fix(ci): deploy ai assistant via immutable gitops release
This commit is contained in:
Ashwin Kumar Sivakumar
parent
e5733a147b
commit
0be8bd65b5
2 changed files with 59 additions and 207 deletions
|
|
@ -1,149 +0,0 @@
|
||||||
#!/usr/bin/env python3
|
|
||||||
"""
|
|
||||||
Update GitOps kustomization.yaml with new image SHA tags.
|
|
||||||
|
|
||||||
Usage:
|
|
||||||
python3 update-gitops.py \
|
|
||||||
--repo /path/to/nxtgauge-gitops \
|
|
||||||
--service gateway \
|
|
||||||
--sha abc123def456...
|
|
||||||
|
|
||||||
This script:
|
|
||||||
1. Updates the newTag for the specified service to the SHA
|
|
||||||
2. Commits and pushes to the gitops repo
|
|
||||||
3. Flux detects the change and deploys
|
|
||||||
"""
|
|
||||||
|
|
||||||
import argparse
|
|
||||||
import os
|
|
||||||
import re
|
|
||||||
import subprocess
|
|
||||||
import sys
|
|
||||||
|
|
||||||
|
|
||||||
def run(cmd: list[str], cwd: str = None) -> tuple[int, str, str]:
|
|
||||||
"""Run a command and return (returncode, stdout, stderr)."""
|
|
||||||
result = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True)
|
|
||||||
return result.returncode, result.stdout, result.stderr
|
|
||||||
|
|
||||||
|
|
||||||
def update_kustomization(kustomization_path: str, service: str, sha: str) -> bool:
|
|
||||||
"""Update the newTag for a service in kustomization.yaml."""
|
|
||||||
with open(kustomization_path, "r") as f:
|
|
||||||
content = f.read()
|
|
||||||
|
|
||||||
# Pattern to find image entry for the service
|
|
||||||
# Matches: - name: registry.nxtgauge.com/nxtgauge-rust-{service}
|
|
||||||
# newTag: something
|
|
||||||
pattern = rf'(\s+-\s+name:\s+registry\.nxtgauge\.com/nxtgauge-rust-{re.escape(service)}\n\s+newTag:\s+)[^\n]+'
|
|
||||||
|
|
||||||
replacement = rf'\g<1>{sha}'
|
|
||||||
|
|
||||||
new_content, count = re.subn(pattern, replacement, content)
|
|
||||||
|
|
||||||
if count == 0:
|
|
||||||
# Try without the nxtgauge-rust- prefix (for frontend, admin, etc)
|
|
||||||
pattern = rf'(\s+-\s+name:\s+registry\.nxtgauge\.com/nxtgauge-{re.escape(service)}\n\s+newTag:\s+)[^\n]+'
|
|
||||||
new_content, count = re.subn(pattern, replacement, content)
|
|
||||||
|
|
||||||
if count == 0:
|
|
||||||
print(f"[ERROR] Could not find image entry for service: {service}")
|
|
||||||
return False
|
|
||||||
|
|
||||||
with open(kustomization_path, "w") as f:
|
|
||||||
f.write(new_content)
|
|
||||||
|
|
||||||
print(f"[OK] Updated {service} to SHA {sha}")
|
|
||||||
return True
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
parser = argparse.ArgumentParser(description="Update GitOps with new image SHA")
|
|
||||||
parser.add_argument("--repo", required=True, help="Path to gitops repo")
|
|
||||||
parser.add_argument("--service", required=True, help="Service name (e.g., gateway, users, frontend-solid)")
|
|
||||||
parser.add_argument("--sha", required=True, help="Git SHA to deploy")
|
|
||||||
parser.add_argument("--message", default=None, help="Commit message")
|
|
||||||
args = parser.parse_args()
|
|
||||||
|
|
||||||
service_image_map = {
|
|
||||||
"gateway": "nxtgauge-rust-gateway",
|
|
||||||
"users": "nxtgauge-rust-users",
|
