feat(ci): migrate workflows to .github/workflows for better compatibility
This commit is contained in:
senke
parent
8fc08935ab
commit
a7fe2a5243
3 changed files with 557 additions and 0 deletions
79
.github/workflows/cleanup-failed.yml
vendored
Normal file
79
.github/workflows/cleanup-failed.yml
vendored
Normal file
|
|
@ -0,0 +1,79 @@
|
|||
# cleanup-failed.yml — workflow_dispatch only.
|
||||
#
|
||||
# Tears down the kept-alive failed-deploy color (the inactive one
|
||||
# that survived a Phase D / Phase F failure for forensics).
|
||||
# Operator triggers this once they have read the journalctl output.
|
||||
#
|
||||
# Hard safety in playbooks/cleanup_failed.yml: refuses to destroy
|
||||
# the currently-active color.
|
||||
name: Veza cleanup failed-deploy color
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
env:
|
||||
description: "Environment to clean up"
|
||||
required: true
|
||||
type: choice
|
||||
options: [staging, prod]
|
||||
color:
|
||||
description: "Color to destroy (must NOT be the active one)"
|
||||
required: true
|
||||
type: choice
|
||||
options: [blue, green]
|
||||
|
||||
concurrency:
|
||||
group: cleanup-${{ inputs.env }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
cleanup:
|
||||
name: Destroy ${{ inputs.color }} app containers in ${{ inputs.env }}
|
||||
runs-on: [self-hosted, incus]
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Install ansible
|
||||
run: |
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y ansible
|
||||
ansible-galaxy collection install community.general
|
||||
|
||||
- name: Write vault password
|
||||
env:
|
||||
VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
|
||||
run: |
|
||||
printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
|
||||
chmod 0400 "$RUNNER_TEMP/vault-pass"
|
||||
echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Run cleanup_failed.yml
|
||||
working-directory: infra/ansible
|
||||
env:
|
||||
ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-cleanup-${{ inputs.env }}-${{ inputs.color }}.log
|
||||
ANSIBLE_HOST_KEY_CHECKING: "False"
|
||||
run: |
|
||||
ansible-playbook \
|
||||
-i inventory/${{ inputs.env }}.yml \
|
||||
playbooks/cleanup_failed.yml \
|
||||
--vault-password-file "$VAULT_PASS_FILE" \
|
||||
-e veza_env=${{ inputs.env }} \
|
||||
-e target_color=${{ inputs.color }}
|
||||
|
||||
- name: Upload Ansible log
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: ansible-cleanup-${{ inputs.env }}-${{ inputs.color }}
|
||||
path: ${{ runner.temp }}/ansible-cleanup-*.log
|
||||
retention-days: 30
|
||||
|
||||
- name: Shred vault password file
|
||||
if: always()
|
||||
run: |
|
||||
if [ -f "$VAULT_PASS_FILE" ]; then
|
||||
shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
|
||||
fi
|
||||
360
.github/workflows/deploy.yml
vendored
Normal file
360
.github/workflows/deploy.yml
vendored
Normal file
|
|
@ -0,0 +1,360 @@
|
|||
# Veza deploy pipeline.
|
||||
#
|
||||
# Triggers (intentionally narrow — see SECURITY note below):
|
||||
# workflow_dispatch → operator-supplied env + sha
|
||||
# (push:main + tag:v* are commented OUT until provisioning is
|
||||
# complete — see docs/RUNBOOK_DEPLOY_BOOTSTRAP.md. Re-enable
|
||||
# once secrets/runner/vault are in place and a manual run via
|
||||
# workflow_dispatch has been verified GREEN.)
|
||||
#
|
||||
# SECURITY: this workflow runs on a self-hosted runner with access to
|
||||
# the Incus unix socket (effectively root on the host). DO NOT add
|
||||
# `pull_request` or any fork-influenced trigger here — an attacker-
|
||||
# controlled fork would be able to `incus exec` arbitrarily. The
|
||||
# narrow trigger list above is the security boundary.
|
||||
#
|
||||
# Sequence : build (3 jobs in parallel) → upload artifacts → deploy.
|
||||
name: Veza deploy
|
||||
|
||||
on:
|
||||
# push: # GATED — uncomment after first
|
||||
# branches: [main] # successful workflow_dispatch run
|
||||
# tags: ['v*'] # see RUNBOOK_DEPLOY_BOOTSTRAP.md
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
env:
|
||||
description: "Environment to deploy"
|
||||
required: true
|
||||
default: staging
|
||||
type: choice
|
||||
options: [staging, prod]
|
||||
release_sha:
|
||||
description: "Full git SHA to deploy (defaults to current HEAD if empty)"
|
||||
required: false
|
||||
type: string
|
||||
|
||||
concurrency:
