From 8188072b082f277fa4c1c3a7acbeecce0509908a Mon Sep 17 00:00:00 2001 From: Ashwin Kumar Sivakumar Date: Sun, 14 Jun 2026 22:49:06 +0530 Subject: [PATCH] ci: deploy backend via github actions and ghcr --- .github/workflows/build-and-deploy-ghcr.yml | 172 ++++++++++++++++++++ .github/workflows/sync-to-forgejo.yml | 40 ----- Dockerfile.simple | 2 +- 3 files changed, 173 insertions(+), 41 deletions(-) create mode 100644 .github/workflows/build-and-deploy-ghcr.yml delete mode 100644 .github/workflows/sync-to-forgejo.yml diff --git a/.github/workflows/build-and-deploy-ghcr.yml b/.github/workflows/build-and-deploy-ghcr.yml new file mode 100644 index 0000000..4e3e7c3 --- /dev/null +++ b/.github/workflows/build-and-deploy-ghcr.yml @@ -0,0 +1,172 @@ +name: build-and-deploy-ghcr + +on: + push: + branches: + - main + - high-performance + workflow_dispatch: + +permissions: + contents: read + packages: write + +env: + K8S_NAMESPACE: nxtgauge + GITOPS_REPO: Traceworks2023/nxtgauge-gitops + +jobs: + detect-changes: + runs-on: ubuntu-latest + outputs: + services: ${{ steps.detect.outputs.services }} + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 2 + + - name: Detect changed services + id: detect + shell: bash + run: | + set -euo pipefail + ALL_SERVICES='gateway users companies jobs leads job-seekers customers payments employees photographers makeup-artists tutors developers video-editors graphic-designers social-media-managers fitness-trainers catering-services ugc-content-creators cron' + + if git rev-parse --verify HEAD^ >/dev/null 2>&1; then + CHANGED_FILES="$(git diff --name-only HEAD^ HEAD)" + else + CHANGED_FILES="$(git ls-files)" + fi + + LAST_COMMIT_MSG="$(git log -1 --pretty=%B | tr '\n' ' ')" + FORCE_FULL_BUILD=false + if echo "$LAST_COMMIT_MSG" | grep -Eiq 'trigger build|force build|rebuild all'; then + FORCE_FULL_BUILD=true + elif echo "$CHANGED_FILES" | grep -Eq '^(\.github/workflows/|\.forgejo/workflows/|Dockerfile|Cargo\.toml|Cargo\.lock|crates/|scripts/)'; then + FORCE_FULL_BUILD=true + fi + + if [ "$FORCE_FULL_BUILD" = true ]; then + SERVICES_JSON="$(printf '%s\n' $ALL_SERVICES | python3 -c 'import json,sys; print(json.dumps([line.strip() for line in sys.stdin if line.strip()]))')" + echo "services=$SERVICES_JSON" >> "$GITHUB_OUTPUT" + exit 0 + fi + + SERVICES_JSON="$(printf '%s\n' "$CHANGED_FILES" | python3 -c ' +import json +import sys +mapping = { + "apps/gateway/": "gateway", + "apps/users/": "users", + "apps/companies/": "companies", + "apps/jobs/": "jobs", + "apps/leads/": "leads", + "apps/job_seekers/": "job-seekers", + "apps/customers/": "customers", + "apps/payments/": "payments", + "apps/employees/": "employees", + "apps/photographers/": "photographers", + "apps/makeup_artists/": "makeup-artists", + "apps/tutors/": "tutors", + "apps/developers/": "developers", + "apps/video_editors/": "video-editors", + "apps/graphic_designers/": "graphic-designers", + "apps/social_media_managers/": "social-media-managers", + "apps/fitness_trainers/": "fitness-trainers", + "apps/catering_services/": "catering-services", + "apps/ugc_content_creators/": "ugc-content-creators", + "apps/cron/": "cron", +} +services = [] +seen = set() +for raw in sys.stdin: + line = raw.strip() + for prefix, service in mapping.items(): + if line.startswith(prefix) and service not in seen: + seen.add(service) + services.append(service) + break +print(json.dumps(services)) +')" + echo "services=$SERVICES_JSON" >> "$GITHUB_OUTPUT" + + build-deploy: + needs: detect-changes + if: needs.detect-changes.outputs.services != '[]' + runs-on: ubuntu-latest + strategy: + fail-fast: false + max-parallel: 1 + matrix: + service: ${{ fromJson(needs.detect-changes.outputs.services) }} + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ secrets.GHCR_USERNAME }} + password: ${{ secrets.DEPLOY_GITHUB_TOKEN }} + + - name: Build and push image + id: build + uses: