DEVOPS-1683 REFACTOR: branch-or-tag description
This commit is contained in:
Alex Urbina
parent
67e9d66b66
commit
a326a32bf3
|
|
@ -0,0 +1,256 @@
|
||||||
|
---
|
||||||
|
name: Deploy Web Vault
|
||||||
|
run-name: Deploy Web Vault to ${{ inputs.environment }}
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
inputs:
|
||||||
|
environment:
|
||||||
|
description: 'Environment'
|
||||||
|
default: 'QA'
|
||||||
|
type: choice
|
||||||
|
options:
|
||||||
|
- USQA
|
||||||
|
- EUQA
|
||||||
|
- USPROD
|
||||||
|
- EUPROD
|
||||||
|
branch-or-tag:
|
||||||
|
description: "Branch or Tag name to deploy (examples: 'main', 'feature/sm', 'web-v2023.12.0')"
|
||||||
|
type: string
|
||||||
|
default: main
|
||||||
|
|
||||||
|
workflow_call:
|
||||||
|
inputs:
|
||||||
|
environment:
|
||||||
|
description: 'Environment'
|
||||||
|
default: 'USQA'
|
||||||
|
type: string
|
||||||
|
branch-or-tag:
|
||||||
|
description: "Branch or Tag name to deploy (examples: 'main', 'feature/sm', 'web-v2023.12.0')"
|
||||||
|
type: string
|
||||||
|
default: main
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
deployments: write
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
setup:
|
||||||
|
name: Setup
|
||||||
|
runs-on: ubuntu-20.04
|
||||||
|
outputs:
|
||||||
|
environment: ${{ steps.config.outputs.environment }}
|
||||||
|
environment-url: ${{ steps.config.outputs.environment-url }}
|
||||||
|
environment-name: ${{ steps.config.outputs.environment-name }}
|
||||||
|
environment-artifact: ${{ steps.config.outputs.environment-artifact }}
|
||||||
|
azure-login-creds: ${{ steps.config.outputs.azure-login-creds }}
|
||||||
|
retrieve-secrets-keyvault: ${{ steps.config.outputs.retrieve-secrets-keyvault }}
|
||||||
|
steps:
|
||||||
|
- name: Configure
|
||||||
|
id: config
|
||||||
|
run: |
|
||||||
|
ENV_NAME_LOWER=$(echo "${{ inputs.environment }}" | awk '{print tolower($0)}')
|
||||||
|
echo "configuring the Web deploy for ${{ inputs.environment }}"
|
||||||
|
echo "environment=${{ inputs.environment }}" >> $GITHUB_OUTPUT
|
||||||
|
case ${{ inputs.environment }} in
|
||||||
|
"USQA")
|
||||||
|
echo "azure-login-creds=AZURE_KV_US_QA_SERVICE_PRINCIPAL" >> $GITHUB_OUTPUT
|
||||||
|
echo "retrieve-secrets-keyvault=bw-webvault-rlktusqa-kv" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-artifact=web-*-cloud-QA.zip" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-name=Web Vault - US QA Cloud" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-url=http://vault.$ENV_NAME_LOWER.bitwarden.pw" >> $GITHUB_OUTPUT
|
||||||
|
;;
|
||||||
|
"EUQA")
|
||||||
|
echo "azure-login-creds=AZURE_KV_EU_QA_SERVICE_PRINCIPAL" >> $GITHUB_OUTPUT
|
||||||
|
echo "retrieve-secrets-keyvault=webvaulteu-westeurope-qa" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-artifact=web-*-cloud-euqa.zip" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-name=Web Vault - EU QA Cloud" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-url=http://vault.$ENV_NAME_LOWER.bitwarden.pw" >> $GITHUB_OUTPUT
|
||||||
|
;;
|
||||||
|
"USPROD")
|
||||||
|
echo "azure-login-creds=AZURE_KV_US_PROD_SERVICE_PRINCIPAL" >> $GITHUB_OUTPUT
|
||||||
|
echo "retrieve-secrets-keyvault=bw-webvault-klrt-kv" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-artifact=web-*-cloud-COMMERCIAL.zip" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-name=Web Vault - US Production Cloud" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-url=http://vault.bitwarden.com" >> $GITHUB_OUTPUT
|
||||||
|
;;
|
||||||
|
"EUPROD")
|
||||||
|
echo "azure-login-creds=AZURE_KV_EU_PRD_SERVICE_PRINCIPAL" >> $GITHUB_OUTPUT
|
||||||
|