|
||||
# Only one deploy per env at a time. Newer pushes cancel older
|
||||
# in-flight builds for the same env (the user almost always wants
|
||||
# the newer commit).
|
||||
group: deploy-${{ github.ref_type == 'tag' && 'prod' || 'staging' }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
# Where build artefacts land. Set in Forgejo repo Variables :
|
||||
# FORGEJO_REGISTRY_URL = https://forgejo.veza.fr/api/packages/talas/generic
|
||||
REGISTRY_URL: ${{ vars.FORGEJO_REGISTRY_URL }}
|
||||
|
||||
jobs:
|
||||
# =================================================================
|
||||
# Resolve env + sha from the trigger.
|
||||
# =================================================================
|
||||
resolve:
|
||||
name: Resolve env + SHA
|
||||
runs-on: [self-hosted, incus]
|
||||
outputs:
|
||||
env: ${{ steps.r.outputs.env }}
|
||||
sha: ${{ steps.r.outputs.sha }}
|
||||
steps:
|
||||
- name: Resolve
|
||||
id: r
|
||||
run: |
|
||||
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
||||
ENV="${{ inputs.env }}"
|
||||
SHA="${{ inputs.release_sha || github.sha }}"
|
||||
elif [ "${{ github.ref_type }}" = "tag" ]; then
|
||||
ENV="prod"
|
||||
SHA="${{ github.sha }}"
|
||||
else
|
||||
ENV="staging"
|
||||
SHA="${{ github.sha }}"
|
||||
fi
|
||||
if ! echo "$SHA" | grep -Eq '^[0-9a-f]{40}$'; then
|
||||
echo "SHA '$SHA' is not a 40-char git SHA"
|
||||
exit 1
|
||||
fi
|
||||
echo "env=$ENV" >> "$GITHUB_OUTPUT"
|
||||
echo "sha=$SHA" >> "$GITHUB_OUTPUT"
|
||||
echo "Resolved env=$ENV sha=$SHA"
|
||||
|
||||
# =================================================================
|
||||
# Build backend (Go).
|
||||
# =================================================================
|
||||
build-backend:
|
||||
name: Build backend
|
||||
needs: resolve
|
||||
runs-on: [self-hosted, incus]
|
||||
timeout-minutes: 20
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
ref: ${{ needs.resolve.outputs.sha }}
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: "1.25"
|
||||
cache: true
|
||||
cache-dependency-path: veza-backend-api/go.sum
|
||||
|
||||
- name: Test
|
||||
working-directory: veza-backend-api
|
||||
env:
|
||||
VEZA_SKIP_INTEGRATION: "1"
|
||||
run: go test ./... -short -count=1 -timeout 300s
|
||||
|
||||
- name: Build veza-api (CGO=0, static)
|
||||
working-directory: veza-backend-api
|
||||
env:
|
||||
CGO_ENABLED: "0"
|
||||
GOOS: linux
|
||||
GOARCH: amd64
|
||||
run: |
|
||||
go build -trimpath -ldflags "-s -w" \
|
||||
-o ./bin/veza-api ./cmd/api/main.go
|
||||
go build -trimpath -ldflags "-s -w" \
|
||||
-o ./bin/migrate_tool ./cmd/migrate_tool/main.go
|
||||
|
||||
- name: Stage tarball contents
|
||||
working-directory: veza-backend-api
|
||||
run: |
|
||||
STAGE="$RUNNER_TEMP/veza-backend"
|
||||
mkdir -p "$STAGE/migrations"
|
||||
cp ./bin/veza-api ./bin/migrate_tool "$STAGE/"
|
||||
cp -r ./migrations/* "$STAGE/migrations/" || true
|
||||
echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
|
||||
|
||||
- name: Pack tarball
|
||||
run: |
|
||||
cd "$RUNNER_TEMP"
|
||||
tar --use-compress-program=zstd -cf \
|
||||
"veza-backend-${{ needs.resolve.outputs.sha }}.tar.zst" \
|
||||
-C "$RUNNER_TEMP/veza-backend" .
