validate/demo-sam-1
4
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ci: restore the platform's orchestrator deploy workflow #2

Merged
demo-bot merged 2 commits from backstage/batch-1787588073338 into renovation/demo-sam-1 2026-08-24 16:14:39 +00:00
Conversation 0 Commits 2 Files Changed 2 +209 -142
2 changed files with 209 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

102
.gitea/workflows/build-push.yml
View File

@@ -2,7 +2,7 @@ name: Build and Push to ACR
on:
push:
branches: [ "dev" ]
branches: [ dev ]
workflow_dispatch: {}
concurrency:
@@ -16,6 +16,11 @@ jobs:
build:
name: Build and Push
runs-on: ubuntu-latest
if: >-
github.ref != 'refs/heads/main' && (
github.event_name == 'workflow_dispatch' ||
(github.event_name == 'push' && github.event.before != '0000000000000000000000000000000000000000')
)
permissions:
contents: read
id-token: write
@@ -23,52 +28,16 @@ jobs:
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up JDK 17
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: '17'
- name: Install Maven
run: |
if ! command -v mvn &>/dev/null; then
apt-get update -qq && apt-get install -y maven
fi
mvn --version
- name: Build with Maven
run: mvn clean package -DskipTests -Dcheckstyle.skip=true -B
- name: Run tests
# Exclude PostgresIntegrationTests — it hardcodes spring.docker.compose.skip.in-tests=false
# in its @SpringBootTest annotation, making it impossible to override via -D flags.
# docker-compose is not available in the act runner container.
# -Dtest=!ClassName is the correct Surefire 2.19+ CLI exclusion syntax.
# -Dcheckstyle.skip=true — platform-scaffolded files (score.yaml, k6/) contain
# internal http:// URLs that trip the NoHttp checkstyle plugin.
run: mvn test -B '-Dtest=!PostgresIntegrationTests' -Dcheckstyle.skip=true
- name: Security Scan - Trivy
continue-on-error: true
run: |
# Download release tarball directly — avoids install.sh which calls
# api.github.com/releases/tags/... and fails in network-restricted runners.
TRIVY_VERSION="0.57.1"
TRIVY_BIN="/tmp/trivy-bin/trivy"
if ! command -v trivy &>/dev/null; then
mkdir -p /tmp/trivy-bin
curl -sfLo /tmp/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
tar -xzf /tmp/trivy.tar.gz -C /tmp/trivy-bin trivy
chmod +x "${TRIVY_BIN}"
else
TRIVY_BIN="$(command -v trivy)"
fi
# Filesystem scan — exit-code 0 so findings are reported but never block the build
"${TRIVY_BIN}" fs --severity HIGH,CRITICAL --exit-code 0 --format table --skip-db-update --offline-scan . || "${TRIVY_BIN}" fs --severity HIGH,CRITICAL --exit-code 0 --format table .
- name: Install Azure CLI
run: |
if ! command -v az &>/dev/null; then
curl -sL https://aka.ms/InstallAzureCLIDeb | bash
fi
command -v az &>/dev/null || curl -sL https://aka.ms/InstallAzureCLIDeb | bash
- name: Install Docker CLI
run: |
command -v docker &>/dev/null || (apt-get update -qq && apt-get install -y docker.io)
docker --version
- name: Azure login (OIDC)
run: |
az login \
@@ -76,13 +45,40 @@ jobs:
--username "$AZURE_CLIENT_ID" \
--tenant "$AZURE_TENANT_ID" \
--federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)"
- name: Build and push via ACR Tasks
echo "✓ Azure login successful"
- name: Get ACR details
run: |
SHORT_SHA=$(echo "${{ gitea.sha }}" | cut -c1-7)
az acr build \
--registry bstagecjotdevacr \
--image demo-sam-1:$SHORT_SHA \
--image demo-sam-1:latest \
--file Dockerfile \
.