|
||||||
"companies": "nxtgauge-rust-companies",
|
|
||||||
"jobs": "nxtgauge-rust-jobs",
|
|
||||||
"leads": "nxtgauge-rust-leads",
|
|
||||||
"job-seekers": "nxtgauge-rust-job-seekers",
|
|
||||||
"customers": "nxtgauge-rust-customers",
|
|
||||||
"payments": "nxtgauge-rust-payments",
|
|
||||||
"employees": "nxtgauge-rust-employees",
|
|
||||||
"photographers": "nxtgauge-rust-photographers",
|
|
||||||
"makeup-artists": "nxtgauge-rust-makeup-artists",
|
|
||||||
"tutors": "nxtgauge-rust-tutors",
|
|
||||||
"developers": "nxtgauge-rust-developers",
|
|
||||||
"video-editors": "nxtgauge-rust-video-editors",
|
|
||||||
"graphic-designers": "nxtgauge-rust-graphic-designers",
|
|
||||||
"social-media-managers": "nxtgauge-rust-social-media-managers",
|
|
||||||
"fitness-trainers": "nxtgauge-rust-fitness-trainers",
|
|
||||||
"catering-services": "nxtgauge-rust-catering-services",
|
|
||||||
"ugc-content-creators": "nxtgauge-rust-ugc-content-creators",
|
|
||||||
"cron": "nxtgauge-rust-cron",
|
|
||||||
"frontend-solid": "nxtgauge-frontend-solid",
|
|
||||||
"admin-solid": "nxtgauge-admin-solid",
|
|
||||||
"ai-assistant": "nxtgauge-ai-assistant",
|
|
||||||
}
|
|
||||||
|
|
||||||
# Determine which kustomization file to update
|
|
||||||
if service_image_map.get(args.service):
|
|
||||||
image_name = service_image_map[args.service]
|
|
||||||
else:
|
|
||||||
image_name = f"nxtgauge-{args.service}"
|
|
||||||
|
|
||||||
# Find the right kustomization file based on service
|
|
||||||
if "frontend" in args.service:
|
|
||||||
kustomization_path = os.path.join(args.repo, "apps/nxtgauge-frontend-solid/overlays/prod/kustomization.yaml")
|
|
||||||
if not os.path.exists(kustomization_path):
|
|
||||||
kustomization_path = os.path.join(args.repo, "apps/nxtgauge-frontend-solid/base/kustomization.yaml")
|
|
||||||
elif "admin" in args.service:
|
|
||||||
kustomization_path = os.path.join(args.repo, "apps/nxtgauge-admin-solid/overlays/prod/kustomization.yaml")
|
|
||||||
if not os.path.exists(kustomization_path):
|
|
||||||
kustomization_path = os.path.join(args.repo, "apps/nxtgauge-admin-solid/base/kustomization.yaml")
|
|
||||||
elif "ai-assistant" in args.service:
|
|
||||||
kustomization_path = os.path.join(args.repo, "apps/nxtgauge-ai-assistant/overlays/prod/kustomization.yaml")
|
|
||||||
if not os.path.exists(kustomization_path):
|
|
||||||
kustomization_path = os.path.join(args.repo, "apps/nxtgauge-ai-assistant/base/kustomization.yaml")
|
|
||||||
else:
|
|
||||||
kustomization_path = os.path.join(args.repo, "apps/nxtgauge-backend-rust/overlays/prod/kustomization.yaml")
|
|
||||||
|
|
||||||
if not os.path.exists(kustomization_path):
|
|
||||||
print(f"[ERROR] Kustomization file not found: {kustomization_path}")
|
|
||||||
sys.exit(0) # Exit 0 per workflow requirement
|
|
||||||
|
|
||||||
print(f"Updating {kustomization_path} for service {args.service}")
|
|
||||||
|
|
||||||
if not update_kustomization(kustomization_path, args.service, args.sha):
|
|
||||||
sys.exit(0) # Exit 0 per workflow requirement
|
|
||||||
|
|
||||||
# Git add, commit, push
|
|
||||||
commit_msg = args.message or f"chore: deploy {args.service}@{args.sha}"
