Run on GCE

.github/workflows/deploy-to-gce.yml

@@ -0,0 +1,65 @@
+# Copyright 2020 Google, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Deployment
+
+concurrency:
+  group: production
+  cancel-in-progress: true
+
+on: workflow_dispatch
+
+env:
+  PROJECT_ID: ${{ secrets.GCE_PROJECT }}
+  GCE_INSTANCE: rollbot-vm
+  GCE_INSTANCE_ZONE: us-central1-a  
+
+jobs:
+  setup-build-publish-deploy:
+    name: Setup, Build, Publish, and Deploy
+    runs-on: ubuntu-latest
+
+    # Add "id-token" with the intended permissions.
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - id: 'auth'
+        uses: 'google-github-actions/auth@v2'
+        with:
+          credentials_json: '${{ secrets.GCE_SA_KEY }}'
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+      - run: |-
+          gcloud --quiet auth configure-docker us-central1-docker.pkg.dev
+      - name: Build
+        run: |-
+          docker build --tag "us-central1-docker.pkg.dev/$PROJECT_ID/rollbot-vm/$GCE_INSTANCE-image:$GITHUB_SHA" .
+      - name: Publish
+        run: |-
+          docker push "us-central1-docker.pkg.dev/$PROJECT_ID/rollbot-vm/$GCE_INSTANCE-image:$GITHUB_SHA"
+      - name: Update startup script to prune and update IP address
+        run: |-
+          gcloud compute instances add-metadata $GCE_INSTANCE \
+            --zone "$GCE_INSTANCE_ZONE" \
+            --metadata=startup-script="#! /bin/bash
+              docker image prune -af"
+      - name: Deploy
+        run: |-
+          gcloud compute instances update-container "$GCE_INSTANCE" \
+            --zone "$GCE_INSTANCE_ZONE" \
+            --container-image "us-central1-docker.pkg.dev/$PROJECT_ID/rollbot-vm/$GCE_INSTANCE-image:$GITHUB_SHA"

.github/workflows/pythonapp.yml

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python 3.11
-      uses: actions/setup-python@v1
+    - uses: actions/checkout@v4
+    - name: Set up Python 3.12
+      uses: actions/setup-python@v5
       with:
-        python-version: 3.11
+        python-version: 3.12
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11-bookworm as builder
+FROM python:3.12 as builder
 
 RUN pip install poetry==1.7.1
 
@@ -14,15 +14,18 @@ RUN touch README.md
 
 RUN --mount=type=cache,target=$POETRY_CACHE_DIR poetry install --without dev --no-root
 
-FROM python:3.11-slim-bookworm as runtime
+FROM python:3.12-slim as runtime
 
 ENV VIRTUAL_ENV=/app/.venv \
     PATH="/app/.venv/bin:$PATH"
 
-RUN mkdir /data
+RUN useradd rollbot && mkdir /app
 
 COPY --from=builder ${VIRTUAL_ENV} ${VIRTUAL_ENV}
+COPY src/rollbot /app/rollbot
+RUN chown -R rollbot:rollbot /app
 
-COPY src/rollbot ./rollbot
+USER rollbot
+WORKDIR /app
 
 ENTRYPOINT ["python", "-m", "rollbot"]