck | |
| - name: Cleanup obsolete Docker objects | |
| uses: appleboy/ssh-action@master | |
| if: ${{ always() }} | |
| with: | |
| host: ${{ env.SSH_HOST }} | |
| username: ${{ env.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| proxy_host: ${{ env.SSH_PROXY_HOST }} | |
| proxy_username: ${{ env.SSH_USERNAME }} | |
| proxy_key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| script_stop: false | |
| script: | | |
| cd ${{ matrix.env }} | |
| make prune |