Skip to content

[MergeDups] When word/sense is protected, give reasons (#2888) #573

[MergeDups] When word/sense is protected, give reasons (#2888)

[MergeDups] When word/sense is protected, give reasons (#2888) #573

Workflow file for this run

name: "Deploy Update to QA Server"
on:
push:
branches:
- master
permissions:
contents: read
jobs:
build:
strategy:
matrix:
component: [frontend, backend, maintenance, database]
runs-on: ubuntu-latest
outputs:
image_tag: ${{ steps.build_combine.outputs.image_tag }}
steps:
# See https://docs.stepsecurity.io/harden-runner/getting-started/ for instructions on
# configuring harden-runner and identifying allowed endpoints.
- name: Harden Runner
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
*.actions.githubusercontent.com:443
*.data.mcr.microsoft.com:443
${{ secrets.AWS_ACCOUNT }}.dkr.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com
api.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com:443
api.github.com:443
api.nuget.org:443
archive.ubuntu.com:80
auth.docker.io:443
codecov.io:443
dc.services.visualstudio.com:443
deb.debian.org:80
docker.io:443
dotnetcli.azureedge.net:443
files.pythonhosted.org:443
github.com:443
mcr.microsoft.com:443
production.cloudflare.docker.com:443
pypi.org:443
registry-1.docker.io:443
registry.npmjs.org:443
security.debian.org:80
security.ubuntu.com:80
storage.googleapis.com:443
sts.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com:443
uploader.codecov.io:443
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0
- name: Build The Combine
id: build_combine
uses: ./.github/actions/combine-build
with:
image_registry: ${{ secrets.AWS_ACCOUNT }}.dkr.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com
aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws_default_region: ${{ secrets.AWS_DEFAULT_REGION }}
build_component: ${{ matrix.component }}
clean_ecr_repo:
needs: build
env:
RM_PATTERN_1: \d+\.\d+\.\d+-master\.\d+
RM_PATTERN_2: \d+\.\d+\.\d+-[a-z]+\.\d+-master\.\d+
runs-on: ubuntu-latest
steps:
# See https://docs.stepsecurity.io/harden-runner/getting-started/ for instructions on
# configuring harden-runner and identifying allowed endpoints.
- name: Harden Runner
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
*.actions.githubusercontent.com:443
api.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com:443
github.com:443
sts.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com:443
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: ${{ secrets.AWS_DEFAULT_REGION }}
- name: Remove old AWS ECR images
run: scripts/clean_aws_repo.py combine_frontend combine_backend combine_maint combine_database --keep ${{ needs.build.outputs.image_tag }} --remove "${{ env.RM_PATTERN_1 }}" "${{ env.RM_PATTERN_2 }}" --verbose
deploy_update:
needs: build
# Only push to the QA server when built on the master branch
if: ${{ github.ref_name == 'master' }}
runs-on: [self-hosted, thecombine]
steps:
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: Deploy The Combine Update
uses: ./.github/actions/combine-deploy-update
with:
image_registry: ${{ secrets.AWS_ACCOUNT }}.dkr.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com
image_tag: ${{ needs.build.outputs.image_tag }}
kube_context: ${{ secrets.LTOPS_K8S_STAGING_CONTEXT }}
kubectl_version: ${{ vars.KUBECTL_VERSION }}
update_cert_proxy: false