From e1d202abcd0dfc8b1352d121edfe4b09a5bb1da3 Mon Sep 17 00:00:00 2001 From: demo-bot Date: Wed, 5 Aug 2026 16:20:26 +0000 Subject: [PATCH 1/2] ci: restore the platform's orchestrator deploy workflow --- .gitea/workflows/deploy.yml | 249 +++++++++++++++++++++++------------- 1 file changed, 160 insertions(+), 89 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index ddeacb2..f80771f 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -1,4 +1,4 @@ -name: Deploy to Humanitec v2 +name: Deploy to Orchestrator on: workflow_run: @@ -12,104 +12,175 @@ on: required: true default: 'dev' type: choice - options: [dev, staging, production] + options: + - dev + - staging + - prod env: - HUMANITEC_ORG: skillful-wild-chicken-2617 - HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }} + PO_API_URL: https://api.dev.orchestrator.crucible.kyndemo.live + PO_ORG_ID: crucible + PO_AUTH_TOKEN: ${{ secrets.PO_AUTH_TOKEN }} + # ONE ORCHESTRATOR PROJECT PER APPLICATION. + # + # This used to be the shared `apps-cluster` project with one environment per app, which + # made every app a peer of every other: the Orchestrator tab on any component listed the + # entire estate, and an app had exactly one environment named after itself, so there was + # nowhere for dev/staging/prod to live. + # + # That shape existed to avoid a Terraform pull request against config/projects.tf for every + # scaffolded app. That constraint turned out not to be real -- `octl create project`, + # `octl create runner-rule` and `octl create environment` are all runtime operations, so + # the workflow below builds the whole thing on first deploy and needs no repository change. PROJECT_ID: reno-test-14 - DEFAULT_ENV_ID: dev - ACR_REGISTRY: bstagecjotdevacr.azurecr.io + # The runner a project's workloads execute on. This is NOT cosmetic: the Kubernetes and + # Helm providers are ambient, so a workload lands in whichever cluster its runner lives in, + # and Terraform state is keyed per runner. A project bound to the wrong runner deploys to + # the wrong cluster, and repointing it afterwards orphans the state it already owns. + PO_RUNNER_ID: crucible-orchestrator-dev-apps-dev-runner + OCTL_VERSION: 1.0.0 + IMAGE: bstagecjotdevacr.azurecr.io/reno-test-14 jobs: - deploy: - name: Deploy to Humanitec v2 + guard: + name: Platform guard runs-on: ubuntu-latest - if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' + outputs: + ready: ${{ steps.check.outputs.ready }} steps: - uses: actions/checkout@v4 - - name: Install dependencies - run: apt-get update -qq && apt-get install -y jq - - name: Install hctl CLI + - name: Check platform initialized + id: check run: | - HCTL_VERSION=$(curl -s https://api.github.com/repos/humanitec/hctl/releases/latest | jq -r '.tag_name') - mkdir -p /tmp/hctl-install - curl -sLo /tmp/hctl-install/hctl.tar.gz "https://github.com/humanitec/hctl/releases/download/${HCTL_VERSION}/hctl_${HCTL_VERSION#v}_linux_amd64.tar.gz" - tar -xzf /tmp/hctl-install/hctl.tar.gz -C /tmp/hctl-install - install -m 755 /tmp/hctl-install/hctl /usr/local/bin/hctl - - name: Ensure Humanitec project and environment exist - env: - HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }} - run: | - DISPATCH_ENV="${{ github.event.inputs.environment }}" - ENV_ID="${DISPATCH_ENV:-$DEFAULT_ENV_ID}" - # Create project if it doesn't exist (hctl exits 0 if already exists) - hctl create project "$PROJECT_ID" --set display_name="reno-test-14" 2>&1 | grep -v "already exists" || true - # Create environment if it doesn't exist - hctl create environment "$PROJECT_ID" "$ENV_ID" --set env_type_id=development --set display_name="Development" 2>&1 | grep -v "already exists" || true - echo "✓ Project $PROJECT_ID / env $ENV_ID ready" - - name: Deploy with Score - env: - HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }} - run: | - DISPATCH_ENV="${{ github.event.inputs.environment }}" - ENV_ID="${DISPATCH_ENV:-$DEFAULT_ENV_ID}" - DEFAULT_IMAGE="$ACR_REGISTRY/reno-test-14:latest" - # Pre-flight: wait for any deployment from a prior run to finish before calling hctl. - # hctl refuses to start a new deployment while one is still executing. - echo "Pre-flight: checking for in-progress deployments..." - MAX_PREFLIGHT=420 - PREFLIGHT_WAITED=0 - while [ $PREFLIGHT_WAITED -lt $MAX_PREFLIGHT ]; do - PREFLIGHT_STATUS=$(curl -sf -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN" "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true" | jq -r '.items[0].status // "none"' 2>/dev/null || echo "none") - if [ "$PREFLIGHT_STATUS" != "in progress" ] && [ "$PREFLIGHT_STATUS" != "pending" ] && [ "$PREFLIGHT_STATUS" != "executing" ]; then - echo "Pre-flight passed (status=$PREFLIGHT_STATUS). Proceeding." - break - fi - echo " Prior deployment still running ($PREFLIGHT_WAITED s elapsed, status=$PREFLIGHT_STATUS)..." - sleep 15 - PREFLIGHT_WAITED=$((PREFLIGHT_WAITED + 15)) - done - # First deploy — provisions all resources. On a brand-new Humanitec project the - # dns-k8s-ingress Terraform module runs before the K8s Service exists, so the - # ingress backend port falls back to 3000. A second deploy (below) corrects it - # once the Service is up, which is essential for Java/Python apps on port 8080. - HCTL_EXIT=0 - timeout 300 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml --no-prompt --default-image "$DEFAULT_IMAGE" || HCTL_EXIT=$? - if [ "$HCTL_EXIT" -eq 0 ]; then - echo "✓ First deployment complete for reno-test-14 to $ENV_ID" - elif [ "$HCTL_EXIT" -eq 124 ]; then - echo "✓ First deployment submitted (polling timed out — waiting for K8s to settle)" + if [ -f ".platform/initialized.md" ]; then + echo "ready=true" >> $GITHUB_OUTPUT else - echo "✗ hctl failed with exit code $HCTL_EXIT" - exit $HCTL_EXIT + echo "ready=false" >> $GITHUB_OUTPUT + echo "Skipping: .platform/initialized.md not found" fi - # Poll Humanitec API until the first deployment is no longer in-progress before - # re-deploying. A flat sleep is unreliable — Terraform DNS modules can take 4-6 min. - echo "Waiting for first deployment to finish (polling Humanitec API)..." - MAX_WAIT=360 - WAITED=0 - while [ $WAITED -lt $MAX_WAIT ]; do - DEPLOY_STATUS=$(curl -sf -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN" "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true" | jq -r '.items[0].status // "unknown"' 2>/dev/null || echo "unknown") - if [ "$DEPLOY_STATUS" != "in progress" ] && [ "$DEPLOY_STATUS" != "pending" ] && [ "$DEPLOY_STATUS" != "executing" ]; then - echo "First deployment finished with status: $DEPLOY_STATUS" - break - fi - echo " Still running ($WAITED s elapsed, status=$DEPLOY_STATUS)..." - sleep 15 - WAITED=$((WAITED + 15)) - done - if [ $WAITED -ge $MAX_WAIT ]; then - echo "Warning: first deployment still running after $MAX_WAIT s — proceeding anyway" - fi - # Second deploy — dns module now reads the real K8s Service port, fixing the ingress - HCTL_EXIT2=0 - timeout 120 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml --no-prompt --default-image "$DEFAULT_IMAGE" || HCTL_EXIT2=$? - if [ "$HCTL_EXIT2" -eq 0 ]; then - echo "✓ Deployment finalised