echo "✓ Pushed: bstagecjotdevacr.azurecr.io/demo-sam-1:$SHORT_SHA"
ACR_NAME=$(az acr list --query "[0].name" -o tsv)
ACR_NAME="${ACR_NAME:-bstagecjotdevacr}"
echo "ACR_NAME=$ACR_NAME" >> $GITHUB_ENV
echo "ACR_LOGIN_SERVER=${ACR_NAME}.azurecr.io" >> $GITHUB_ENV
echo "✓ Using ACR: ${ACR_NAME}.azurecr.io"
- name: ACR Login
run: |
ACR_TOKEN=$(az acr login --name "$ACR_NAME" --expose-token --output tsv --query accessToken)
docker login "$ACR_LOGIN_SERVER" \
--username 00000000-0000-0000-0000-000000000000 \
--password "$ACR_TOKEN"
echo "✓ ACR login successful"
- name: Build and Push Docker image
run: |
IMAGE_TAG="${{ gitea.sha }}"
IMAGE_FULL="${ACR_LOGIN_SERVER}/demo-sam-1:${IMAGE_TAG}"
IMAGE_LATEST="${ACR_LOGIN_SERVER}/demo-sam-1:latest"
docker build -t "$IMAGE_FULL" -t "$IMAGE_LATEST" .
docker push "$IMAGE_FULL"
docker push "$IMAGE_LATEST"
echo "IMAGE_FULL=$IMAGE_FULL" >> $GITHUB_ENV
echo "✓ Pushed: $IMAGE_FULL"
- name: Build Summary
run: |
echo "### ✅ Build Successful" >> $GITHUB_STEP_SUMMARY
echo "| | |" >> $GITHUB_STEP_SUMMARY
echo "|---|---|" >> $GITHUB_STEP_SUMMARY
echo "| **Service** | demo-sam-1 |" >> $GITHUB_STEP_SUMMARY
echo "| **Commit** | ${{ gitea.sha }} |" >> $GITHUB_STEP_SUMMARY
echo "| **Image** | $IMAGE_FULL |" >> $GITHUB_STEP_SUMMARY

249
.gitea/workflows/deploy.yml
View File

@@ -1,4 +1,4 @@
name: Deploy to Humanitec v2
name: Deploy to Orchestrator
on:
workflow_run:
@@ -12,104 +12,175 @@ on:
required: true
default: 'dev'
type: choice
options: [dev, staging, production]
options:
- dev
- staging
- prod
env:
HUMANITEC_ORG: skillful-wild-chicken-2617
HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }}
PO_API_URL: https://api.dev.orchestrator.crucible.kyndemo.live
PO_ORG_ID: crucible
PO_AUTH_TOKEN: ${{ secrets.PO_AUTH_TOKEN }}
# ONE ORCHESTRATOR PROJECT PER APPLICATION.
#
# This used to be the shared `apps-cluster` project with one environment per app, which
# made every app a peer of every other: the Orchestrator tab on any component listed the
# entire estate, and an app had exactly one environment named after itself, so there was
# nowhere for dev/staging/prod to live.
#
# That shape existed to avoid a Terraform pull request against config/projects.tf for every
# scaffolded app. That constraint turned out not to be real -- `octl create project`,
# `octl create runner-rule` and `octl create environment` are all runtime operations, so
# the workflow below builds the whole thing on first deploy and needs no repository change.
PROJECT_ID: demo-sam-1
DEFAULT_ENV_ID: dev
ACR_REGISTRY: bstagecjotdevacr.azurecr.io
# The runner a project's workloads execute on. This is NOT cosmetic: the Kubernetes and
# Helm providers are ambient, so a workload lands in whichever cluster its runner lives in,
# and Terraform state is keyed per runner. A project bound to the wrong runner deploys to
# the wrong cluster, and repointing it afterwards orphans the state it already owns.
PO_RUNNER_ID: crucible-orchestrator-dev-apps-dev-runner
OCTL_VERSION: 1.0.0
IMAGE: bstagecjotdevacr.azurecr.io/demo-sam-1
jobs:
deploy:
name: Deploy to Humanitec v2
guard:
name: Platform guard
runs-on: ubuntu-latest
if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
outputs:
ready: ${{ steps.check.outputs.ready }}
steps:
- uses: actions/checkout@v4
- name: Install dependencies
run: apt-get update -qq && apt-get install -y jq
- name: Install hctl CLI
- name: Check platform initialized
id: check
run: |
HCTL_VERSION=$(curl -s https://api.github.com/repos/humanitec/hctl/releases/latest | jq -r '.tag_name')
mkdir -p /tmp/hctl-install
curl -sLo /tmp/hctl-install/hctl.tar.gz "https://github.com/humanitec/hctl/releases/download/${HCTL_VERSION}/hctl_${HCTL_VERSION#v}_linux_amd64.tar.gz"
tar -xzf /tmp/hctl-install/hctl.tar.gz -C /tmp/hctl-install
install -m 755 /tmp/hctl-install/hctl /usr/local/bin/hctl
- name: Ensure Humanitec project and environment exist
env:
HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }}
run: |
DISPATCH_ENV="${{ github.event.inputs.environment }}"
ENV_ID="${DISPATCH_ENV:-$DEFAULT_ENV_ID}"
# Create project if it doesn't exist (hctl exits 0 if already exists)
hctl create project "$PROJECT_ID" --set display_name="demo-sam-1" 2>&1 | grep -v "already exists" || true
# Create environment if it doesn't exist
hctl create environment "$PROJECT_ID" "$ENV_ID" --set env_type_id=development --set display_name="Development" 2>&1 | grep -v "already exists" || true
echo "✓ Project $PROJECT_ID / env $ENV_ID ready"
- name: Deploy with Score
env:
HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }}
run: |
DISPATCH_ENV="${{ github.event.inputs.environment }}"
ENV_ID="${DISPATCH_ENV:-$DEFAULT_ENV_ID}"
DEFAULT_IMAGE="$ACR_REGISTRY/demo-sam-1:latest"
# Pre-flight: wait for any deployment from a prior run to finish before calling hctl.
# hctl refuses to start a new deployment while one is still executing.
echo "Pre-flight: checking for in-progress deployments..."
MAX_PREFLIGHT=420
PREFLIGHT_WAITED=0
while [ $PREFLIGHT_WAITED -lt $MAX_PREFLIGHT ]; do
PREFLIGHT_STATUS=$(curl -sf -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN" "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true" | jq -r '.items[0].status // "none"' 2>/dev/null || echo "none")
if [ "$PREFLIGHT_STATUS" != "in progress" ] && [ "$PREFLIGHT_STATUS" != "pending" ] && [ "$PREFLIGHT_STATUS" != "executing" ]; then
echo "Pre-flight passed (status=$PREFLIGHT_STATUS). Proceeding."
break
fi
echo " Prior deployment still running ($PREFLIGHT_WAITED s elapsed, status=$PREFLIGHT_STATUS)..."
sleep 15
PREFLIGHT_WAITED=$((PREFLIGHT_WAITED + 15))
done
# First deploy — provisions all resources. On a brand-new Humanitec project the
# dns-k8s-ingress Terraform module runs before the K8s Service exists, so the
# ingress backend port falls back to 3000. A second deploy (below) corrects it
# once the Service is up, which is essential for Java/Python apps on port 8080.
HCTL_EXIT=0
timeout 300 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml --no-prompt --default-image "$DEFAULT_IMAGE" || HCTL_EXIT=$?
if [ "$HCTL_EXIT" -eq 0 ]; then
echo "✓ First deployment complete for demo-sam-1 to $ENV_ID"
elif [ "$HCTL_EXIT" -eq 124 ]; then
echo "✓ First deployment submitted (polling timed out — waiting for K8s to settle)"
if [ -f ".platform/initialized.md" ]; then
echo "ready=true" >> $GITHUB_OUTPUT
else
echo "✗ hctl failed with exit code $HCTL_EXIT"
exit $HCTL_EXIT
echo "ready=false" >> $GITHUB_OUTPUT
echo "Skipping: .platform/initialized.md not found"
fi
# Poll Humanitec API until the first deployment is no longer in-progress before
# re-deploying. A flat sleep is unreliable — Terraform DNS modules can take 4-6 min.
echo "Waiting for first deployment to finish (polling Humanitec API)..."