|
|
||||||
|
|
||||||
run(["git", "add", "-A"], cwd=args.repo)
|
|
||||||
code, stdout, stderr = run(["git", "diff", "--cached", "--stat"], cwd=args.repo)
|
|
||||||
|
|
||||||
if not stdout.strip():
|
|
||||||
print("[INFO] No changes to commit")
|
|
||||||
sys.exit(0)
|
|
||||||
|
|
||||||
print(f"Changes to commit:\n{stdout}")
|
|
||||||
|
|
||||||
run(["git", "commit", "-m", commit_msg], cwd=args.repo)
|
|
||||||
code, stdout, stderr = run(["git", "push"], cwd=args.repo)
|
|
||||||
|
|
||||||
if code != 0:
|
|
||||||
print(f"[ERROR] Push failed: {stderr}")
|
|
||||||
else:
|
|
||||||
print(f"[OK] Pushed update to gitops repo")
|
|
||||||
|
|
||||||
sys.exit(0) # Always exit 0 per workflow requirement
|
|
||||||
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
main()
|
|
||||||
|
|
@ -1,92 +1,62 @@
|
||||||
name: build-and-push
|
name: build-and-release
|
||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
|
- high-performance
|
||||||
|
|
||||||
|
concurrency:
|
||||||
|
group: ai-assistant-build-${{ github.ref }}
|
||||||
|
cancel-in-progress: true
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
runs-on: ubuntu-latest
|
runs-on: self-hosted
|
||||||
env:
|
|
||||||
DOCKER_HOST: unix:///var/run/docker.sock
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
- name: Set up Docker Buildx
|
- name: Set up Docker Buildx
|
||||||
run: |
|
run: |
|
||||||
export DOCKER_HOST=unix:///var/run/docker.sock
|
set -euo pipefail
|
||||||
docker version
|
docker version
|
||||||
docker buildx create --use || true
|
docker buildx create --use --name nxtgauge-builder || docker buildx use nxtgauge-builder
|
||||||
docker buildx inspect --bootstrap
|
docker buildx inspect --bootstrap
|
||||||
|
|
||||||
- name: Login to Registry
|
- name: Login to registry
|
||||||
env:
|
env:
|
||||||
REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
|
REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
|
||||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
||||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
export DOCKER_HOST=unix:///var/run/docker.sock
|
|
||||||
SHA="$(git rev-parse HEAD)"
|
|
||||||
test -n "$REGISTRY_HOSTPORT"
|
test -n "$REGISTRY_HOSTPORT"
|
||||||
echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin
|
printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin
|
||||||
|
|
||||||
- name: Build and push
|
- name: Build and push image
|
||||||
env:
|
env:
|
||||||
REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
|
REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
|
||||||
|
SHA: ${{ github.sha }}
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
export DOCKER_HOST=unix:///var/run/docker.sock
|
metadata_file="/tmp/ai-assistant-metadata.json"
|
||||||
SHA="$(git rev-parse HEAD)"
|
image_ref="$REGISTRY_HOSTPORT/nxtgauge-ai-assistant:$SHA"
|
||||||
|
|
||||||
docker buildx build --push \
|
docker buildx build --push \
|
||||||
|
--metadata-file "$metadata_file" \
|
||||||
-f Dockerfile \
|
-f Dockerfile \
|
||||||
-t "$REGISTRY_HOSTPORT/nxtgauge-ai-assistant:${SHA}" \
|
-t "$image_ref" \
|
||||||
-t "$REGISTRY_HOSTPORT/nxtgauge-ai-assistant:main-latest" \
|
|
||||||
.
|
.