for reno-test-14 to $ENV_ID" - elif [ "$HCTL_EXIT2" -eq 124 ]; then - echo "✓ Second deployment submitted for reno-test-14 to $ENV_ID (polling timed out)" + + deploy: + name: Deploy to Orchestrator + needs: guard + if: >- + (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && needs.guard.outputs.ready == 'true') || + (github.event_name == 'workflow_dispatch') + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Install octl + run: | + set -euo pipefail + curl -fsSLo /tmp/octl.tar.gz \ + "https://github.com/stellwerk-labs/platform-orchestrator-cli/releases/download/v${OCTL_VERSION}/platform-orchestrator-cli_${OCTL_VERSION}_linux_amd64.tar.gz" + tar xzf /tmp/octl.tar.gz -C /tmp + install -m 755 /tmp/octl /usr/local/bin/octl + octl --version + + - name: Derive environment + run: | + # The environment is now a STAGE of this application -- dev, staging, prod -- because + # the project is the application. It used to be the component id, which was the only + # option while every app shared one project and had to be distinguishable inside it. + DISPATCH_ENV="${{ github.event.inputs.environment }}" + if [ -n "$DISPATCH_ENV" ]; then + ENV_ID="$DISPATCH_ENV" else - echo "✗ Second hctl deploy failed with exit code $HCTL_EXIT2" - exit $HCTL_EXIT2 + # On a workflow_run the branch is the triggering run's, not this job's checkout. + BRANCH="${{ github.event.workflow_run.head_branch }}" + BRANCH="${BRANCH:-${GITHUB_REF_NAME}}" + case "$BRANCH" in + staging) ENV_ID=staging ;; + prod|main|master) ENV_ID=prod ;; + *) ENV_ID=dev ;; + esac + echo "Branch '$BRANCH' maps to environment '$ENV_ID'" fi + echo "ENV_ID=$ENV_ID" >> $GITHUB_ENV + echo "Deploying $PROJECT_ID to environment: $ENV_ID" + + - name: Ensure the project and its runner binding exist + run: | + set -euo pipefail + # Created on first deploy rather than by a pull request against config/projects.tf. + # None of this needs a repository change: project, runner rule and environment are + # all runtime objects. + # + # Neither create is idempotent, so both fall through to a read on the second run. + octl create project "$PROJECT_ID" \ + --set display_name='reno-test-14' || \ + octl get project "$PROJECT_ID" + + # The runner rule is what routes this project's deployments to the apps cluster. + # Creating it twice would leave two rules matching the same project, so it is + # created only when absent -- `create` would happily add a duplicate. + if octl get runner-rules -o json 2>/dev/null | grep -q "\"project_id\": *\"$PROJECT_ID\""; then + echo "Runner rule for '$PROJECT_ID' already exists." + else + octl create runner-rule \ + --set project_id="$PROJECT_ID" \ + --set runner_id="$PO_RUNNER_ID" \ + --no-prompt + fi + + - name: Ensure the environment exists + run: | + set -euo pipefail + # Project and environment ids are POSITIONAL; only env_type_id and display_name go + # through --set. `dev` and `stable` are the only environment TYPES that exist, so + # staging rides on the dev type -- the type governs policy, the id governs identity. + case "$ENV_ID" in + prod) ENV_TYPE=stable ;; + *) ENV_TYPE=dev ;; + esac + octl create environment "$PROJECT_ID" "$ENV_ID" \ + --set env_type_id="$ENV_TYPE" \ + --set display_name="$ENV_ID" || \ + octl get environment "$PROJECT_ID" "$ENV_ID" + + - name: Deploy the Score workload + run: | + set -euo pipefail + # `octl score deploy` is ADDITIVE — it adds or updates a workload in the manifest and + # never removes one. That is the opposite of `octl deploy`, where omission is + # deletion. Do not substitute one for the