|
||||
|
||||
- name: Push to Forgejo Package Registry
|
||||
env:
|
||||
TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
|
||||
run: |
|
||||
set -e
|
||||
TARBALL="veza-backend-${{ needs.resolve.outputs.sha }}.tar.zst"
|
||||
URL="${REGISTRY_URL}/veza-backend/${{ needs.resolve.outputs.sha }}/${TARBALL}"
|
||||
echo "PUT → $URL"
|
||||
curl -fsSL --fail-with-body -X PUT \
|
||||
-H "Authorization: token ${TOKEN}" \
|
||||
--upload-file "$RUNNER_TEMP/${TARBALL}" \
|
||||
"${URL}"
|
||||
|
||||
# =================================================================
|
||||
# Build stream (Rust).
|
||||
# =================================================================
|
||||
build-stream:
|
||||
name: Build stream
|
||||
needs: resolve
|
||||
runs-on: [self-hosted, incus]
|
||||
timeout-minutes: 30
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
ref: ${{ needs.resolve.outputs.sha }}
|
||||
|
||||
- name: Set up Rust toolchain
|
||||
run: |
|
||||
command -v rustup >/dev/null || \
|
||||
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
|
||||
source "$HOME/.cargo/env"
|
||||
rustup target add x86_64-unknown-linux-musl
|
||||
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
||||
sudo apt-get update -qq && sudo apt-get install -y musl-tools
|
||||
|
||||
- name: Cache cargo + target
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
veza-stream-server/target
|
||||
key: deploy-${{ runner.os }}-cargo-${{ hashFiles('veza-stream-server/Cargo.lock') }}
|
||||
restore-keys: |
|
||||
deploy-${{ runner.os }}-cargo-
|
||||
|
||||
- name: Test
|
||||
working-directory: veza-stream-server
|
||||
run: cargo test --workspace
|
||||
|
||||
- name: Build stream_server (musl static)
|
||||
working-directory: veza-stream-server
|
||||
run: |
|
||||
cargo build --release --locked \
|
||||
--target x86_64-unknown-linux-musl
|
||||
|
||||
- name: Stage tarball contents
|
||||
working-directory: veza-stream-server
|
||||
run: |
|
||||
STAGE="$RUNNER_TEMP/veza-stream"
|
||||
mkdir -p "$STAGE"
|
||||
cp ./target/x86_64-unknown-linux-musl/release/stream_server "$STAGE/"
|
||||
echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
|
||||
|
||||
- name: Pack tarball
|
||||
run: |
|
||||
cd "$RUNNER_TEMP"
|
||||
tar --use-compress-program=zstd -cf \
|
||||
"veza-stream-${{ needs.resolve.outputs.sha }}.tar.zst" \
|
||||
-C "$RUNNER_TEMP/veza-stream" .
|
||||
|
||||
- name: Push to Forgejo Package Registry
|
||||
env:
|
||||
TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
|
||||
run: |
|
||||
set -e
|
||||
TARBALL="veza-stream-${{ needs.resolve.outputs.sha }}.tar.zst"
|
||||
URL="${REGISTRY_URL}/veza-stream/${{ needs.resolve.outputs.sha }}/${TARBALL}"
|
||||
echo "PUT → $URL"
|
||||
curl -fsSL --fail-with-body -X PUT \
|
||||
-H "Authorization: token ${TOKEN}" \
|
||||
--upload-file "$RUNNER_TEMP/${TARBALL}" \
|
||||
"${URL}"
|
||||
|
||||
# =================================================================
|
||||
# Build web (React/Vite).
|
||||
# =================================================================
|
||||
build-web:
|
||||
name: Build web
|
||||
needs: resolve
|
||||
runs-on: [self-hosted, incus]
|
||||
timeout-minutes: 20
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
ref: ${{ needs.resolve.outputs.sha }}
|
||||
|
||||
- name: Use Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: "20"
|
||||
cache: "npm"
|
||||
cache-dependency-path: package-lock.json
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Build design tokens
|
||||
run: npm run build:tokens --workspace=@veza/design-system
|
||||
|
||||
- name: Build SPA
|
||||
working-directory: apps/web
|
||||
env:
|
||||
VITE_API_URL: /api/v1
|
||||
VITE_DOMAIN: ${{ needs.resolve.outputs.env == 'prod' && 'veza.fr' || 'staging.veza.fr' }}
|
||||
VITE_RELEASE_SHA: ${{ needs.resolve.outputs.sha }}
|
||||
run: npm run build
|
||||
|
||||
- name: Stage tarball contents
|
||||
run: |
|
||||
STAGE="$RUNNER_TEMP/veza-web"
|
||||
mkdir -p "$STAGE"
|
||||
cp -r apps/web/dist/* "$STAGE/"
|
||||
echo "${{ needs.resolve.outputs.sha }}" > "$STAGE/VERSION"
|
||||
|
||||
- name: Pack tarball
|
||||
run: |
|
||||
cd "$RUNNER_TEMP"
|
||||
tar --use-compress-program=zstd -cf \
|
||||
"veza-web-${{ needs.resolve.outputs.sha }}.tar.zst" \
|
||||
-C "$RUNNER_TEMP/veza-web" .
