r010 [DPTM-12] (#62) #72
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: hypnos::deploy_prod | |
| on: | |
| push: | |
| branches: | |
| - main | |
| # on: | |
| # pull_request: | |
| # branches: | |
| # - dev | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }} | |
| REGION: europe-west2 | |
| GAR_LOCATION: europe-west2-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/chain-service/ | |
| jobs: | |
| build-and-push-image: | |
| name: hypnos::build_and_push::docker_image | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - name: hypnos::deploy_prod::docker::Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: hypnos::deploy_prod::docker::Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: hypnos::deploy_prod::docker::Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| - name: hypnos::deploy_prod::docker::Build and push Docker image | |
| id: push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| API_URL=${{ secrets.API_URL_PROD }} | |
| APPLE_CLIENT_ID=${{ secrets.APPLE_CLIENT_ID_PROD }} | |
| APPLE_CLIENT_SECRET=${{ secrets.APPLE_CLIENT_SECRET_PROD }} | |
| AUTH_SECRET=${{ secrets.AUTH_SECRET_PROD }} | |
| AUTH_TRUST_HOST=${{ secrets.AUTH_TRUST_HOST_PROD }} | |
| AUTH_URL=${{ secrets.AUTH_URL_PROD }} | |
| AUTH_GITHUB_ID=${{ secrets.AUTH_GITHUB_ID_PROD }} | |
| AUTH_GITHUB_SECRET=${{ secrets.AUTH_GITHUB_SECRET_PROD }} | |
| EMAIL_FROM=${{ secrets.EMAIL_FROM_PROD }} | |
| EMAIL_SERVER=${{ secrets.EMAIL_SERVER_PROD }} | |
| FACEBOOK_CLIENT_ID=${{ secrets.FACEBOOK_CLIENT_ID_PROD }} | |
| FACEBOOK_CLIENT_SECRET=${{ secrets.FACEBOOK_CLIENT_SECRET_PROD }} | |
| GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID_PROD }} | |
| GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET_PROD }} | |
| INSTAGRAM_CLIENT_ID=${{ secrets.INSTAGRAM_CLIENT_ID_PROD }} | |
| INSTAGRAM_CLIENT_SECRET=${{ secrets.INSTAGRAM_CLIENT_SECRET_PROD }} | |
| KV_REST_API_READ_ONLY_TOKEN=${{ secrets.KV_REST_API_READ_ONLY_TOKEN_PROD }} | |
| KV_REST_API_TOKEN=${{ secrets.KV_REST_API_TOKEN_PROD }} | |
| KV_REST_API_URL=${{ secrets.KV_REST_API_URL_PROD }} | |
| KV_URL=${{ secrets.KV_URL_PROD }} | |
| MAIN_URL=${{ secrets.MAIN_URL_PROD }} | |
| MONGODB_DATABASE=${{ secrets.MONGODB_DATABASE_PROD }} | |
| MONGODB_DEFAULT_ORG=${{ secrets.MONGODB_DEFAULT_ORG_PROD }} | |
| MONGODB_ORGS_DATABASE=${{ secrets.MONGODB_ORGS_DATABASE_PROD }} | |
| MONGODB_PRIVATE_URI=${{ secrets.MONGODB_PRIVATE_URI_PROD }} | |
| MONGODB_PUBLIC_URI=${{ secrets.MONGODB_PUBLIC_URI_PROD }} | |
| MONGODB_USERS_DATABASE=${{ secrets.MONGODB_USERS_DATABASE_PROD }} | |
| NEXUS_KEEPALIVE=${{ secrets.NEXUS_KEEPALIVE_PROD }} | |
| NEXUS_MODE=${{ secrets.NEXUS_MODE_PROD }} | |
| NEXUS_STANDALONE=true | |
| PRISMA_PRIVATE_URI=${{ secrets.MONGODB_PRIVATE_URI_PROD }} | |
| PRISMA_PUBLIC_URI=${{ secrets.MONGODB_PUBLIC_URI_PROD }} | |
| SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN_PROD }} | |
| SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN_PROD }} | |
| NEXT_PUBLIC_SENTRY_DSN=${{ secrets.NEXT_PUBLIC_SENTRY_DSN_PROD }} | |
| SENTRY_PROJECT=${{ secrets.SENTRY_PROJECT_PROD }} | |
| SENTRY_ORG=${{ secrets.SENTRY_ORG_PROD }} | |
| VERCEL_GIT_COMMIT_SHA=${{ github.sha }} | |
| - name: hypnos::deploy_prod::docker::Generate artifact attestation | |
| uses: actions/attest-build-provenance@v1 | |
| with: | |
| subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| subject-digest: ${{ steps.push.outputs.digest }} | |
| push-to-registry: true | |
| deploy-to-gcp-vm: | |
| needs: build-and-push-image | |
| name: hypnos::deploy_prod::push_to_gcp::vm | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: hypnos::deploy_prod::push_to_gcp::vm::install ssh keys | |
| run: | | |
| install -m 600 -D /dev/null ~/.ssh/id_rsa | |
| echo "${{ secrets.SSH_PRIVATE_KEY_PROD }}" > ~/.ssh/id_rsa | |
| ssh-keyscan -H ${{ secrets.SSH_HOST_PROD }} > ~/.ssh/known_hosts | |
| - name: hypnos::deploy_prod::push_to_gcp::vm::connect and pull | |
| run: ssh ${{ secrets.SSH_USER_PROD }}@${{ secrets.SSH_HOST_PROD }} "docker login ghcr.io -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }} && docker pull ${{ secrets.IMAGE_TAG_PROD }} && docker stop hypnos && docker rm hypnos && docker run -d --name hypnos --restart unless-stopped -p ${{ secrets.IMAGE_PORT_PROD }}:3001 ${{ secrets.IMAGE_TAG_PROD }} && exit" | |
| - name: cleanup | |
| run: rm -rf ~/.ssh |