other. + # No --show-logs: octl 1.0.0 has no such flag and exits 1 with `unknown flag` + # BEFORE contacting the orchestrator, so the whole deploy dies on an argument + # typo. Its nearest relatives are --runner-logs-level (default `info`, already + # what we want) and --skip-logs (which suppresses storage). Neither streams the + # runner's logs into this job, so there is nothing to substitute -- the runner + # logs are read from the orchestrator, not from here. + # The tag must be the commit the BUILD built, and it must be the WHOLE sha. + # + # build-push.yml tags with `` -- all 40 characters -- so the + # 7-character `${GITHUB_SHA:0:7}` this used to pass named a tag that has never + # existed in the registry. + # + # And on a workflow_run, GITHUB_SHA is the DEFAULT branch's head, while the build + # that produced the image ran on `dev`. They coincide only while the branches are + # level. `workflow_run.head_sha` is the triggering run's own commit, which is by + # definition the one that was built; `github.sha` covers the workflow_dispatch case, + # where there is no triggering run. + IMAGE_TAG="${{ github.event.workflow_run.head_sha || github.sha }}" + echo "Deploying ${IMAGE}:${IMAGE_TAG}" + + octl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml \ + --default-image "${IMAGE}:${IMAGE_TAG}" \ + --no-prompt + + - name: Deployment summary + if: always() + run: | + # Same commit the deploy step resolved, abbreviated for reading only -- the + # deployed tag is the full sha. + DEPLOYED_SHA="${{ github.event.workflow_run.head_sha || github.sha }}" + SHORT_SHA="${DEPLOYED_SHA:0:7}" + echo "## Deployment Result" >> $GITHUB_STEP_SUMMARY + echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY + echo "|---|---|" >> $GITHUB_STEP_SUMMARY + echo "| Project | \`$PROJECT_ID\` |" >> $GITHUB_STEP_SUMMARY + echo "| Environment | \`$ENV_ID\` |" >> $GITHUB_STEP_SUMMARY + echo "| Commit | \`$SHORT_SHA\` |" >> $GITHUB_STEP_SUMMARY + echo "[View in Orchestrator Console](https://console.dev.orchestrator.crucible.kyndemo.live/orgs/$PO_ORG_ID/projects/$PROJECT_ID/environments/$ENV_ID)" >> $GITHUB_STEP_SUMMARY -- 2.49.1 From 0db8c59b93da868c8d2bacf9f06bd0656a8c3263 Mon Sep 17 00:00:00 2001 From: demo-bot Date: Wed, 5 Aug 2026 16:20:27 +0000 Subject: [PATCH 2/2] ci: restore the platform's orchestrator deploy workflow --- .gitea/workflows/build-push.yml | 102 +++++++++++++++----------------- 1 file changed, 49 insertions(+), 53 deletions(-) diff --git a/.gitea/workflows/build-push.yml b/.gitea/workflows/build-push.yml index 2da7cfc..750575a 100644 --- a/.gitea/workflows/build-push.yml +++ b/.gitea/workflows/build-push.yml @@ -2,7 +2,7 @@ name: Build and Push to ACR on: push: - branches: [ "dev" ] + branches: [ dev ] workflow_dispatch: {} concurrency: @@ -16,6 +16,11 @@ jobs: build: name: Build and Push runs-on: ubuntu-latest + if: >- + github.ref != 'refs/heads/main' && ( + github.event_name == 'workflow_dispatch' || + (github.event_name == 'push' && github.event.before != '0000000000000000000000000000000000000000') + ) permissions: contents: read id-token: write @@ -23,52 +28,16 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v4 - - name: Set up JDK 17 - uses: actions/setup-java@v4 - with: - distribution: 'temurin' - java-version: '17' - - name: Install Maven - run: | - if ! command -v mvn &>/dev/null; then - apt-get update -qq && apt-get install -y maven - fi - mvn --version - - name: Build with Maven - run: mvn clean package -DskipTests -Dcheckstyle.skip=true -B - - name: Run tests - # Exclude