ci(forgejo): update backend build pipeline
This commit is contained in:
Ashwin Kumar Sivakumar
parent
96276579d1
commit
e9fc9c9502
1 changed files with 60 additions and 249 deletions
|
|
@ -1,4 +1,4 @@
|
||||||
name: build-and-push
|
name: Build Backend And Update GitOps
|
||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
|
|
@ -7,267 +7,78 @@ on:
|
||||||
- high-performance
|
- high-performance
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
detect-changes:
|
build-and-update:
|
||||||
runs-on: ubuntu-latest
|
|
||||||
outputs:
|
|
||||||
services_csv: ${{ steps.detect.outputs.services_csv }}
|
|
||||||
has_changes: ${{ steps.detect.outputs.has_changes }}
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@v4
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Detect changed services
|
|
||||||
id: detect
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
set_output() {
|
|
||||||
local key="$1"
|
|
||||||
local value="$2"
|
|
||||||
if [ -n "${GITHUB_OUTPUT:-}" ]; then
|
|
||||||
echo "$key=$value" >> "$GITHUB_OUTPUT"
|
|
||||||
fi
|
|
||||||
echo "::set-output name=$key::$value"
|
|
||||||
}
|
|
||||||
|
|
||||||
if git rev-parse --verify HEAD^ >/dev/null 2>&1; then
|
|
||||||
CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
|
|
||||||
else
|
|
||||||
CHANGED_FILES=$(git ls-files)
|
|
||||||
fi
|
|
||||||
|
|
||||||
LAST_COMMIT_MSG=$(git log -1 --pretty=%B | tr '\n' ' ')
|
|
||||||
|
|
||||||
echo "Changed files:"
|
|
||||||
echo "$CHANGED_FILES"
|
|
||||||
|
|
||||||
ALL_SERVICES='gateway,users,companies,jobs,leads,job-seekers,customers,payments,employees,photographers,makeup-artists,tutors,developers,video-editors,graphic-designers,social-media-managers,fitness-trainers,catering-services,ugc-content-creators,cron'
|
|
||||||
|
|
||||||
# Force full build for explicit trigger commits.
|
|
||||||
if echo "$LAST_COMMIT_MSG" | grep -Eiq 'trigger gitea pipeline|force build|rebuild all'; then
|
|
||||||
set_output "services_csv" "$ALL_SERVICES"
|
|
||||||
set_output "has_changes" "true"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Build everything for workflow/docker/shared backend changes.
|
|
||||||
if echo "$CHANGED_FILES" | grep -Eq '^(\.gitea/workflows/|Dockerfile|Dockerfile\.|Cargo\.toml|Cargo\.lock|crates/|scripts/)'; then
|
|
||||||
set_output "services_csv" "$ALL_SERVICES"
|
|
||||||
set_output "has_changes" "true"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
SERVICES=''
|
|
||||||
add_service() {
|
|
||||||
local svc="$1"
|
|
||||||
case ",${SERVICES}," in
|
|
||||||
*",${svc},"*) ;;
|
|
||||||
*)
|
|
||||||
if [ -z "$SERVICES" ]; then
|
|
||||||
SERVICES="$svc"
|
|
||||||
else
|
|
||||||
SERVICES="$SERVICES,$svc"
|
|
||||||
fi
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
}
|
|
||||||
|
|
||||||
while IFS= read -r f; do
|
|
||||||
case "$f" in
|
|
||||||
apps/gateway/*) add_service "gateway" ;;
|
|
||||||
apps/users/*) add_service "users" ;;
|
|
||||||
apps/companies/*) add_service "companies" ;;
|
|
||||||
apps/jobs/*) add_service "jobs" ;;
|
|
||||||
apps/leads/*) add_service "leads" ;;
|
|
||||||
apps/job_seekers/*) add_service "job-seekers" ;;
|
|
||||||
apps/customers/*) add_service "customers" ;;
|
|
||||||
apps/payments/*) add_service "payments" ;;
|
|
||||||
apps/employees/*) add_service "employees" ;;
|
|
||||||
apps/photographers/*) add_service "photographers" ;;
|
|
||||||