|
||||
|
||||
- name: Push to Forgejo Package Registry
|
||||
env:
|
||||
TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
|
||||
run: |
|
||||
set -e
|
||||
TARBALL="veza-web-${{ needs.resolve.outputs.sha }}.tar.zst"
|
||||
URL="${REGISTRY_URL}/veza-web/${{ needs.resolve.outputs.sha }}/${TARBALL}"
|
||||
echo "PUT → $URL"
|
||||
curl -fsSL --fail-with-body -X PUT \
|
||||
-H "Authorization: token ${TOKEN}" \
|
||||
--upload-file "$RUNNER_TEMP/${TARBALL}" \
|
||||
"${URL}"
|
||||
|
||||
# =================================================================
|
||||
# Deploy via Ansible. Runs on the self-hosted runner that has
|
||||
# Incus socket access (label `incus`). Requires Forgejo secrets:
|
||||
# ANSIBLE_VAULT_PASSWORD — unlocks group_vars/all/vault.yml
|
||||
# FORGEJO_REGISTRY_TOKEN — same token the build jobs use,
|
||||
# passed to ansible-playbook so
|
||||
# the data containers can fetch
|
||||
# the tarballs they were just sent.
|
||||
# =================================================================
|
||||
deploy:
|
||||
name: Deploy via Ansible
|
||||
needs: [resolve, build-backend, build-stream, build-web]
|
||||
runs-on: [self-hosted, incus]
|
||||
timeout-minutes: 30
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
ref: ${{ needs.resolve.outputs.sha }}
|
||||
|
||||
- name: Install ansible + community.general + community.postgresql + community.rabbitmq
|
||||
run: |
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y ansible python3-psycopg2 python3-pip
|
||||
ansible-galaxy collection install \
|
||||
community.general \
|
||||
community.postgresql \
|
||||
community.rabbitmq
|
||||
|
||||
- name: Write vault password to a tmpfile
|
||||
env:
|
||||
VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
|
||||
run: |
|
||||
printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
|
||||
chmod 0400 "$RUNNER_TEMP/vault-pass"
|
||||
echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Run deploy_data.yml (idempotent provisioning + ZFS snapshot)
|
||||
working-directory: infra/ansible
|
||||
env:
|
||||
ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-data-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}.log
|
||||
ANSIBLE_HOST_KEY_CHECKING: "False"
|
||||
run: |
|
||||
ansible-playbook \
|
||||
-i inventory/${{ needs.resolve.outputs.env }}.yml \
|
||||
playbooks/deploy_data.yml \
|
||||
--vault-password-file "$VAULT_PASS_FILE" \
|
||||
-e veza_env=${{ needs.resolve.outputs.env }} \
|
||||
-e veza_release_sha=${{ needs.resolve.outputs.sha }} \
|
||||
-e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}
|
||||
|
||||
- name: Run deploy_app.yml (blue/green)
|
||||
working-directory: infra/ansible
|
||||
env:
|
||||
ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-app-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}.log
|
||||
ANSIBLE_HOST_KEY_CHECKING: "False"
|
||||
run: |
|
||||
ansible-playbook \
|
||||
-i inventory/${{ needs.resolve.outputs.env }}.yml \
|
||||
playbooks/deploy_app.yml \
|
||||
--vault-password-file "$VAULT_PASS_FILE" \
|
||||
-e veza_env=${{ needs.resolve.outputs.env }} \
|
||||
-e veza_release_sha=${{ needs.resolve.outputs.sha }} \
|
||||
-e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}
|
||||
|
||||
- name: Upload Ansible logs (for forensics)
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: ansible-logs-${{ needs.resolve.outputs.env }}-${{ needs.resolve.outputs.sha }}
|
||||
path: ${{ runner.temp }}/ansible-*.log
|
||||
retention-days: 30
|
||||
|
||||
- name: Shred vault password file
|
||||
if: always()
