name: Build and publish rule engine on: push: branches: [main] tags: ["v*"] permissions: contents: write jobs: release: runs-on: large if: ${{ !startsWith(github.ref, 'refs/heads/') || !contains(github.event.head_commit.message, '[auto-version-bump]') }} steps: - name: Check out repository uses: actions/checkout@v4 with: token: ${{ secrets.GITEA_TOKEN }} persist-credentials: true - name: Test and lint in the shared builder image shell: bash run: | set -euo pipefail docker run --rm \ --volume "$PWD:/src" \ --volume ai-spel-rule-engine-cargo:/src/target \ --workdir /src \ harbor.k3s.k0.nu/ai-spel/game-builder:rust1.89-v2 \ sh -c 'cargo generate-lockfile && cargo fmt --all && cargo fmt --all -- --check && cargo test --workspace && cargo clippy --locked --workspace --all-targets -- -D warnings' - name: Bump version and create Git tag id: bump if: startsWith(github.ref, 'refs/heads/') shell: bash run: | set -euo pipefail git fetch origin main --quiet test "$(git rev-parse origin/main)" = "$GITHUB_SHA" version="$(python3 scripts/bump-release-version.py)" git config user.name "Gitea Actions" git config user.email "actions@users.noreply.gitea" git add -u git add Cargo.toml Cargo.lock deploy/helm/ai-spel-rule-engine/Chart.yaml deploy/argocd/application.yaml git commit -m "Release $version [auto-version-bump]" git tag -a "v$version" -m "v$version" git push origin HEAD:main "refs/tags/v$version" echo "version=$version" >> "$GITHUB_OUTPUT" - name: Build and publish image and Helm chart id: publish if: ${{ startsWith(github.ref, 'refs/tags/') || steps.bump.outputs.version != '' }} shell: bash env: HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }} HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }} AUTO_RELEASE_VERSION: ${{ steps.bump.outputs.version }} run: | set -euo pipefail version="${AUTO_RELEASE_VERSION:-${GITHUB_REF_NAME#v}}" printf '%s' "$HARBOR_PASSWORD" | docker login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin image="harbor.k3s.k0.nu/ai-spel/rule-engine:$version" docker build --platform linux/amd64 --pull --tag "$image" . docker image push "$image" helm_version=v3.17.3 if ! command -v helm >/dev/null 2>&1; then mkdir -p "$RUNNER_TEMP/helm" "$HOME/.local/bin" archive="helm-${helm_version}-linux-amd64.tar.gz" curl -fsSLo "$RUNNER_TEMP/helm/$archive" "https://get.helm.sh/$archive" curl -fsSLo "$RUNNER_TEMP/helm/$archive.sha256sum" "https://get.helm.sh/$archive.sha256sum" (cd "$RUNNER_TEMP/helm" && sha256sum -c "$archive.sha256sum") tar -xzf "$RUNNER_TEMP/helm/$archive" -C "$RUNNER_TEMP/helm" install "$RUNNER_TEMP/helm/linux-amd64/helm" "$HOME/.local/bin/helm" echo "$HOME/.local/bin" >> "$GITHUB_PATH" export PATH="$HOME/.local/bin:$PATH" fi helm lint deploy/helm/ai-spel-rule-engine package_dir="$(mktemp -d)" trap 'rm -rf "$package_dir"' EXIT helm package deploy/helm/ai-spel-rule-engine --destination "$package_dir" --version "$version" --app-version "$version" printf '%s' "$HARBOR_PASSWORD" | helm registry login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin helm push "$package_dir/ai-spel-rule-engine-$version.tgz" oci://harbor.k3s.k0.nu/ai-spel helm template ai-spel-rule-engine "$package_dir/ai-spel-rule-engine-$version.tgz" --namespace ai-spel > "$package_dir/manifest.yaml" oras_version=1.2.3 mkdir -p "$RUNNER_TEMP/oras" curl -fsSLo "$RUNNER_TEMP/oras/oras.tgz" "https://github.com/oras-project/oras/releases/download/v${oras_version}/oras_${oras_version}_linux_amd64.tar.gz" echo 'b4efc97a91f471f323f193ea4b4d63d8ff443ca3aab514151a30751330852827 '"$RUNNER_TEMP/oras/oras.tgz" | sha256sum -c - tar -xzf "$RUNNER_TEMP/oras/oras.tgz" -C "$RUNNER_TEMP/oras" oras install "$RUNNER_TEMP/oras/oras" "$RUNNER_TEMP/oras-bin" printf '%s' "$HARBOR_PASSWORD" | "$RUNNER_TEMP/oras-bin" login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin unset HARBOR_PASSWORD "$RUNNER_TEMP/oras-bin" push --artifact-type application/vnd.ai-spel.kubernetes-manifest.v1 \ "harbor.k3s.k0.nu/ai-spel/rule-engine-manifest:$version" \ "$package_dir/manifest.yaml:application/yaml" echo "version=$version" >> "$GITHUB_OUTPUT" - name: Deploy rule engine through Argo CD if: ${{ startsWith(github.ref, 'refs/tags/') || steps.bump.outputs.version != '' }} shell: bash env: KUBECONFIG_B64: ${{ secrets.AI_SPEL_TEST_KUBECONFIG }} AUTO_RELEASE_VERSION: ${{ steps.bump.outputs.version }} run: | set -euo pipefail test -n "$KUBECONFIG_B64" mkdir -p "$RUNNER_TEMP/kube" printf '%s' "$KUBECONFIG_B64" | base64 -d > "$RUNNER_TEMP/kube/config" chmod 600 "$RUNNER_TEMP/kube/config" unset KUBECONFIG_B64 export KUBECONFIG="$RUNNER_TEMP/kube/config" version="${AUTO_RELEASE_VERSION:-${GITHUB_REF_NAME#v}}" if ! kubectl -n ai-spel get statefulset ai-spel-nats >/dev/null 2>&1 \ && ! kubectl -n argocd get application ai-spel-rule-engine >/dev/null 2>&1; then echo 'NATS is not installed yet. The backend release pipeline bootstraps NATS and this Argo Application.' exit 0 fi kubectl -n ai-spel rollout status statefulset/ai-spel-nats --timeout=10m kubectl -n argocd apply -f deploy/argocd/application.yaml kubectl -n argocd patch application ai-spel-rule-engine --type merge -p "{\"spec\":{\"source\":{\"targetRevision\":\"$version\"}}}" deadline=$((SECONDS + 600)) while (( SECONDS < deadline )); do sync="$(kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.sync.status}')" health="$(kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.health.status}')" if [[ "$sync" == Synced && "$health" == Healthy ]]; then break; fi sleep 5 done [[ "$sync" == Synced && "$health" == Healthy ]] || { echo "Argo CD did not reach Synced/Healthy for rule engine $version" kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.conditions[*].message}' exit 1 } kubectl -n ai-spel rollout status deployment/ai-spel-rule-engine --timeout=10m kubectl -n ai-spel get pods -l app.kubernetes.io/instance=ai-spel-rule-engine -o wide