apps/makeup_artists/*) add_service "makeup-artists" ;;
|
|
||||||
apps/tutors/*) add_service "tutors" ;;
|
|
||||||
apps/developers/*) add_service "developers" ;;
|
|
||||||
apps/video_editors/*) add_service "video-editors" ;;
|
|
||||||
apps/graphic_designers/*) add_service "graphic-designers" ;;
|
|
||||||
apps/social_media_managers/*) add_service "social-media-managers" ;;
|
|
||||||
apps/fitness_trainers/*) add_service "fitness-trainers" ;;
|
|
||||||
apps/catering_services/*) add_service "catering-services" ;;
|
|
||||||
apps/ugc_content_creators/*) add_service "ugc-content-creators" ;;
|
|
||||||
apps/cron/*) add_service "cron" ;;
|
|
||||||
esac
|
|
||||||
done <<< "$CHANGED_FILES"
|
|
||||||
|
|
||||||
if [ -z "$SERVICES" ]; then
|
|
||||||
set_output "services_csv" ""
|
|
||||||
set_output "has_changes" "false"
|
|
||||||
else
|
|
||||||
set_output "services_csv" "$SERVICES"
|
|
||||||
set_output "has_changes" "true"
|
|
||||||
fi
|
|
||||||
|
|
||||||
build:
|
|
||||||
needs: detect-changes
|
|
||||||
if: needs.detect-changes.outputs.has_changes == 'true'
|
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
env:
|
env:
|
||||||
DOCKER_HOST: unix:///var/run/docker.sock
|
DOCKER_HOST: unix:///var/run/docker.sock
|
||||||
strategy:
|
GITOPS_USERNAME: ${{ secrets.GITOPS_GITHUB_USERNAME || 'Traceworks2023' }}
|
||||||
fail-fast: false
|
GITOPS_PASSWORD: ${{ secrets.GITOPS_GITHUB_TOKEN || secrets.GITOPS_PAT }}
|
||||||
matrix:
|
GITOPS_REPO: https://github.com/Traceworks2023/nxtgauge-gitops.git
|
||||||
service:
|
|
||||||
- gateway
|
|
||||||
- users
|
|
||||||
- companies
|
|
||||||
- jobs
|
|
||||||
- leads
|
|
||||||
- job-seekers
|
|
||||||
- customers
|
|
||||||
- payments
|
|
||||||
- employees
|
|
||||||
- photographers
|
|
||||||
- makeup-artists
|
|
||||||
- tutors
|
|
||||||
- developers
|
|
||||||
- video-editors
|
|
||||||
- graphic-designers
|
|
||||||
- social-media-managers
|
|
||||||
- fitness-trainers
|
|
||||||
- catering-services
|
|
||||||
- ugc-content-creators
|
|
||||||
- cron
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
- name: Set up Docker Buildx
|
- name: Install Docker CLI
|
||||||
run: |
|
run: |
|
||||||
export DOCKER_HOST=unix:///var/run/docker.sock
|
apt-get update
|
||||||
docker version
|
apt-get install -y docker.io git python3
|
||||||
docker buildx create --use || true
|
|
||||||
docker buildx inspect --bootstrap
|
|
||||||
|
|
||||||
- name: Login to Registry
|
- name: Log in to registry
|
||||||
env:
|
run: |
|
||||||
REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ci.nxtgauge.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
||||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
- name: Build, push, and update GitOps
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
export DOCKER_HOST=unix:///var/run/docker.sock
|
test -n "${GITOPS_PASSWORD:-}" || { echo "GITOPS_PASSWORD is empty"; exit 1; }
|
||||||
test -n "$REGISTRY_HOSTPORT"
|
AUTH="$(printf '%s' "${GITOPS_USERNAME}:${GITOPS_PASSWORD}" | base64 -w0)"
|
||||||
|
TMP_DIR="$(mktemp -d)"
|
||||||
|
git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" clone --branch main "${GITOPS_REPO}" "${TMP_DIR}"
|
||||||
|
while IFS='|' read -r service app_dir; do
|
||||||
|
[ -n "${service}" ] || continue
|
||||||
|
IMAGE="ci.nxtgauge.com/ashwin/nxtgauge-rust-${service}:${{ github.sha }}"
|
||||||
|
docker build -f "${app_dir}/Dockerfile" -t "${IMAGE}" .
