chatbot/.github/workflows/deploy-prod.yaml at 836fc3ad5c3bf89feed9206004407215b107b029 · basedosdados/chatbot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: Deploy Prod

on:
  workflow_run:
    workflows:
      - Build Prod
    branches:
      - main
    types:
      - completed
  # Allow manual execution from the Actions tab
  workflow_dispatch:

jobs:
  deploy-prod:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          ref: main

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          version: v4.0.0

      - name: Import secrets from Vault
        id: import_secrets
        uses: hashicorp/vault-action@v2.8.0
        with:
          url: https://vault.basedosdados.org
          token: ${{ secrets.VAULT_TOKEN }}
          secrets: |
            secret/data/gcp_credentials/basedosdados-dev GCP_PROJECT_ID   | GCP_PROJECT_ID ;
            secret/data/gcp_credentials/basedosdados-dev GH_ACTIONS_SA    | GCP_SA ;
            secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_NAME | GKE_CLUSTER_NAME ;
            secret/data/gcp_credentials/basedosdados-dev GKE_CLUSTER_ZONE | GKE_CLUSTER_ZONE ;

      - name: Setup Google Cloud CLI
        uses: google-github-actions/setup-gcloud@v0.2.1
        with:
          service_account_key: ${{ steps.import_secrets.outputs.GCP_SA }}
          project_id: ${{ steps.import_secrets.outputs.GCP_PROJECT_ID }}
          export_default_credentials: true

      - name: Get GKE credentials
        uses: google-github-actions/get-gke-credentials@v0.2.1
        with:
          cluster_name: ${{ steps.import_secrets.outputs.GKE_CLUSTER_NAME }}
          location: ${{ steps.import_secrets.outputs.GKE_CLUSTER_ZONE }}
          credentials: ${{ steps.import_secrets.outputs.GCP_SA }}

      - name: Write values.yaml file
        run: |
          cat << EOF > values.yaml
          chatbot:
            name: chatbot-api-prod
            image:
              name: ghcr.io/${{ github.repository }}
              tag: prod
              pullPolicy: Always
            replicas: 1
            resources:
              requests:
                cpu: 250m
                memory: 1Gi
              limits:
                cpu: 500m
                memory: 2Gi
            envConfigMap: chatbot-api-prod-config
            envSecret: chatbot-api-prod-secrets
            envSharedSecret: api-prod-secrets
          EOF

      # NOTE: --server-side=false disables Helm v4's Server-Side Apply (SSA) and uses
      # Client-Side Apply (CSA) instead, which mirrors Helm v3 behavior. This is simpler
      # for single-manager setups: fields removed from the template are deleted from the
      # cluster, and there are no field ownership conflicts.
      - name: Deploy using Helm
        run: |
          helm upgrade \
            --wait \
            --install \
            --timeout 10m \
            --namespace website \
            --values values.yaml \
            --server-side false \
            chatbot-api-prod charts/basedosdados-chatbot