Migration to use uv + ruff #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Container | |
| on: | |
| push: | |
| branches: | |
| - 'develop' | |
| tags: | |
| - 'v*' | |
| pull_request: | |
| branches: | |
| - 'develop' | |
| # Allows you to run this workflow manually from the Actions tab | |
| workflow_dispatch: | |
| env: | |
| ENV: build | |
| DJANGO_SETTINGS_MODULE: lti_emailer.settings.local | |
| AWS_REGION: 'us-east-1' | |
| AWS_ROLE: arn:aws:iam::482956169056:role/uw-lti-emailer-github-actions-role | |
| REPOSITORY: 'uw/lti-emailer' | |
| ECR_HOST: '482956169056.dkr.ecr.us-east-1.amazonaws.com' | |
| ECS_CLUSTER: 'default' | |
| ECS_SERVICE: 'uw-lti-emailer-service-dev-1-4-0' | |
| ECS_TASK_DEFINITION: 'uw-lti-emailer-task-dev' | |
| CONTAINER_NAME: 'uw-lti-emailer-container-dev' | |
| UV_INDEX_PRIVATE_REGISTRY_USERNAME: aws | |
| jobs: | |
| quality-checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| # TODO: remember to enable this | |
| # - name: Lint with ruff | |
| # uses: astral-sh/ruff-action@v3 | |
| # TODO: remember to enable this | |
| # - name: Check formatting with ruff | |
| # run: ruff format --check | |
| # could run tests here, but we don't have any tests yet | |
| build-and-push-image: | |
| runs-on: ubuntu-latest | |
| needs: quality-checks | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write # This is required for requesting the JWT | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ env.AWS_ROLE }} | |
| role-session-name: GitHub_to_AWS_via_FederatedOIDC | |
| aws-region: ${{ env.AWS_REGION }} | |
| mask-aws-account-id: 'no' | |
| - name: Get CodeArtifact authorization token | |
| id: codeartifact-auth | |
| run: | | |
| echo "UV_INDEX_PRIVATE_REGISTRY_PASSWORD=$(aws codeartifact get-authorization-token --domain huit-academic-technology --query authorizationToken --output text)" >> $GITHUB_ENV | |
| echo "index pwd: ${UV_INDEX_PRIVATE_REGISTRY_PASSWORD}" | |
| - name: Login to Amazon ECR | |
| id: login-ecr | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| mask-password: 'true' | |
| # SSH agent will no longer be required once we switch to | |
| # using CodeArtifact for all private package dependencies | |
| - name: Setup ssh agent | |
| uses: webfactory/ssh-agent@v0.9.1 | |
| with: | |
| ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }} | |
| - name: Configure docker image metadata | |
| id: docker_meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ steps.login-ecr.outputs.registry }}/${{ env.REPOSITORY }} | |
| flavor: | | |
| latest=false | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=sha,format=long,prefix=sha-,suffix=${{ startsWith(github.ref, 'refs/tags/v') && format('-{0}', github.ref_name) || '' }} | |
| type=sha,format=short,prefix=sha-,suffix=${{ startsWith(github.ref, 'refs/tags/v') && format('-{0}', github.ref_name) || '' }} | |
| type=ref,event=branch | |
| type=ref,event=tag | |
| type=raw,value=${{ github.event.after }} | |
| - name: Generate build_info.py | |
| run: | | |
| # Get the short version of the SHA (Note: this commit SHA is the last commit in the push event that triggered the workflow). | |
| SHORT_SHA=$(echo ${{ github.event.after }} | cut -c1-7) | |
| echo "BUILD_INFO = {" > build_info.py | |
| echo " 'resolved_source_version': '${{ github.sha }}'," >> build_info.py | |
| echo " 'source_version': '${{ github.ref_name }}'," >> build_info.py | |
| echo " 'build_timestamp': '$(date "+%Y-%m-%dT%H:%M:%S%z")'," >> build_info.py | |
| echo " 'image_tag': '${{ github.ref_name }}'," >> build_info.py | |
| echo " 'image_hash_tag': '$SHORT_SHA'," >> build_info.py | |
| echo "}" >> build_info.py | |
| - name: Build and push | |
| id: build_and_push | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| ssh: default=${{ env.SSH_AUTH_SOCK }} | |
| secrets: UV_INDEX_PRIVATE_REGISTRY_PASSWORD=${{ env.UV_INDEX_PRIVATE_REGISTRY_PASSWORD }} | |
| push: true | |
| tags: ${{ steps.docker_meta.outputs.tags }} | |
| labels: ${{ steps.docker_meta.outputs.labels }} | |
| build-args: | | |
| BUILD_VERSION=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| BUILD_REVISION=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.revision'] }} | |
| - name: Download task definition | |
| run: | | |
| aws ecs describe-task-definition --task-definition ${{ env.ECS_TASK_DEFINITION }} --query taskDefinition > task-definition.json | |
| - name: Fill in the new image ID in the Amazon ECS task definition | |
| id: task-def | |
| uses: aws-actions/amazon-ecs-render-task-definition@v1 | |
| with: | |
| task-definition: task-definition.json | |
| container-name: ${{ env.CONTAINER_NAME }} | |
| image: ${{ env.ECR_HOST }}/${{ env.REPOSITORY }}:${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| environment-variables: | | |
| BUILD_VERSION=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| BUILD_REVISION=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.revision'] }} | |
| BUILD_TIMESTAMP=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.created'] }} | |
| BUILD_REF=${{ github.ref }} | |
| BUILD_REF_NAME=${{ github.ref_name }} | |
| BUILD_REF_TYPE=${{ github.ref_type }} | |
| - name: Deploy Amazon ECS task definition | |
| uses: aws-actions/amazon-ecs-deploy-task-definition@v2 | |
| with: | |
| task-definition: ${{ steps.task-def.outputs.task-definition }} | |
| service: ${{ env.ECS_SERVICE }} | |
| cluster: ${{ env.ECS_CLUSTER }} | |
| wait-for-service-stability: false |