|
||||||
|
docker push "${IMAGE}"
|
||||||
|
IMAGE_DIGEST="$(docker image inspect "${IMAGE}" --format '{{join .RepoDigests "\n"}}' | grep '@sha256:' | sed -n '1s|.*@||p')"
|
||||||
|
test -n "${IMAGE_DIGEST}" || { echo "failed to resolve image digest for ${IMAGE}"; exit 1; }
|
||||||
|
(
|
||||||
|
cd "${TMP_DIR}"
|
||||||
|
./scripts/set-backend-rust-release.sh "${service}" "${IMAGE_DIGEST}"
|
||||||
|
)
|
||||||
|
done <<'SERVICES'
|
||||||
|
catering-services|apps/catering_services
|
||||||
|
companies|apps/companies
|
||||||
|
cron|apps/cron
|
||||||
|
customers|apps/customers
|
||||||
|
developers|apps/developers
|
||||||
|
employees|apps/employees
|
||||||
|
fitness-trainers|apps/fitness_trainers
|
||||||
|
gateway|apps/gateway
|
||||||
|
graphic-designers|apps/graphic_designers
|
||||||
|
job-seekers|apps/job_seekers
|
||||||
|
jobs|apps/jobs
|
||||||
|
leads|apps/leads
|
||||||
|
makeup-artists|apps/makeup_artists
|
||||||
|
payments|apps/payments
|
||||||
|
photographers|apps/photographers
|
||||||
|
social-media-managers|apps/social_media_managers
|
||||||
|
tutors|apps/tutors
|
||||||
|
ugc-content-creators|apps/ugc_content_creators
|
||||||
|
users|apps/users
|
||||||
|
video-editors|apps/video_editors
|
||||||
|
SERVICES
|
||||||
|
cd "${TMP_DIR}"
|
||||||
|
git config user.name "forgejo-actions"
|
||||||
|
git config user.email "forgejo-actions@nxtgauge.com"
|
||||||
|
git add apps/nxtgauge-backend-rust/overlays/prod/backend-release-state.tsv apps/nxtgauge-backend-rust/overlays/prod/release-patches.yaml apps/nxtgauge-backend-rust/overlays/prod/disabled-deployments.yaml
|
||||||
|
git diff --cached --quiet && exit 0
|
||||||
|
git commit -m "chore(gitops): deploy backend@${{ github.sha }}"
|
||||||
for attempt in 1 2 3 4 5; do
|
for attempt in 1 2 3 4 5; do
|
||||||
echo "Registry login attempt $attempt to $REGISTRY_HOSTPORT"
|
git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" pull --rebase origin main
|
||||||
if echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOSTPORT" -u "$REGISTRY_USERNAME" --password-stdin; then
|
if git -c http.extraHeader="AUTHORIZATION: basic ${AUTH}" push origin main; then
|
||||||
exit 0
|
exit 0
|
||||||
fi
|
fi
|
||||||
echo "Registry login failed (attempt $attempt); retrying..."
|
sleep "$attempt"
|
||||||
sleep $((attempt * 8))
|
|
||||||
done
|
done
|
||||||
|
echo "failed to push GitOps update after retries"
|
||||||
echo "Registry login failed after retries"
|
|
||||||
exit 1
|
exit 1
|
||||||
|
|
||||||
- name: Build and push
|
|
||||||
env:
|
|
||||||
REGISTRY_HOSTPORT: ${{ secrets.REGISTRY_HOSTPORT }}
|
|
||||||
SERVICES_CSV: ${{ needs.detect-changes.outputs.services_csv }}
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
export DOCKER_HOST=unix:///var/run/docker.sock
|
|
||||||
if [ -n "$SERVICES_CSV" ] && ! echo ",$SERVICES_CSV," | grep -q ",${{ matrix.service }},"; then
|
|
||||||
echo "Skipping unchanged service: ${{ matrix.service }}"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
build_with_cache() {
|
|
||||||
docker buildx build --push \
|
|
||||||
-f Dockerfile.simple \
|
|
||||||
--build-arg SERVICE_NAME=${{ matrix.service }} \
|
|
||||||
--cache-from type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache \
|
|
||||||
--cache-to type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache,mode=max \
|
|
||||||
-t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
|
|
||||||
-t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
|
|
||||||
.
