148 lines
7.6 KiB
YAML
148 lines
7.6 KiB
YAML
name: Build and publish rule engine
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: large
|
|
if: ${{ !startsWith(github.ref, 'refs/heads/') || !contains(github.event.head_commit.message, '[auto-version-bump]') }}
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
token: ${{ secrets.GITEA_TOKEN }}
|
|
persist-credentials: true
|
|
|
|
- name: Check release credentials before changing the version
|
|
shell: bash
|
|
env:
|
|
HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
|
|
HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$HARBOR_USERNAME" || { echo 'Missing HARBOR_USERNAME action secret'; exit 1; }
|
|
test -n "$HARBOR_PASSWORD" || { echo 'Missing HARBOR_PASSWORD action secret'; exit 1; }
|
|
|
|
- name: Test and lint in the shared builder image
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
docker run --rm \
|
|
--volume "$PWD:/src" \
|
|
--volume ai-spel-rule-engine-cargo:/src/target \
|
|
--workdir /src \
|
|
harbor.k3s.k0.nu/ai-spel/game-builder:rust1.89-v2 \
|
|
sh -c 'cargo generate-lockfile && cargo fmt --all && cargo fmt --all -- --check && cargo test --workspace && cargo clippy --locked --workspace --all-targets -- -D warnings'
|
|
|
|
- name: Bump version and create Git tag
|
|
id: bump
|
|
if: startsWith(github.ref, 'refs/heads/')
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch origin main --quiet
|
|
test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
|
|
version="$(python3 scripts/bump-release-version.py)"
|
|
git config user.name "Gitea Actions"
|
|
git config user.email "actions@users.noreply.gitea"
|
|
git add -u
|
|
git add Cargo.toml Cargo.lock deploy/helm/ai-spel-rule-engine/Chart.yaml deploy/argocd/application.yaml
|
|
git commit -m "Release $version [auto-version-bump]"
|
|
git tag -a "v$version" -m "v$version"
|
|
git push origin HEAD:main "refs/tags/v$version"
|
|
echo "version=$version" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build and publish image and Helm chart
|
|
id: publish
|
|
if: ${{ startsWith(github.ref, 'refs/tags/') || steps.bump.outputs.version != '' }}
|
|
shell: bash
|
|
env:
|
|
HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
|
|
HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
|
|
AUTO_RELEASE_VERSION: ${{ steps.bump.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
version="${AUTO_RELEASE_VERSION:-${GITHUB_REF_NAME#v}}"
|
|
printf '%s' "$HARBOR_PASSWORD" | docker login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
|
|
image="harbor.k3s.k0.nu/ai-spel/rule-engine:$version"
|
|
docker build --platform linux/amd64 --pull --tag "$image" .
|
|
docker image push "$image"
|
|
helm_version=v3.17.3
|
|
if ! command -v helm >/dev/null 2>&1; then
|
|
mkdir -p "$RUNNER_TEMP/helm" "$HOME/.local/bin"
|
|
archive="helm-${helm_version}-linux-amd64.tar.gz"
|
|
curl -fsSLo "$RUNNER_TEMP/helm/$archive" "https://get.helm.sh/$archive"
|
|
curl -fsSLo "$RUNNER_TEMP/helm/$archive.sha256sum" "https://get.helm.sh/$archive.sha256sum"
|
|
(cd "$RUNNER_TEMP/helm" && sha256sum -c "$archive.sha256sum")
|
|
tar -xzf "$RUNNER_TEMP/helm/$archive" -C "$RUNNER_TEMP/helm"
|
|
install "$RUNNER_TEMP/helm/linux-amd64/helm" "$HOME/.local/bin/helm"
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
fi
|
|
helm lint deploy/helm/ai-spel-rule-engine
|
|
package_dir="$(mktemp -d)"
|
|
trap 'rm -rf "$package_dir"' EXIT
|
|
