From bacd92f05daef9f6b9b1c3af13a773d6e6c9a130 Mon Sep 17 00:00:00 2001 From: Barcode Betty Date: Sun, 19 Apr 2026 12:44:33 +0000 Subject: [PATCH] feat: add CI workflow for build, push, and deploy - Build and push Docker image to GHCR on push to main/dev/uat - Generate CalVer tags on main branch - Auto-deploy to dev and uat overlays via infra repo Co-Authored-By: Paperclip --- .github/workflows/ci.yml | 172 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 172 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..d842735 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,172 @@ +name: CI + +on: + push: + branches: [main, dev, uat] + pull_request: + branches: [main, dev, uat] + +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: write + packages: write + security-events: write + +env: + REGISTRY: ghcr.io + IMAGE_NAME: cartsnitch/auth + +jobs: + build-and-push: + runs-on: runners-cartsnitch + if: github.event_name == 'push' + outputs: + calver_tag: ${{ steps.calver.outputs.version }} + sha_tag: sha-${{ github.sha }} + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Generate CalVer tag + id: calver + if: github.ref == 'refs/heads/main' + run: | + DATE_TAG=$(date -u +%Y.%m.%d) + EXISTING=$(git tag -l "v${DATE_TAG}*" | sort -V | tail -1) + if [ -z "$EXISTING" ]; then VERSION="$DATE_TAG" + elif [ "$EXISTING" = "v${DATE_TAG}" ]; then VERSION="${DATE_TAG}.2" + else BUILD_NUM=$(echo "$EXISTING" | sed "s/v${DATE_TAG}\.//"); VERSION="${DATE_TAG}.$((BUILD_NUM + 1))"; fi + echo "version=$VERSION" >> "$GITHUB_OUTPUT" + + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=sha,prefix=sha-,format=long + type=raw,value=${{ steps.calver.outputs.version }},enable=${{ github.ref == 'refs/heads/main' }} + type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }} + + - name: Build and push Docker image + uses: docker/build-push-action@v6 + with: + context: . + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Create git tag + if: github.ref == 'refs/heads/main' + run: | + git tag "v${{ steps.calver.outputs.version }}" + git push origin "v${{ steps.calver.outputs.version }}" + + deploy-dev: + runs-on: runners-cartsnitch + needs: [build-and-push] + if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main') + steps: + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.CARTSNITCH_APP_ID }} + private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: infra + + - uses: actions/checkout@v4 + with: + repository: cartsnitch/infra + token: ${{ steps.app-token.outputs.token }} + ref: main + path: infra + + - uses: imranismail/setup-kustomize@v2 + + - name: Determine image tag + id: tag + run: | + if [ "${{ github.ref }}" == "refs/heads/main" ]; then + echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" + else + echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" + fi + + - name: Update auth image tag in dev overlay + run: | + cd infra/apps/overlays/dev + kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.tag.outputs.tag }} + + - name: Commit and push to infra + run: | + cd infra + git config user.name "cartsnitch-ci[bot]" + git config user.email "cartsnitch-ci[bot]@users.noreply.github.com" + git add apps/overlays/dev/kustomization.yaml + git diff --cached --quiet && echo "No changes" && exit 0 + git commit -m "ci(dev): update auth image from cartsnitch/auth CI" + git pull --rebase origin main + git push origin main + + deploy-uat: + runs-on: runners-cartsnitch + needs: [build-and-push] + if: github.event_name == 'push' && (github.ref == 'refs/heads/uat' || github.ref == 'refs/heads/main') + steps: + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.CARTSNITCH_APP_ID }} + private-key: ${{ secrets.CARTSNITCH_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: infra + + - uses: actions/checkout@v4 + with: + repository: cartsnitch/infra + token: ${{ steps.app-token.outputs.token }} + ref: main + path: infra + + - uses: imranismail/setup-kustomize@v2 + + - name: Determine image tag + id: tag + run: | + if [ "${{ github.ref }}" == "refs/heads/main" ]; then + echo "tag=${{ needs.build-and-push.outputs.calver_tag }}" >> "$GITHUB_OUTPUT" + else + echo "tag=${{ needs.build-and-push.outputs.sha_tag }}" >> "$GITHUB_OUTPUT" + fi + + - name: Update auth image tag in uat overlay + run: | + cd infra/apps/overlays/uat + kustomize edit set image ghcr.io/cartsnitch/auth:${{ steps.tag.outputs.tag }} + + - name: Commit and push to infra + run: | + cd infra + git config user.name "cartsnitch-ci[bot]" + git config user.email "cartsnitch-ci[bot]@users.noreply.github.com" + git add apps/overlays/uat/kustomization.yaml + git diff --cached --quiet && echo "No changes" && exit 0 + git commit -m "ci(uat): update auth image from cartsnitch/auth CI" + git pull --rebase origin main + git push origin main \ No newline at end of file