echo "retrieve-secrets-keyvault=webvault-westeurope-prod" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-artifact=web-*-cloud-euprd.zip" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-name=Web Vault - EU Production Cloud" >> $GITHUB_OUTPUT
|
||||||
|
echo "environment-url=http://vault.bitwarden.eu" >> $GITHUB_OUTPUT
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
approval:
|
||||||
|
name: Approval for Deployment to ${{ needs.setup.outputs.environment-name }}
|
||||||
|
needs: setup
|
||||||
|
runs-on: ubuntu-22.04
|
||||||
|
environment: ${{ needs.setup.outputs.environment-name }}
|
||||||
|
steps:
|
||||||
|
- name: Success Code
|
||||||
|
run: exit 0
|
||||||
|
|
||||||
|
notify-start:
|
||||||
|
name: Notify Slack with start message
|
||||||
|
needs:
|
||||||
|
- approval
|
||||||
|
- setup
|
||||||
|
runs-on: ubuntu-22.04
|
||||||
|
if: always()
|
||||||
|
steps:
|
||||||
|
- uses: bitwarden/gh-actions/report-deployment-status-to-slack@main
|
||||||
|
with:
|
||||||
|
project: Clients
|
||||||
|
environment: ${{ needs.setup.outputs.environment-name }}
|
||||||
|
tag: ${{ inputs.branch-or-tag }}
|
||||||
|
slack-channel: team-eng-qa-devops
|
||||||
|
event: 'start'
|
||||||
|
url: https://github.com/bitwarden/clients/actions/runs/${{ github.run_id }}
|
||||||
|
AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
|
||||||
|
|
||||||
|
artifact-check:
|
||||||
|
name: Check if Web artifact is present
|
||||||
|
runs-on: ubuntu-22.04
|
||||||
|
needs: setup
|
||||||
|
env:
|
||||||
|
_ENVIRONMENT_ARTIFACT: ${{ needs.setup.outputs.environment-artifact }}
|
||||||
|
steps:
|
||||||
|
- name: 'Download latest cloud asset from branch/tag: ${{ inputs.branch-or-tag }}'
|
||||||
|
uses: bitwarden/gh-actions/download-artifacts@main
|
||||||
|
id: download-artifacts
|
||||||
|
continue-on-error: true
|
||||||
|
with:
|
||||||
|
workflow: build-web.yml
|
||||||
|
path: apps/web
|
||||||
|
workflow_conclusion: success
|
||||||
|
branch: ${{ inputs.branch-or-tag }}
|
||||||
|
artifacts: ${{ env._ENVIRONMENT_ARTIFACT }}
|
||||||
|
|
||||||
|
- name: Login to Azure
|
||||||
|
if: ${{ steps.download-artifacts.outcome == 'failure' }}
|
||||||
|
uses: Azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2 # v1.4.7
|
||||||
|
with:
|
||||||
|
creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
|
||||||
|
|
||||||
|
- name: Retrieve secrets for Build trigger
|
||||||
|
if: ${{ steps.download-artifacts.outcome == 'failure' }}
|
||||||
|
id: retrieve-secret
|
||||||
|
uses: bitwarden/gh-actions/get-keyvault-secrets@main
|
||||||
|
with:
|
||||||
|
keyvault: "bitwarden-ci"
|
||||||
|
secrets: "github-pat-bitwarden-devops-bot-repo-scope"
|
||||||
|
|
||||||
|
- name: 'Trigger build web for missing branch/tag ${{ inputs.branch-or-tag }}'
|
||||||
|
if: ${{ steps.download-artifacts.outcome == 'failure' }}
|
||||||
|
uses: convictional/trigger-workflow-and-wait@f69fa9eedd3c62a599220f4d5745230e237904be # v1.6.5
|
||||||
|
with:
|
||||||
|
owner: bitwarden
|
||||||
|
repo: clients
|
||||||
|
github_token: ${{ steps.retrieve-secret.outputs.github-pat-bitwarden-devops-bot-repo-scope }}
|
||||||
|
workflow_file_name: build-web.yml
|
||||||
|
ref: ${{ inputs.branch-or-tag }}
|
||||||
|
wait_interval: 100
|
||||||
|
|
||||||
|
azure-deploy:
|
||||||
|
name: Deploy Web Vault to ${{ inputs.environment }} Storage Account
|
||||||
|
needs:
|
||||||
|
- setup
|
||||||
|
- artifact-check
|
||||||
|
- approval
|
||||||
|
- notify-start
|
||||||
|
runs-on: ubuntu-22.04
|
||||||
|
env:
|
||||||
|
_ENVIRONMENT: ${{ needs.setup.outputs.environment }}
|
||||||
|
_ENVIRONMENT_URL: ${{ needs.setup.outputs.environment-url }}
|
||||||
|
_ENVIRONMENT_NAME: ${{ needs.setup.outputs.environment-name }}
|
||||||
|
_ENVIRONMENT_ARTIFACT: ${{ needs.setup.outputs.environment-artifact }}
|
||||||
|
steps:
|
||||||
|
- name: Create GitHub deployment