MAX_WAIT=360
WAITED=0
while [ $WAITED -lt $MAX_WAIT ]; do
DEPLOY_STATUS=$(curl -sf -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN" "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true" | jq -r '.items[0].status // "unknown"' 2>/dev/null || echo "unknown")
if [ "$DEPLOY_STATUS" != "in progress" ] && [ "$DEPLOY_STATUS" != "pending" ] && [ "$DEPLOY_STATUS" != "executing" ]; then
echo "First deployment finished with status: $DEPLOY_STATUS"
break
fi
echo " Still running ($WAITED s elapsed, status=$DEPLOY_STATUS)..."
sleep 15
WAITED=$((WAITED + 15))
done
if [ $WAITED -ge $MAX_WAIT ]; then
echo "Warning: first deployment still running after $MAX_WAIT s — proceeding anyway"
fi
# Second deploy — dns module now reads the real K8s Service port, fixing the ingress
HCTL_EXIT2=0
timeout 120 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml --no-prompt --default-image "$DEFAULT_IMAGE" || HCTL_EXIT2=$?
if [ "$HCTL_EXIT2" -eq 0 ]; then
echo "✓ Deployment finalised for demo-sam-1 to $ENV_ID"
elif [ "$HCTL_EXIT2" -eq 124 ]; then
echo "✓ Second deployment submitted for demo-sam-1 to $ENV_ID (polling timed out)"
deploy:
name: Deploy to Orchestrator
needs: guard
if: >-
(github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && needs.guard.outputs.ready == 'true') ||
(github.event_name == 'workflow_dispatch')
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Install octl
run: |
set -euo pipefail
curl -fsSLo /tmp/octl.tar.gz \
"https://github.com/stellwerk-labs/platform-orchestrator-cli/releases/download/v${OCTL_VERSION}/platform-orchestrator-cli_${OCTL_VERSION}_linux_amd64.tar.gz"
tar xzf /tmp/octl.tar.gz -C /tmp
install -m 755 /tmp/octl /usr/local/bin/octl
octl --version
- name: Derive environment
run: |
# The environment is now a STAGE of this application -- dev, staging, prod -- because
# the project is the application. It used to be the component id, which was the only
# option while every app shared one project and had to be distinguishable inside it.
DISPATCH_ENV="${{ github.event.inputs.environment }}"
if [ -n "$DISPATCH_ENV" ]; then
ENV_ID="$DISPATCH_ENV"
else
echo "✗ Second hctl deploy failed with exit code $HCTL_EXIT2"
exit $HCTL_EXIT2
# On a workflow_run the branch is the triggering run's, not this job's checkout.
BRANCH="${{ github.event.workflow_run.head_branch }}"
BRANCH="${BRANCH:-${GITHUB_REF_NAME}}"
case "$BRANCH" in
staging) ENV_ID=staging ;;
prod|main|master) ENV_ID=prod ;;
*) ENV_ID=dev ;;
esac
echo "Branch '$BRANCH' maps to environment '$ENV_ID'"
fi
echo "ENV_ID=$ENV_ID" >> $GITHUB_ENV
echo "Deploying $PROJECT_ID to environment: $ENV_ID"
- name: Ensure the project and its runner binding exist
run: |
set -euo pipefail
# Created on first deploy rather than by a pull request against config/projects.tf.
# None of this needs a repository change: project, runner rule and environment are
# all runtime objects.
#
# Neither create is idempotent, so both fall through to a read on the second run.
octl create project "$PROJECT_ID" \
--set display_name='demo-sam-1' || \
octl get project "$PROJECT_ID"
# The runner rule is what routes this project's deployments to the apps cluster.
# Creating it twice would leave two rules matching the same project, so it is
# created only when absent -- `create` would happily add a duplicate.
if octl get runner-rules -o json 2>/dev/null | grep -q "\"project_id\": *\"$PROJECT_ID\""; then
echo "Runner rule for '$PROJECT_ID' already exists."
