cicd.yml

#
# Example GitHub Actions config that drives UW-IT AXD2 integration and deployment
#
# Preconditions:
#
#  1) Application docker build is based on django-container
#
#  2) Application test suite is kicked off in docker/test.sh
#
#  3) Application repo has access to the two secrets
#     at https://github.com/organizations/uw-it-aca/settings/secrets:
#
#     GH_AUTH_TOKEN: Grants access to private flux deployment repo
#     GCP_JSON_KEY: Grants access to Google Cloud Registry
#
# To adapt this config file to a specific django project:
#
#  1) Set RELEASE_NAME suitable for deployment to k8s. RELEASE_NAME must
#     match the "repo" value in docker/*-values.yml.
#
#  2) Set DJANGO_APP to the name of the django project name/directory.
#
#  3) Verify that the lists of branches for push/pull_request is appropriate,
#     and add other branch names if needed.  Additional branch names must
#     also have steps defined in the deploy job
#
#  4) Confirm that the build steps are suitable.  Likely they are, but
#     some projects have an intermediate build step that could benefit
#     from caching, so it may be useful to augment the build steps.
#
---
name: Build, Test and Deploy

env:
  # Release name must match "repo" value in docker/*-values.yml
  RELEASE_NAME: compass
  DJANGO_APP: compass

# Be sure that branches defined here have corresponding steps
# defined in the "deploy" job
on:
  push:
    branches: [main, master, qa, develop, feature/eval-me]
  pull_request:
    branches: [main, master, qa, develop, feature/eval-me]
    types: [opened, reopened, synchronize]

jobs:
  context:
    runs-on: ubuntu-22.04

    outputs:
      commit_hash: ${{ steps.context.outputs.commit_hash }}
      git_repo_branch: ${{ steps.context.outputs.git_repo_branch }}
      image_tag: ${{ steps.context.outputs.image_tag }}

    steps:
      - name: Set up Context
        id: context
        uses: uw-it-aca/actions/cicd-context@main
        with:
          release_name: ${{ env.RELEASE_NAME }}

  build:
    runs-on: ubuntu-22.04

    needs: context

    services:
      postgres:
        image: postgres:14
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_USER: postgres
        # Set health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.10'

      - name: Run Python Linters
        uses: uw-it-aca/actions/python-linters@main
        with:
          app_name: ${DJANGO_APP}
          exclude_paths: 'migrations'

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Cache Docker layers
        uses: actions/cache@v4
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-$(echo ${{ hashFiles('Dockerfile') }} | head -c 16)
          restore-keys: |
            ${{ runner.os }}-buildx-

      - name: Build App Image
        uses: docker/build-push-action@v6
        with:
          context: .
          target: app-container
          tags: ${{ needs.context.outputs.image_tag }}
          push: false
          load: true
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache

      - name: Build Test Image
        uses: docker/build-push-action@v6
        with:
          target: app-test-container
          tags: app-test-container
          push: false
          load: true

      - name: Run Tests in Image
        id: tests
        shell: bash
        run: >-
          docker run -u root -t --network ${{ job.container.network }}
          -v ${PWD}:/coverage
          -e DJANGO_APP="$DJANGO_APP"
          -e "ENV=localdev" -e "AUTH=SAML_MOCK"
          app-test-container
          bash -c ". ./docker/test.sh"

      - name: Record Test Results
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          python -m pip install --upgrade pip coverage coveralls==3.3.1
          coverage combine
          coveralls

      - name: Push Image to Repository
        if: github.event_name == 'push'
        uses: uw-it-aca/actions/gcr-push@main
        with:
          image_tag: ${{ needs.context.outputs.image_tag }}
          gcp_json_key: ${{ secrets.GCP_JSON_KEY }}

  deploy:
    if: github.event_name == 'push'

    needs: [context, build]

    outputs:
      context: ${{ steps.context.outputs.context }}

    runs-on: ubuntu-22.04

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4

      - name: Deployment Pipeline
        if: >-
          contains(fromJSON('["main", "master", "develop", "qa"]'),
            needs.context.outputs.git_repo_branch)
        uses: uw-it-aca/actions/cicd-deploy@main
        with:
          release_name: ${{ env.RELEASE_NAME }}
          commit_hash: ${{ needs.context.outputs.commit_hash }}
          git_repo_branch: ${{ needs.context.outputs.git_repo_branch }}
          gh_auth_token: ${{ secrets.GH_AUTH_TOKEN }}

      - name: Deploy Evaluation Branch
        if: needs.context.outputs.git_repo_branch == 'feature/eval-me'
        uses: uw-it-aca/actions/cicd-deploy@main
        with:
          release_name: ${{ env.RELEASE_NAME }}
          commit_hash: ${{ needs.context.outputs.commit_hash }}
          git_repo_branch: ${{ needs.context.outputs.git_repo_branch }}
          gh_auth_token: ${{ secrets.GH_AUTH_TOKEN }}
          app_instance: eval

      - name: 'Surface context from executed build step'
        id: context
        shell: bash
        run: echo "context=$(< ${CONTEXT_FILENAME})" >> $GITHUB_OUTPUT

  housekeeping:
    if: github.event_name == 'push'

    needs: [context, build, deploy]

    runs-on: ubuntu-22.04

    steps:
      - name: House Keeping
        uses: uw-it-aca/actions/cicd-housekeeping@main
        with:
          release_name: ${{ env.RELEASE_NAME }}
          gh_auth_token: ${{ secrets.GH_AUTH_TOKEN }}
          registry_password: ${{ secrets.GCP_JSON_KEY }}
          context: ${{ needs.deploy.outputs.context }}