|
|
||||||
}
|
|
||||||
|
|
||||||
build_without_cache_export() {
|
|
||||||
docker buildx build --push \
|
|
||||||
-f Dockerfile.simple \
|
|
||||||
--build-arg SERVICE_NAME=${{ matrix.service }} \
|
|
||||||
--cache-from type=registry,ref=$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:buildcache \
|
|
||||||
-t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
|
|
||||||
-t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
|
|
||||||
.
|
|
||||||
}
|
|
||||||
|
|
||||||
for attempt in 1 2 3; do
|
|
||||||
echo "Build attempt $attempt with cache export for ${{ matrix.service }}"
|
|
||||||
if build_with_cache; then
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
echo "Attempt $attempt failed; retrying after backoff"
|
|
||||||
sleep $((attempt * 10))
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "Falling back to build without cache export for ${{ matrix.service }}"
|
|
||||||
if ! build_without_cache_export; then
|
|
||||||
echo "Final fallback: push tags without cache"
|
|
||||||
docker buildx build --push \
|
|
||||||
-f Dockerfile.simple \
|
|
||||||
--build-arg SERVICE_NAME=${{ matrix.service }} \
|
|
||||||
-t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:${{ gitea.sha }}" \
|
|
||||||
-t "$REGISTRY_HOSTPORT/nxtgauge-rust-${{ matrix.service }}:high-performance-latest" \
|
|
||||||
.
|
|
||||||
fi
|
|
||||||
|
|
||||||
- name: Prune old image tags (keep latest 1 SHA)
|
|
||||||
if: success()
|
|
||||||
continue-on-error: true
|
|
||||||
env:
|
|
||||||
REGISTRY_HOST: ${{ secrets.REGISTRY_HOSTPORT }}
|
|
||||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
||||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
python3 .gitea/scripts/registry_prune.py \
|
|
||||||
--registry "$REGISTRY_HOST" \
|
|
||||||
--repo "nxtgauge-rust-${{ matrix.service }}" \
|
|
||||||
--username "$REGISTRY_USERNAME" \
|
|
||||||
--password "$REGISTRY_PASSWORD" \
|
|
||||||
--keep 1
|
|
||||||
|
|
||||||
- name: Update GitOps and trigger deployment
|
|
||||||
if: always()
|
|
||||||
continue-on-error: true
|
|
||||||
env:
|
|
||||||
GITEOPS_REPO: ${{ secrets.GITEOPS_REPO }}
|
|
||||||
GITEOPS_SSH_KEY: ${{ secrets.GITEOPS_SSH_KEY }}
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
if [ -z "$GITEOPS_REPO" ]; then
|
|
||||||
echo "GITEOPS_REPO secret not set, skipping GitOps update"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Clone gitops repo
|
|
||||||
GITEOPS_DIR=$(mktemp -d)
|
|
||||||
git clone "$GITEOPS_REPO" "$GITEOPS_DIR"
|
|
||||||
cd "$GITEOPS_DIR"
|
|
||||||
|
|
||||||
# Set up SSH key for push
|
|
||||||
mkdir -p ~/.ssh
|
|
||||||
echo "$GITEOPS_SSH_KEY" > ~/.ssh/id_ed25519
|
|
||||||
chmod 600 ~/.ssh/id_ed25519
|
|
||||||
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
|
|
||||||
|
|
||||||
# Update gitops with new SHA
|
|
||||||
python3 .gitea/scripts/update-gitops.py \
|
|
||||||
--repo "$GITEOPS_DIR" \
|
|
||||||
--service "${{ matrix.service }}" \
|
|
||||||
--sha "${{ gitea.sha }}" \
|
|
||||||
--message "chore: deploy ${{ matrix.service }}@${{ gitea.sha }}"
|
|
||||||
|
|
||||||
rm -rf "$GITEOPS_DIR"
|
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue