name: Deploy to Humanitec on: workflow_run: workflows: ["Build and Push to ACR"] types: - completed branches: [ "main" ] workflow_dispatch: inputs: environment: description: 'Target environment' required: true default: 'dev' type: choice options: - dev - staging - prod env: APP_ID: test-alex-1 PROJECT_ID: cjot-platform AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token DEFAULT_ENV_ID: dev jobs: deploy: name: Deploy to Humanitec runs-on: ubuntu-latest if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' permissions: contents: read id-token: write outputs: sha: ${{ steps.get-sha.outputs.sha }} steps: - name: Checkout code uses: actions/checkout@v4 - name: Get short SHA id: get-sha run: echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - name: Install CLI tools run: | # jq (needed for github API call) command -v jq &>/dev/null || (apt-get update -qq && apt-get install -y -qq jq) # hctl (Humanitec Platform Orchestrator v2 CLI) HCTL_VERSION=$(curl -s https://api.github.com/repos/humanitec/hctl/releases/latest | jq -r '.tag_name') curl -fLO "https://github.com/humanitec/hctl/releases/download/${HCTL_VERSION}/hctl_${HCTL_VERSION#v}_linux_amd64.tar.gz" tar -xzf "hctl_${HCTL_VERSION#v}_linux_amd64.tar.gz" install -m 755 hctl /usr/local/bin/hctl hctl --version echo "✓ Tools installed" - name: Install Azure CLI run: command -v az &>/dev/null || curl -sL https://aka.ms/InstallAzureCLIDeb | bash - name: Azure login (OIDC) run: | az login \ --service-principal \ --username "$AZURE_CLIENT_ID" \ --tenant "$AZURE_TENANT_ID" \ --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)" echo "✓ Azure login successful" - name: Get image reference id: image run: | ACR_LOGIN_SERVER=$(az acr list --query "[0].loginServer" -o tsv) SHA=${{ steps.get-sha.outputs.sha }} echo "IMAGE_FULL=${ACR_LOGIN_SERVER}/test-alex-1:${SHA}" >> $GITHUB_ENV echo "✓ Image: ${ACR_LOGIN_SERVER}/test-alex-1:${SHA}" - name: Set environment id: set-env run: | if [ "${{ gitea.event_name }}" = "workflow_dispatch" ]; then ENV_ID="${{ gitea.event.inputs.environment }}" else ENV_ID="$DEFAULT_ENV_ID" fi ENV_ID="${ENV_ID:-dev}" echo "ENV_ID=$ENV_ID" >> $GITHUB_OUTPUT echo "ENV_ID=$ENV_ID" >> $GITHUB_ENV echo "✓ Target environment: $ENV_ID" - name: Get Humanitec credentials from Key Vault run: | HUMANITEC_TOKEN=$(az keyvault secret show \ --vault-name "bstage-cjot-dev-core-kv" \ --name "humanitec-api-token-v2" \ --query "value" -o tsv) [ -z "$HUMANITEC_TOKEN" ] && echo "❌ Failed to retrieve HUMANITEC_TOKEN" && exit 1 echo "HUMANITEC_AUTH_TOKEN=$HUMANITEC_TOKEN" >> $GITHUB_ENV HUMANITEC_ORG=$(az keyvault secret show \ --vault-name "bstage-cjot-dev-core-kv" \ --name "humanitec-org-id" \ --query "value" -o tsv) [ -z "$HUMANITEC_ORG" ] && echo "❌ Failed to retrieve HUMANITEC_ORG" && exit 1 echo "HUMANITEC_ORG=$HUMANITEC_ORG" >> $GITHUB_ENV echo "✓ Credentials retrieved" - name: Deploy via Humanitec Score run: | # Pre-flight: wait for any prior deployment to finish before calling hctl. # hctl refuses to start a new deployment while one is still executing. echo "Pre-flight: checking for in-progress deployments..." PREFLIGHT_WAITED=0 while [ $PREFLIGHT_WAITED -lt 300 ]; do PREFLIGHT_STATUS=$(curl -sf \ -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN" \ "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true" \ | jq -r '.items[0].status // "none"' 2>/dev/null || echo "none") if [ "$PREFLIGHT_STATUS" != "in progress" ] && [ "$PREFLIGHT_STATUS" != "pending" ] && [ "$PREFLIGHT_STATUS" != "executing" ]; then echo "Pre-flight passed (status=$PREFLIGHT_STATUS). Proceeding." break fi echo " Prior deployment still running ($PREFLIGHT_WAITED s elapsed, status=$PREFLIGHT_STATUS)..." sleep 15 PREFLIGHT_WAITED=$((PREFLIGHT_WAITED + 15)) done # First deploy — provisions all resources. On a brand-new Humanitec project the # dns-k8s-ingress Terraform module runs before the K8s Service exists, so the # ingress backend port falls back to 3000. A second deploy (below) corrects it # once the Service is up, which is essential for apps not running on port 3000. HCTL_EXIT=0 timeout 300 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml \ --no-prompt \ --default-image "$IMAGE_FULL" || HCTL_EXIT=$? if [ "$HCTL_EXIT" -eq 0 ]; then echo "✓ First deployment complete to $ENV_ID" elif [ "$HCTL_EXIT" -eq 124 ]; then echo "✓ First deployment submitted (polling timed out — waiting for K8s to settle)" else echo "✗ hctl failed with exit code $HCTL_EXIT" exit $HCTL_EXIT fi # Poll Humanitec API until the first deployment is no longer in-progress before # re-deploying. A flat sleep is unreliable — Terraform DNS modules can take 4-6 min. echo "Waiting for first deployment to finish (polling Humanitec API)..." MAX_WAIT=360 WAITED=0 while [ $WAITED -lt $MAX_WAIT ]; do DEPLOY_STATUS=$(curl -sf \ -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN" \ "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true" \ | jq -r '.items[0].status // "unknown"' 2>/dev/null || echo "unknown") if [ "$DEPLOY_STATUS" != "in progress" ] && [ "$DEPLOY_STATUS" != "pending" ] && [ "$DEPLOY_STATUS" != "executing" ]; then echo "First deployment finished with status: $DEPLOY_STATUS" break fi echo " Still running ($WAITED s elapsed, status=$DEPLOY_STATUS)..." sleep 15 WAITED=$((WAITED + 15)) done if [ $WAITED -ge $MAX_WAIT ]; then echo "Warning: first deployment still running after $MAX_WAIT s — proceeding anyway" fi # Second deploy — dns module now reads the real K8s Service port, fixing the # ingress backend. This is a no-op for apps already routed correctly (e.g. port 3000). HCTL_EXIT2=0 timeout 120 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml \ --no-prompt \ --default-image "$IMAGE_FULL" || HCTL_EXIT2=$? if [ "$HCTL_EXIT2" -eq 0 ]; then echo "✓ Deployment finalised to $ENV_ID" elif [ "$HCTL_EXIT2" -eq 124 ]; then echo "✓ Second deployment submitted (polling timed out)" else echo "✗ Second hctl deploy failed with exit code $HCTL_EXIT2" exit $HCTL_EXIT2 fi - name: Deployment Summary run: | DEPLOY_URL="https://console.humanitec.dev/orgs/${HUMANITEC_ORG}/projects/$APP_ID" echo "### 🚀 Deployment Complete" >> $GITHUB_STEP_SUMMARY echo "| | |" >> $GITHUB_STEP_SUMMARY echo "|---|---|" >> $GITHUB_STEP_SUMMARY echo "| **Service** | $APP_ID |" >> $GITHUB_STEP_SUMMARY echo "| **Environment** | $ENV_ID |" >> $GITHUB_STEP_SUMMARY echo "| **Image** | $IMAGE_FULL |" >> $GITHUB_STEP_SUMMARY echo "| **Humanitec** | [$DEPLOY_URL]($DEPLOY_URL) |" >> $GITHUB_STEP_SUMMARY