docker/build-push-action@v6 + with: + context: . + file: Dockerfile.simple + push: true + platforms: linux/amd64 + build-args: | + SERVICE_NAME=${{ matrix.service }} + tags: ghcr.io/${{ github.repository_owner }}/nxtgauge-rust-${{ matrix.service }}:${{ github.sha }} + + - name: Configure kubeconfig + run: | + set -euo pipefail + mkdir -p ~/.kube + printf '%s' '${{ secrets.KUBE_CONFIG_DATA }}' | base64 -d > ~/.kube/config + chmod 600 ~/.kube/config + + - name: Install kubectl + uses: azure/setup-kubectl@v4 + + - name: Deploy to Kubernetes + env: + GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }} + GHCR_TOKEN: ${{ secrets.DEPLOY_GITHUB_TOKEN }} + run: | + set -euo pipefail + deployment="nxtgauge-rust-${{ matrix.service }}" + container="${{ matrix.service }}" + image_ref="ghcr.io/${{ github.repository_owner }}/nxtgauge-rust-${{ matrix.service }}@${{ steps.build.outputs.digest }}" + kubectl -n "$K8S_NAMESPACE" create secret docker-registry ghcr-regcred --docker-server=ghcr.io --docker-username="$GHCR_USERNAME" --docker-password="$GHCR_TOKEN" --dry-run=client -o yaml | kubectl apply -f - + kubectl -n "$K8S_NAMESPACE" patch deployment "$deployment" --type merge -p '{"spec":{"template":{"spec":{"imagePullSecrets":[{"name":"ghcr-regcred"}]}}}}' + kubectl -n "$K8S_NAMESPACE" set image deployment/"$deployment" "$container"="$image_ref" + kubectl -n "$K8S_NAMESPACE" rollout status deployment/"$deployment" --timeout=15m + + - name: Sync GitOps release + env: + GITOPS_TOKEN: ${{ secrets.DEPLOY_GITHUB_TOKEN }} + run: | + set -euo pipefail + git clone "https://${{ secrets.GHCR_USERNAME }}:${GITOPS_TOKEN}@github.com/${GITOPS_REPO}.git" /tmp/nxtgauge-gitops + cd /tmp/nxtgauge-gitops + ./scripts/set-backend-rust-release.sh "${{ matrix.service }}" "${{ steps.build.outputs.digest }}" + if git diff --quiet; then + echo "GitOps repo already up to date." + exit 0 + fi + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + git add apps/nxtgauge-backend-rust/overlays/prod/backend-release-state.tsv apps/nxtgauge-backend-rust/overlays/prod/release-patches.yaml apps/nxtgauge-backend-rust/overlays/prod/disabled-deployments.yaml + git commit -m "chore(gitops): deploy backend ${{ matrix.service }}@${{ github.sha }}" + git pull --rebase origin main + git push origin HEAD:main diff --git a/.github/workflows/sync-to-forgejo.yml b/.github/workflows/sync-to-forgejo.yml deleted file mode 100644 index 354a407..0000000 --- a/.github/workflows/sync-to-forgejo.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: sync-to-forgejo - -on: - push: - branches: - - main - - high-performance - -jobs: - sync: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Push branch to Forgejo - env: - FORGEJO_SECRET: ${{ secrets.FORGEJO_SECRET || secrets.GITEA_SECRET }} - FORGEJO_OWNER: ${{ secrets.FORGEJO_OWNER || 'ashwin' }} - FORGEJO_USERNAME: ${{ secrets.FORGEJO_USERNAME || secrets.GITEA_USERNAME || 'ashwin' }} - REPO: ${{ github.event.repository.name }} - BRANCH: ${{ github.ref_name }} - run: | - set -euo pipefail - test -n "${FORGEJO_SECRET:-}" || { echo "FORGEJO_SECRET is empty"; exit 1; } - - AUTH="$(printf '%s' "${FORGEJO_USERNAME}:${FORGEJO_SECRET}" | base64 -w0)" - TARGET="https://ci.nxtgauge.com/${FORGEJO_OWNER}/${REPO}.git" - - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git remote remove forgejo 2>/dev/null || true - git remote add forgejo "${TARGET}" - - git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" push forgejo "HEAD:${BRANCH}" --force - git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" push forgejo --tags --force diff --git a/Dockerfile.simple b/Dockerfile.simple index aba206f..48e31c1 100644 --- a/Dockerfile.simple +++ b/Dockerfile.simple @@ -3,7 +3,7 @@ ARG SERVICE_NAME -FROM registry.nxtgauge.com/rust:alpine AS builder +FROM rust:alpine AS builder ARG SERVICE_NAME # Install build deps + rust toolchain (Alpine-packaged Rust lacks proc-macro support)