Hackathon 2024 #10686
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deployment | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| prepare-dev-database: | |
| name: Prepare Dev Database | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Set Variables | |
| shell: bash | |
| run: | | |
| echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Deploy PostGIS instance | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| EPHEMERAL_STORAGE=True BUCKET=gpdqha DATA_SIZE=5Gi WAL_SIZE=5Gi bash openshift/scripts/oc_provision_crunchy.sh ${SUFFIX} apply | |
| build-web-image: | |
| # Declared ahead of build-api-image ; it runs slightly slower than the api build, and putting | |
| # it here increases the odds that it get's started 1st, so api and web are slightly more likely | |
| # to finish building at the same time. | |
| name: Build Web Image | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Set Variables | |
| shell: bash | |
| run: | | |
| echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Build wps-web Image | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_TOOL_TOKEN }}" | |
| GIT_BRANCH=${GITHUB_HEAD_REF} MODULE_NAME=web DOCKER_FILE=Dockerfile.web PATH_BC=openshift/templates/build.web.bc.yaml SENTRY_AUTH_TOKEN="${{ secrets.SENTRY_AUTH_TOKEN }}" bash openshift/scripts/oc_build.sh ${SUFFIX} apply | |
| build-api-image: | |
| name: Build API Image | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Set Variables | |
| shell: bash | |
| run: | | |
| echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Build wps-api Image | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_TOOL_TOKEN }}" | |
| GIT_BRANCH=${GITHUB_HEAD_REF} MODULE_NAME=api bash openshift/scripts/oc_build.sh ${SUFFIX} apply | |
| # TODO: Delete once pmtiles has run for some time | |
| # build-tileserv-image: | |
| # name: Build tileserv Image | |
| # runs-on: ubuntu-22.04 | |
| # steps: | |
| # - name: Set Variables | |
| # shell: bash | |
| # run: | | |
| # echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| # - name: Checkout | |
| # uses: actions/checkout@v4 | |
| # - name: Build wps-tileserv Image | |
| # shell: bash | |
| # run: | | |
| # oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_TOOL_TOKEN }}" | |
| # GIT_BRANCH=${GITHUB_HEAD_REF} MODULE_NAME=tileserv DOCKER_FILE=Dockerfile.tileserv PATH_BC=openshift/templates/tileserv/tileserv_build.yaml bash openshift/scripts/oc_build.sh ${SUFFIX} apply | |
| configure-nats-server-name: | |
| name: Configure nats server name | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Set Variables | |
| shell: bash | |
| run: | | |
| echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Configure | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| bash openshift/scripts/oc_provision_nats_server_config.sh ${SUFFIX} apply | |
| deploy-dev: | |
| name: Deploy to Dev | |
| if: github.triggering_actor != 'renovate' | |
| needs: | |
| [ | |
| build-api-image, | |
| build-web-image, | |
| prepare-dev-database, | |
| deploy-dev-queue, | |
| configure-nats-server-name, | |
| ] | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Set Variables | |
| shell: bash | |
| run: | | |
| echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Deploy API to Dev | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| MODULE_NAME=api SECOND_LEVEL_DOMAIN="apps.silver.devops.gov.bc.ca" VANITY_DOMAIN="${SUFFIX}-dev-psu.apps.silver.devops.gov.bc.ca" USE_WFWX="True" ENVIRONMENT="development" bash openshift/scripts/oc_deploy.sh ${SUFFIX} apply | |
| ## TODO: re-enable once crunchy is deployed: https://app.zenhub.com/workspaces/bcws---agile-psu-5e321393e038fba5bbe203b8/issues/gh/bcgov/wps/2340 | |
| - name: Hourly actuals cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| bash openshift/scripts/oc_provision_wfwx_hourly_actuals_cronjob.sh ${SUFFIX} apply | |
| # - name: Noon forecasts cronjob | |
| # shell: bash | |
| # run: | | |
| # oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| # bash openshift/scripts/oc_provision_wfwx_noon_forecasts_cronjob.sh ${SUFFIX} apply | |
| - name: Environment Canada GDPS cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_ec_gdps_cronjob.sh ${SUFFIX} apply | |
| - name: Environment Canada HRDPS cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_ec_hrdps_cronjob.sh ${SUFFIX} apply | |
| # - name: Environment Canada RDPS cronjob | |
| # shell: bash | |
| # run: | | |
| # oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| # PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_ec_rdps_cronjob.sh ${SUFFIX} apply | |
| - name: NOAA GFS cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_noaa_gfs_cronjob.sh ${SUFFIX} apply | |
| - name: NOAA NAM cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_noaa_nam_cronjob.sh ${SUFFIX} apply | |
| - name: VIIRS SNOW cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_viirs_snow_cronjob.sh ${SUFFIX} apply | |
| - name: GRASS CURING cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_grass_curing_cronjob.sh ${SUFFIX} apply | |
| - name: RDPS SFMS cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_rdps_sfms_cronjob.sh ${SUFFIX} apply | |
| - name: FIRMS MODIS cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_firms_footprint_cronjob.sh ${SUFFIX} apply | |
| - name: BCData Fire Perimeters cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_bc_wildfire_fire_perimeters_cronjob.sh ${SUFFIX} apply | |
| - name: Hourly pruner nightly cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_hourly_prune_cronjob.sh ${SUFFIX} apply | |
| # TODO: Delete once pmtiles has run for some time | |
| # deploy-tileserv: | |
| # name: Deploy tileserv to Dev | |
| # if: github.triggering_actor != 'renovate' | |
| # runs-on: ubuntu-22.04 | |
| # # We need | |
| # # - the image to be built before we can deploy. | |
| # needs: [build-tileserv-image] | |
| # steps: | |
| # - name: Set Variables | |
| # shell: bash | |
| # run: | | |
| # echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| # - name: Checkout | |
| # uses: actions/checkout@v3 | |
| # - name: Tileserv | |
| # shell: bash | |
| # run: | | |
| # oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| # PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_tileserv.sh ${SUFFIX} apply | |
| deploy-dev-queue: | |
| name: Deploy Message Queue to Dev | |
| if: github.triggering_actor != 'renovate' | |
| runs-on: ubuntu-22.04 | |
| # We need | |
| # - the image to be built before we can deploy. | |
| # - we need the tileserv database up so we can write to it | |
| needs: [build-api-image, configure-nats-server-name] | |
| steps: | |
| - name: Set Variables | |
| shell: bash | |
| run: | | |
| echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: NATS Message Queue | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_DEV="e1e498-dev" MEMORY_REQUEST=250Mi MEMORY_LIMIT=500Mi bash openshift/scripts/oc_provision_nats.sh ${SUFFIX} apply | |
| scan-dev: | |
| name: ZAP Baseline Scan Dev | |
| needs: [deploy-dev] | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| # f.y.i.: ZAP Scan must be able to log an issue or it will fail. | |
| - name: ZAP Scan | |
| uses: zaproxy/action-baseline@v0.12.0 | |
| with: | |
| target: "https://wps-pr-${{ github.event.number }}.apps.silver.devops.gov.bc.ca" | |
| rules_file_name: ".zap/rules.tsv" | |
| # Do not return failure on warnings - TODO: this has to be resolved! | |
| cmd_options: "-I" | |
| run-schemathesis: | |
| name: Schemathesis Fuzzing | |
| if: github.triggering_actor != 'renovate' | |
| runs-on: ubuntu-22.04 | |
| needs: [deploy-dev] | |
| steps: | |
| - name: Run Schemathesis | |
| continue-on-error: true | |
| uses: schemathesis/action@v1 | |
| with: | |
| # Your API schema location | |
| schema: "https://wps-pr-${{ github.event.number }}.apps.silver.devops.gov.bc.ca/api/openapi.json" | |
| args: "--experimental=openapi-3.1" | |
| # Set your token from secrets | |
| token: ${{ secrets.SCHEMATHESIS_TOKEN }} | |
| deploy-c-haines: | |
| name: Deploy c-haines cronjob | |
| if: github.triggering_actor != 'renovate' | |
| runs-on: ubuntu-22.04 | |
| # We need | |
| # - the image to be built before we can deploy. | |
| # - the database to be there (so we can write to it). | |
| # - wait for the api deployment, as it's responsible for upgrading the database. | |
| needs: [build-api-image, prepare-dev-database, deploy-dev] | |
| steps: | |
| - name: Set Variables | |
| shell: bash | |
| run: echo "SUFFIX=pr-${{ github.event.number }}" >> $GITHUB_ENV | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: C-Haines Cronjob | |
| shell: bash | |
| run: | | |
| oc login "${{ secrets.OPENSHIFT_CLUSTER }}" --token="${{ secrets.OC4_DEV_TOKEN }}" | |
| PROJ_TARGET="e1e498-dev" PROJ_TOOLS="e1e498-tools" PROJ_DEV="e1e498-dev" bash openshift/scripts/oc_provision_c_haines_cronjob.sh ${SUFFIX} apply |