|
||||
run: |
|
||||
if [ -f "$VAULT_PASS_FILE" ]; then
|
||||
shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
|
||||
fi
|
||||
118
.github/workflows/rollback.yml
vendored
Normal file
118
.github/workflows/rollback.yml
vendored
Normal file
|
|
@ -0,0 +1,118 @@
|
|||
# rollback.yml — workflow_dispatch only.
|
||||
#
|
||||
# Two modes :
|
||||
# fast — flip HAProxy back to the previous color. ~5s. Requires
|
||||
# the target color's containers to still be alive
|
||||
# (i.e., no later deploy has recycled them).
|
||||
# full — re-run deploy_app.yml with a specific (older) release_sha.
|
||||
# ~5-10min. The artefact must still be in the Forgejo
|
||||
# registry (default retention 30 SHA per component).
|
||||
#
|
||||
# See docs/RUNBOOK_ROLLBACK.md for decision criteria.
|
||||
name: Veza rollback
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
env:
|
||||
description: "Environment to rollback"
|
||||
required: true
|
||||
type: choice
|
||||
options: [staging, prod]
|
||||
mode:
|
||||
description: "Rollback mode"
|
||||
required: true
|
||||
type: choice
|
||||
options: [fast, full]
|
||||
target_color:
|
||||
description: "(mode=fast only) color to flip back TO (the prior active one)"
|
||||
required: false
|
||||
type: choice
|
||||
options: [blue, green]
|
||||
release_sha:
|
||||
description: "(mode=full only) 40-char SHA of the release to redeploy"
|
||||
required: false
|
||||
type: string
|
||||
|
||||
concurrency:
|
||||
group: rollback-${{ inputs.env }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
rollback:
|
||||
name: Rollback ${{ inputs.env }} (${{ inputs.mode }})
|
||||
runs-on: [self-hosted, incus]
|
||||
timeout-minutes: 30
|
||||
steps:
|
||||
- name: Validate inputs
|
||||
run: |
|
||||
if [ "${{ inputs.mode }}" = "fast" ] && [ -z "${{ inputs.target_color }}" ]; then
|
||||
echo "mode=fast requires target_color"
|
||||
exit 1
|
||||
fi
|
||||
if [ "${{ inputs.mode }}" = "full" ]; then
|
||||
if [ -z "${{ inputs.release_sha }}" ]; then
|
||||
echo "mode=full requires release_sha"
|
||||
exit 1
|
||||
fi
|
||||
if ! echo "${{ inputs.release_sha }}" | grep -Eq '^[0-9a-f]{40}$'; then
|
||||
echo "release_sha is not a 40-char git SHA"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
ref: ${{ inputs.mode == 'full' && inputs.release_sha || github.ref }}
|
||||
|
||||
- name: Install ansible + collections
|
||||
run: |
|
||||
sudo apt-get update -qq
|
||||
sudo apt-get install -y ansible python3-psycopg2
|
||||
ansible-galaxy collection install \
|
||||
community.general \
|
||||
community.postgresql \
|
||||
community.rabbitmq
|
||||
|
||||
- name: Write vault password
|
||||
env:
|
||||
VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
|
||||
run: |
|
||||
printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
|
||||
chmod 0400 "$RUNNER_TEMP/vault-pass"
|
||||
echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Run rollback.yml
|
||||
working-directory: infra/ansible
|
||||
env:
|
||||
ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-rollback-${{ inputs.env }}-${{ inputs.mode }}.log
|
||||
ANSIBLE_HOST_KEY_CHECKING: "False"
|
||||
run: |
|
||||
EXTRA="-e veza_env=${{ inputs.env }} -e mode=${{ inputs.mode }}"
|
||||
if [ "${{ inputs.mode }}" = "fast" ]; then
|
||||
EXTRA="$EXTRA -e target_color=${{ inputs.target_color }}"
|
||||
else
|
||||
EXTRA="$EXTRA -e veza_release_sha=${{ inputs.release_sha }}"
|
||||
EXTRA="$EXTRA -e vault_forgejo_registry_token=${{ secrets.FORGEJO_REGISTRY_TOKEN }}"
|
||||
fi
|
||||
ansible-playbook \
|
||||
-i inventory/${{ inputs.env }}.yml \
|
||||
playbooks/rollback.yml \
|
||||
--vault-password-file "$VAULT_PASS_FILE" \
|
||||
$EXTRA
|
||||
|
||||
- name: Upload Ansible log
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: ansible-rollback-${{ inputs.env }}-${{ inputs.mode }}
|
||||
path: ${{ runner.temp }}/ansible-rollback-*.log
|
||||
retention-days: 30
|
||||
|
||||
- name: Shred vault password file
|
||||
if: always()
|
||||
run: |
|
||||
if [ -f "$VAULT_PASS_FILE" ]; then
|
||||
shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
|
||||
fi
|
||||
Loading…
Reference in a new issue