PostgresIntegrationTests — it hardcodes spring.docker.compose.skip.in-tests=false - # in its @SpringBootTest annotation, making it impossible to override via -D flags. - # docker-compose is not available in the act runner container. - # -Dtest=!ClassName is the correct Surefire 2.19+ CLI exclusion syntax. - # -Dcheckstyle.skip=true — platform-scaffolded files (score.yaml, k6/) contain - # internal http:// URLs that trip the NoHttp checkstyle plugin. - run: mvn test -B '-Dtest=!PostgresIntegrationTests' -Dcheckstyle.skip=true - - - - name: Security Scan - Trivy - continue-on-error: true - run: | - # Download release tarball directly — avoids install.sh which calls - # api.github.com/releases/tags/... and fails in network-restricted runners. - TRIVY_VERSION="0.57.1" - TRIVY_BIN="/tmp/trivy-bin/trivy" - if ! command -v trivy &>/dev/null; then - mkdir -p /tmp/trivy-bin - curl -sfLo /tmp/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" - tar -xzf /tmp/trivy.tar.gz -C /tmp/trivy-bin trivy - chmod +x "${TRIVY_BIN}" - else - TRIVY_BIN="$(command -v trivy)" - fi - # Filesystem scan — exit-code 0 so findings are reported but never block the build - "${TRIVY_BIN}" fs --severity HIGH,CRITICAL --exit-code 0 --format table --skip-db-update --offline-scan . || "${TRIVY_BIN}" fs --severity HIGH,CRITICAL --exit-code 0 --format table . - name: Install Azure CLI run: | - if ! command -v az &>/dev/null; then - curl -sL https://aka.ms/InstallAzureCLIDeb | bash - fi + command -v az &>/dev/null || curl -sL https://aka.ms/InstallAzureCLIDeb | bash + + - name: Install Docker CLI + run: | + command -v docker &>/dev/null || (apt-get update -qq && apt-get install -y docker.io) + docker --version + - name: Azure login (OIDC) run: | az login \ @@ -76,13 +45,40 @@ jobs: --username "$AZURE_CLIENT_ID" \ --tenant "$AZURE_TENANT_ID" \ --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)" - - name: Build and push via ACR Tasks + echo "✓ Azure login successful" + + - name: Get ACR details run: | - SHORT_SHA=$(echo "${{ gitea.sha }}" | cut -c1-7) - az acr build \ - --registry bstagecjotdevacr \ - --image reno-test-14:$SHORT_SHA \ - --image reno-test-14:latest \ - --file Dockerfile \ - . - echo "✓ Pushed: bstagecjotdevacr.azurecr.io/reno-test-14:$SHORT_SHA" + ACR_NAME=$(az acr list --query "[0].name" -o tsv) + ACR_NAME="${ACR_NAME:-bstagecjotdevacr}" + echo "ACR_NAME=$ACR_NAME" >> $GITHUB_ENV + echo "ACR_LOGIN_SERVER=${ACR_NAME}.azurecr.io" >> $GITHUB_ENV + echo "✓ Using ACR: ${ACR_NAME}.azurecr.io" + + - name: ACR Login + run: | + ACR_TOKEN=$(az acr login --name "$ACR_NAME" --expose-token --output tsv --query accessToken) + docker login "$ACR_LOGIN_SERVER" \ + --username 00000000-0000-0000-0000-000000000000 \ + --password "$ACR_TOKEN" + echo "✓ ACR login successful" + + - name: Build and Push Docker image + run: | + IMAGE_TAG="${{ gitea.sha }}" + IMAGE_FULL="${ACR_LOGIN_SERVER}/reno-test-14:${IMAGE_TAG}" + IMAGE_LATEST="${ACR_LOGIN_SERVER}/reno-test-14:latest" + docker build -t "$IMAGE_FULL" -t "$IMAGE_LATEST" . + docker push "$IMAGE_FULL" + docker push "$IMAGE_LATEST" + echo "IMAGE_FULL=$IMAGE_FULL" >> $GITHUB_ENV + echo "✓ Pushed: $IMAGE_FULL" + + - name: Build Summary + run: | + echo "### ✅ Build Successful" >> $GITHUB_STEP_SUMMARY + echo "| | |" >> $GITHUB_STEP_SUMMARY + echo "|---|---|" >> $GITHUB_STEP_SUMMARY + echo "| **Service** | reno-test-14 |" >> $GITHUB_STEP_SUMMARY + echo "| **Commit** | ${{ gitea.sha }} |" >> $GITHUB_STEP_SUMMARY + echo "| **Image** | $IMAGE_FULL |" >> $GITHUB_STEP_SUMMARY -- 2.49.1