Merge pull request #232 from Harvard-University-iCommons/task/haydn90… #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Container | |
| on: | |
| push: | |
| branches: | |
| - 'develop' | |
| tags: | |
| - 'v*' | |
| pull_request: | |
| branches: | |
| - 'develop' | |
| # Allows you to run this workflow manually from the Actions tab | |
| workflow_dispatch: | |
| env: | |
| ENV: build | |
| DJANGO_SETTINGS_MODULE: lti_emailer.settings.local | |
| AWS_REGION: 'us-east-1' | |
| AWS_ROLE: arn:aws:iam::482956169056:role/uw-lti-emailer-github-actions-role | |
| REPOSITORY: 'uw/lti-emailer' | |
| ECR_HOST: '482956169056.dkr.ecr.us-east-1.amazonaws.com' | |
| ECS_CLUSTER: 'default' | |
| ECS_SERVICE: 'uw-lti-emailer-service-dev-1-4-0' | |
| ECS_TASK_DEFINITION: 'uw-lti-emailer-task-dev' | |
| CONTAINER_NAME: 'uw-lti-emailer-container-dev' | |
| UV_INDEX_PRIVATE_REGISTRY_USERNAME: aws | |
| jobs: | |
| quality-checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Lint with ruff | |
| uses: astral-sh/ruff-action@v3 | |
| - name: Check formatting with ruff | |
| run: ruff format --check | |
| # could run tests here, but we don't have any tests yet | |
| build-and-push-image: | |
| runs-on: ubuntu-latest | |
| needs: quality-checks | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write # This is required for requesting the JWT | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| role-to-assume: ${{ env.AWS_ROLE }} | |
| role-session-name: GitHub_to_AWS_via_FederatedOIDC | |
| aws-region: ${{ env.AWS_REGION }} | |
| mask-aws-account-id: 'no' | |
| - name: Get CodeArtifact authorization token | |
| id: codeartifact-auth | |
| run: | | |
| CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token \ | |
| --domain huit-academic-technology \ | |
| --domain-owner 482956169056 \ | |
| --query authorizationToken \ | |
| --output text) | |
| echo "UV_INDEX_PRIVATE_REGISTRY_USERNAME=aws" >> $GITHUB_ENV | |
| echo "UV_INDEX_PRIVATE_REGISTRY_PASSWORD=$CODEARTIFACT_AUTH_TOKEN" >> $GITHUB_ENV | |
| - name: Login to Amazon ECR | |
| id: login-ecr | |
| uses: aws-actions/amazon-ecr-login@v2 | |
| with: | |
| mask-password: 'true' | |
| - name: Configure docker image metadata | |
| id: docker_meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ steps.login-ecr.outputs.registry }}/${{ env.REPOSITORY }} | |
| flavor: | | |
| latest=false | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=sha,format=long,prefix=sha-,suffix=${{ startsWith(github.ref, 'refs/tags/v') && format('-{0}', github.ref_name) || '' }} | |
| type=sha,format=short,prefix=sha-,suffix=${{ startsWith(github.ref, 'refs/tags/v') && format('-{0}', github.ref_name) || '' }} | |
| type=ref,event=branch | |
| type=ref,event=tag | |
| type=raw,value=${{ github.event.after }} | |
| - name: Generate build_info.py | |
| run: | | |
| # Get the short version of the SHA (Note: this commit SHA is the last commit in the push event that triggered the workflow). | |
| SHORT_SHA=$(echo ${{ github.event.after }} | cut -c1-7) | |
| echo "BUILD_INFO = {" > build_info.py | |
| echo " 'resolved_source_version': '${{ github.sha }}'," >> build_info.py | |
| echo " 'source_version': '${{ github.ref_name }}'," >> build_info.py | |
| echo " 'build_timestamp': '$(date "+%Y-%m-%dT%H:%M:%S%z")'," >> build_info.py | |
| echo " 'image_tag': '${{ github.ref_name }}'," >> build_info.py | |
| echo " 'image_hash_tag': '$SHORT_SHA'," >> build_info.py | |
| echo "}" >> build_info.py | |
| - name: Build and push | |
| id: build_and_push | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| secrets: UV_INDEX_PRIVATE_REGISTRY_PASSWORD=${{ env.UV_INDEX_PRIVATE_REGISTRY_PASSWORD }} | |
| push: true | |
| tags: ${{ steps.docker_meta.outputs.tags }} | |
| labels: ${{ steps.docker_meta.outputs.labels }} | |
| build-args: | | |
| BUILD_VERSION=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| BUILD_REVISION=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.revision'] }} | |
| - name: Download task definition | |
| run: | | |
| aws ecs describe-task-definition --task-definition ${{ env.ECS_TASK_DEFINITION }} --query taskDefinition > task-definition.json | |
| - name: Fill in the new image ID in the Amazon ECS task definition | |
| id: task-def | |
| uses: aws-actions/amazon-ecs-render-task-definition@v1 | |
| with: | |
| task-definition: task-definition.json | |
| container-name: ${{ env.CONTAINER_NAME }} | |
| image: ${{ env.ECR_HOST }}/${{ env.REPOSITORY }}:${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| environment-variables: | | |
| BUILD_VERSION=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.version'] }} | |
| BUILD_REVISION=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.revision'] }} | |
| BUILD_TIMESTAMP=${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.created'] }} | |
| BUILD_REF=${{ github.ref }} | |
| BUILD_REF_NAME=${{ github.ref_name }} | |
| BUILD_REF_TYPE=${{ github.ref_type }} | |
| - name: Deploy Amazon ECS task definition | |
| uses: aws-actions/amazon-ecs-deploy-task-definition@v2 | |
| with: | |
| task-definition: ${{ steps.task-def.outputs.task-definition }} | |
| service: ${{ env.ECS_SERVICE }} | |
| cluster: ${{ env.ECS_CLUSTER }} | |
| wait-for-service-stability: false |