|
||||||
|
uses: chrnorm/deployment-action@d42cde7132fcec920de534fffc3be83794335c00 # v2.0.5
|
||||||
|
id: deployment
|
||||||
|
with:
|
||||||
|
token: '${{ secrets.GITHUB_TOKEN }}'
|
||||||
|
initial-status: 'in_progress'
|
||||||
|
environment-url: ${{ env._ENVIRONMENT_URL }}
|
||||||
|
environment: ${{ env._ENVIRONMENT_NAME }}
|
||||||
|
task: 'deploy'
|
||||||
|
description: 'Deployment from branch/tag: ${{ inputs.branch-or-tag }}'
|
||||||
|
|
||||||
|
- name: Login to Azure
|
||||||
|
uses: Azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2 # v1.4.7
|
||||||
|
with:
|
||||||
|
creds: ${{ secrets[needs.setup.outputs.azure-login-creds] }}
|
||||||
|
|
||||||
|
- name: Retrieve Storage Account connection string
|
||||||
|
id: retrieve-secrets
|
||||||
|
uses: bitwarden/gh-actions/get-keyvault-secrets@main
|
||||||
|
with:
|
||||||
|
keyvault: ${{ needs.setup.outputs.retrieve-secrets-keyvault }}
|
||||||
|
secrets: "sa-bitwarden-web-vault-dev-key-temp"
|
||||||
|
|
||||||
|
- name: 'Download cloud asset from branch/tag: ${{ inputs.branch-or-tag }}'
|
||||||
|
uses: bitwarden/gh-actions/download-artifacts@main
|
||||||
|
with:
|
||||||
|
workflow: build-web.yml
|
||||||
|
path: apps/web
|
||||||
|
workflow_conclusion: success
|
||||||
|
branch: ${{ inputs.branch-or-tag }}
|
||||||
|
artifacts: ${{ env._ENVIRONMENT_ARTIFACT }}
|
||||||
|
|
||||||
|
- name: Unzip build asset
|
||||||
|
working-directory: apps/web
|
||||||
|
run: unzip ${{ env._ENVIRONMENT_ARTIFACT }}
|
||||||
|
|
||||||
|
- name: Empty container in Storage Account
|
||||||
|
run: |
|
||||||
|
az storage blob delete-batch \
|
||||||
|
--source '$web' \
|
||||||
|
--pattern '*' \
|
||||||
|
--connection-string "${{ steps.retrieve-secrets.outputs.sa-bitwarden-web-vault-dev-key-temp }}"
|
||||||
|
|
||||||
|
- name: Deploy to Azure Storage Account
|
||||||
|
working-directory: apps/web
|
||||||
|
run: |
|
||||||
|
az storage blob upload-batch \
|
||||||
|
--source "./build" \
|
||||||
|
--destination '$web' \
|
||||||
|
--connection-string "${{ steps.retrieve-secrets.outputs.sa-bitwarden-web-vault-dev-key-temp }}" \
|
||||||
|
--overwrite \
|
||||||
|
--no-progress
|
||||||
|
|
||||||
|
- name: Update deployment status to Success
|
||||||
|
if: success()
|
||||||
|
uses: chrnorm/deployment-status@2afb7d27101260f4a764219439564d954d10b5b0 # v2.0.1
|
||||||
|
with:
|
||||||
|
token: '${{ secrets.GITHUB_TOKEN }}'
|
||||||
|
environment-url: ${{ env._ENVIRONMENT_URL }}
|
||||||
|
state: 'success'
|
||||||
|
deployment-id: ${{ steps.deployment.outputs.deployment_id }}
|
||||||
|
|
||||||
|
- name: Update deployment status to Failure
|
||||||
|
if: failure()
|
||||||
|
uses: chrnorm/deployment-status@2afb7d27101260f4a764219439564d954d10b5b0 # v2.0.1
|
||||||
|
with:
|
||||||
|
token: '${{ secrets.GITHUB_TOKEN }}'
|
||||||
|
environment-url: ${{ env._ENVIRONMENT_URL }}
|
||||||
|
state: 'failure'
|
||||||
|
deployment-id: ${{ steps.deployment.outputs.deployment_id }}
|
||||||
|
|
||||||
|
notify:
|
||||||
|
name: Notify Slack with result
|
||||||
|
runs-on: ubuntu-22.04
|
||||||
|
if: always()
|
||||||
|
needs:
|
||||||
|
- azure-deploy
|
||||||
|
- setup
|
||||||
|
steps:
|
||||||
|
- uses: bitwarden/gh-actions/report-deployment-status-to-slack@main
|
||||||
|
with:
|
||||||
|
project: Clients
|
||||||
|
environment: ${{ needs.setup.outputs.environment-name }}
|
||||||
|
tag: ${{ inputs.branch-or-tag }}
|
||||||
|
slack-channel: team-eng-qa-devops
|
||||||
|
event: ${{ needs.azure-deploy.result }}
|
||||||
|
url: https://github.com/bitwarden/clients/actions/runs/${{ github.run_id }}
|
||||||
|
AZURE_KV_CI_SERVICE_PRINCIPAL: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
|
||||||
Loading…
Reference in New Issue