helm package deploy/helm/ai-spel-rule-engine --destination "$package_dir" --version "$version" --app-version "$version"
|
|
printf '%s' "$HARBOR_PASSWORD" | helm registry login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
|
|
helm push "$package_dir/ai-spel-rule-engine-$version.tgz" oci://harbor.k3s.k0.nu/ai-spel
|
|
helm template ai-spel-rule-engine "$package_dir/ai-spel-rule-engine-$version.tgz" --namespace ai-spel > "$package_dir/manifest.yaml"
|
|
oras_version=1.2.3
|
|
mkdir -p "$RUNNER_TEMP/oras"
|
|
curl -fsSLo "$RUNNER_TEMP/oras/oras.tgz" "https://github.com/oras-project/oras/releases/download/v${oras_version}/oras_${oras_version}_linux_amd64.tar.gz"
|
|
echo 'b4efc97a91f471f323f193ea4b4d63d8ff443ca3aab514151a30751330852827 '"$RUNNER_TEMP/oras/oras.tgz" | sha256sum -c -
|
|
tar -xzf "$RUNNER_TEMP/oras/oras.tgz" -C "$RUNNER_TEMP/oras" oras
|
|
install "$RUNNER_TEMP/oras/oras" "$RUNNER_TEMP/oras-bin"
|
|
printf '%s' "$HARBOR_PASSWORD" | "$RUNNER_TEMP/oras-bin" login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
|
|
unset HARBOR_PASSWORD
|
|
"$RUNNER_TEMP/oras-bin" push --artifact-type application/vnd.ai-spel.kubernetes-manifest.v1 \
|
|
"harbor.k3s.k0.nu/ai-spel/rule-engine-manifest:$version" \
|
|
"$package_dir/manifest.yaml:application/yaml"
|
|
echo "version=$version" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Deploy rule engine through Argo CD
|
|
if: ${{ startsWith(github.ref, 'refs/tags/') || steps.bump.outputs.version != '' }}
|
|
shell: bash
|
|
env:
|
|
KUBECONFIG_B64: ${{ secrets.AI_SPEL_TEST_KUBECONFIG }}
|
|
AUTO_RELEASE_VERSION: ${{ steps.bump.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$KUBECONFIG_B64"
|
|
mkdir -p "$RUNNER_TEMP/kube"
|
|
printf '%s' "$KUBECONFIG_B64" | base64 -d > "$RUNNER_TEMP/kube/config"
|
|
chmod 600 "$RUNNER_TEMP/kube/config"
|
|
unset KUBECONFIG_B64
|
|
export KUBECONFIG="$RUNNER_TEMP/kube/config"
|
|
version="${AUTO_RELEASE_VERSION:-${GITHUB_REF_NAME#v}}"
|
|
if ! kubectl -n ai-spel get statefulset ai-spel-nats >/dev/null 2>&1 \
|
|
&& ! kubectl -n argocd get application ai-spel-rule-engine >/dev/null 2>&1; then
|
|
echo 'NATS is not installed yet. The backend release pipeline bootstraps NATS and this Argo Application.'
|
|
exit 0
|
|
fi
|
|
if ! kubectl -n argocd get application ai-spel-rule-engine >/dev/null 2>&1; then
|
|
echo 'The backend release pipeline owns first-time Argo Application creation; skipping this worker-only rollout.'
|
|
exit 0
|
|
fi
|
|
kubectl -n ai-spel rollout status statefulset/ai-spel-nats --timeout=10m
|
|
kubectl -n argocd patch application ai-spel-rule-engine --type merge -p "{\"spec\":{\"source\":{\"targetRevision\":\"$version\"}}}"
|
|
deadline=$((SECONDS + 600))
|
|
while (( SECONDS < deadline )); do
|
|
sync="$(kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.sync.status}')"
|
|
health="$(kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.health.status}')"
|
|
if [[ "$sync" == Synced && "$health" == Healthy ]]; then break; fi
|
|
sleep 5
|
|
done
|
|
[[ "$sync" == Synced && "$health" == Healthy ]] || {
|
|
echo "Argo CD did not reach Synced/Healthy for rule engine $version"
|
|
kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.conditions[*].message}'
|
|
exit 1
|
|
}
|
|
kubectl -n ai-spel rollout status deployment/ai-spel-rule-engine --timeout=10m
|
|
kubectl -n ai-spel get pods -l app.kubernetes.io/instance=ai-spel-rule-engine -o wide
|