else
octl create runner-rule \
--set project_id="$PROJECT_ID" \
--set runner_id="$PO_RUNNER_ID" \
--no-prompt
fi
- name: Ensure the environment exists
run: |
set -euo pipefail
# Project and environment ids are POSITIONAL; only env_type_id and display_name go
# through --set. `dev` and `stable` are the only environment TYPES that exist, so
# staging rides on the dev type -- the type governs policy, the id governs identity.
case "$ENV_ID" in
prod) ENV_TYPE=stable ;;
*) ENV_TYPE=dev ;;
esac
octl create environment "$PROJECT_ID" "$ENV_ID" \
--set env_type_id="$ENV_TYPE" \
--set display_name="$ENV_ID" || \
octl get environment "$PROJECT_ID" "$ENV_ID"
- name: Deploy the Score workload
run: |
set -euo pipefail
# `octl score deploy` is ADDITIVE — it adds or updates a workload in the manifest and
# never removes one. That is the opposite of `octl deploy`, where omission is
# deletion. Do not substitute one for the other.
# No --show-logs: octl 1.0.0 has no such flag and exits 1 with `unknown flag`
# BEFORE contacting the orchestrator, so the whole deploy dies on an argument
# typo. Its nearest relatives are --runner-logs-level (default `info`, already
# what we want) and --skip-logs (which suppresses storage). Neither streams the
# runner's logs into this job, so there is nothing to substitute -- the runner
# logs are read from the orchestrator, not from here.
# The tag must be the commit the BUILD built, and it must be the WHOLE sha.
#
# build-push.yml tags with `` -- all 40 characters -- so the
# 7-character `${GITHUB_SHA:0:7}` this used to pass named a tag that has never
# existed in the registry.
#
# And on a workflow_run, GITHUB_SHA is the DEFAULT branch's head, while the build
# that produced the image ran on `dev`. They coincide only while the branches are
# level. `workflow_run.head_sha` is the triggering run's own commit, which is by
# definition the one that was built; `github.sha` covers the workflow_dispatch case,
# where there is no triggering run.
IMAGE_TAG="${{ github.event.workflow_run.head_sha || github.sha }}"
echo "Deploying ${IMAGE}:${IMAGE_TAG}"
octl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml \
--default-image "${IMAGE}:${IMAGE_TAG}" \
--no-prompt
- name: Deployment summary
if: always()
run: |
# Same commit the deploy step resolved, abbreviated for reading only -- the
# deployed tag is the full sha.
DEPLOYED_SHA="${{ github.event.workflow_run.head_sha || github.sha }}"
SHORT_SHA="${DEPLOYED_SHA:0:7}"
echo "## Deployment Result" >> $GITHUB_STEP_SUMMARY
echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
echo "|---|---|" >> $GITHUB_STEP_SUMMARY
echo "| Project | \`$PROJECT_ID\` |" >> $GITHUB_STEP_SUMMARY
echo "| Environment | \`$ENV_ID\` |" >> $GITHUB_STEP_SUMMARY
echo "| Commit | \`$SHORT_SHA\` |" >> $GITHUB_STEP_SUMMARY
echo "[View in Orchestrator Console](https://console.dev.orchestrator.crucible.kyndemo.live/orgs/$PO_ORG_ID/projects/$PROJECT_ID/environments/$ENV_ID)" >> $GITHUB_STEP_SUMMARY