|
||||||
|
|
||||||
- name: Update GitOps and trigger deployment
|
digest="$(grep -o '"containerimage.digest":"sha256:[^"]*"' "$metadata_file" | cut -d'"' -f4)"
|
||||||
|
test -n "$digest"
|
||||||
|
printf '%s@%s\n' "$REGISTRY_HOSTPORT/nxtgauge-ai-assistant" "$digest" > /tmp/ai-assistant-image-ref.txt
|
||||||
|
|
||||||
|
- name: Prune old SHA tags
|
||||||
if: success()
|
if: success()
|
||||||
continue-on-error: true
|
|
||||||
env:
|
|
||||||
GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
|
|
||||||
GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
SHA="$(git rev-parse HEAD)"
|
|
||||||
|
|
||||||
if [ -z "$GITEOPS_REPO" ]; then
|
|
||||||
echo "GITEOPS_REPO secret not set, skipping GitOps update"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
GITEOPS_DIR=$(mktemp -d)
|
|
||||||
git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
|
|
||||||
cd "$GITEOPS_DIR"
|
|
||||||
|
|
||||||
mkdir -p ~/.ssh
|
|
||||||
echo "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
|
|
||||||
chmod 600 ~/.ssh/id_ed25519
|
|
||||||
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
|
|
||||||
|
|
||||||
python3 .forgejo/scripts/update-gitops.py \
|
|
||||||
--repo "$GITEOPS_DIR" \
|
|
||||||
--service "ai-assistant" \
|
|
||||||
--sha "${SHA}" \
|
|
||||||
--message "chore: deploy ai-assistant@${SHA}"
|
|
||||||
|
|
||||||
rm -rf "$GITEOPS_DIR"
|
|
||||||
|
|
||||||
cleanup-after-build:
|
|
||||||
needs: build
|
|
||||||
if: always() && needs.build.result == 'success'
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
|
|
||||||
- name: Cleanup old image tags (keep 2 SHA tags)
|
|
||||||
continue-on-error: true
|
continue-on-error: true
|
||||||
env:
|
env:
|
||||||
REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
|
REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
|
||||||
|
|
@ -94,11 +64,42 @@ jobs:
|
||||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
echo "AI Assistant post-build cleanup: keeping only 2 SHA tags"
|
|
||||||
python3 .forgejo/scripts/registry_prune.py \
|
python3 .forgejo/scripts/registry_prune.py \
|
||||||
--registry "$REGISTRY_HOST" \
|
--registry "$REGISTRY_HOST" \
|
||||||
--repo "nxtgauge-ai-assistant" \
|
--repo "nxtgauge-ai-assistant" \
|
||||||
--username "$REGISTRY_USERNAME" \
|
--username "$REGISTRY_USERNAME" \
|
||||||
--password "$REGISTRY_PASSWORD" \
|
--password "$REGISTRY_PASSWORD" \
|
||||||
--keep 2 || echo "Warning: cleanup failed (continuing)"
|
--keep 2
|
||||||
echo "Cleanup completed"
|
|
||||||
|
- name: Update GitOps release
|
||||||
|
env:
|
||||||
|
GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
|
||||||
|
GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
|
||||||
|
SHA: ${{ github.sha }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
test -n "$GITEOPS_REPO"
|
||||||
|
test -n "$GITEOPS_SSH_KEY"
|
||||||
|
|
||||||
|
mkdir -p ~/.ssh
|
||||||
|
printf '%s\n' "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
|
||||||
|
chmod 600 ~/.ssh/id_ed25519
|
||||||
|
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
|
||||||
|
|
||||||
|
GITEOPS_DIR=$(mktemp -d)
|
||||||
|
git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
|
||||||
|
cd "$GITEOPS_DIR"
|
||||||
|
|
||||||
|
image_ref="$(cat /tmp/ai-assistant-image-ref.txt)"
|
||||||
|
./scripts/set-app-release.sh ai-assistant "$image_ref"
|
||||||
|
|
||||||
|
if git diff --quiet; then
|
||||||
|
echo "GitOps repo already up to date."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
git config user.name "forgejo-actions[bot]"
|
||||||
|
git config user.email "forgejo-actions@ci.nxtgauge.com"
|
||||||
|
git add apps scripts/set-app-release.sh
|
||||||
|
git commit -m "chore(gitops): deploy ai-assistant@${SHA}"
|
||||||
|
git push
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue