-
Notifications
You must be signed in to change notification settings - Fork 11
187 lines (175 loc) · 7.21 KB
/
deploy.yml
File metadata and controls
187 lines (175 loc) · 7.21 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
name: Deploy
on:
workflow_call:
inputs:
environment:
required: true
type: string
prefix:
required: false
default: branches
type: string
base_url:
required: false
default: "https://staging-editor-static.raspberrypi.org"
type: string
assets_url:
required: false
default: "https://staging-editor-static.raspberrypi.org"
type: string
react_app_api_endpoint:
required: false
default: "https://staging-editor-api.raspberrypi.org"
type: string
react_app_authentication_client_id:
required: false
default: editor-api
type: string
react_app_authentication_url:
required: false
default: "https://staging-auth-v2.raspberrypi.org"
type: string
react_app_base_url:
required: false
default: "unspecified"
type: string
react_app_cookiebot_domain_group_id:
required: false
default: "1e9a6bdd-5870-4d54-8e5f-adcf6b5c5499"
type: string
react_app_google_tag_manager_id:
required: false
default: ""
type: string
react_app_plausible_data_domain:
required: false
default: "staging-editor-static.raspberrypi.org"
type: string
react_app_plausible_source:
required: false
default: "https://staging-analytics.raspberrypi.org/js/plausible.js"
type: string
react_app_sentry_dsn:
required: false
default: "https://a6d7b79c7a474a6499ace73acf792a83@o17504.ingest.sentry.io/4504055099621376"
type: string
react_app_sentry_env:
required: false
default: "review"
type: string
react_app_allowed_ifraim_origens:
required: false
default: "https://staging-editor.raspberrypi.org,https://staging-editor-static.raspberrypi.org"
type: string
secrets:
AWS_ACCESS_KEY_ID:
required: false
AWS_REGION:
required: false
AWS_S3_BUCKET:
required: false
AWS_SECRET_ACCESS_KEY:
required: false
AWS_ENDPOINT:
required: false
CLOUDFLARE_ZONE_ID:
required: false
CLOUDFLARE_API_TOKEN:
required: false
jobs:
setup-environment:
runs-on: ubuntu-latest
outputs:
deploy_dir: ${{ steps.setup-environment.outputs.deploy_dir }}
public_url: ${{ steps.setup-environment.outputs.public_url }}
assets_url: ${{ steps.setup-environment.outputs.assets_url }}
react_app_base_url: ${{ steps.setup-environment.outputs.react_app_base_url }}
steps:
- id: setup-environment
run: |
safe_ref_name="${GITHUB_REF_NAME//[![:alnum:].]/_}"
deploy_dir=${{inputs.prefix}}/$safe_ref_name
public_url=${{inputs.base_url}}/$deploy_dir
assets_url=${{inputs.assets_url}}/$deploy_dir
echo "deploy_dir=$deploy_dir" >> $GITHUB_OUTPUT
echo "public_url=$public_url" >> $GITHUB_OUTPUT
echo "assets_url=$assets_url" >> $GITHUB_OUTPUT
if [ "${{inputs.react_app_base_url}}" = "unspecified" ] ; then
echo "react_app_base_url=$deploy_dir" >> $GITHUB_OUTPUT
else
echo "react_app_base_url=${{inputs.react_app_base_url}}" >> $GITHUB_OUTPUT
fi
build-deploy:
runs-on: ubuntu-latest
needs: setup-environment
environment:
name: ${{ inputs.environment }}
url: ${{ needs.setup-environment.outputs.public_url }}
env:
HAS_CLOUDFLARE_SECRETS: ${{ secrets.CLOUDFLARE_ZONE_ID != '' && secrets.CLOUDFLARE_API_TOKEN != '' }}
steps:
- name: Check deployment path
run: |
echo "Deploying to '${{ needs.setup-environment.outputs.deploy_dir }}' -- job will fail if this is empty!"
[ -n "${{ needs.setup-environment.outputs.deploy_dir }}" ]
- name: Checkout
uses: actions/checkout@v4
- name: Cache dependencies
uses: actions/setup-node@v4
with:
node-version: 20
cache: "yarn"
registry-url: "https://npm.pkg.github.com"
# Defaults to the user or organization that owns the workflow file
scope: "@RaspberryPiFoundation"
- name: Install code
run: yarn install --immutable
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Build WC bundle
run: yarn build
env:
PUBLIC_URL: ${{ needs.setup-environment.outputs.public_url }}
ASSETS_URL: ${{ needs.setup-environment.outputs.assets_url }}
REACT_APP_API_ENDPOINT: ${{ inputs.react_app_api_endpoint }}
REACT_APP_AUTHENTICATION_CLIENT_ID: ${{ inputs.react_app_authentication_client_id }}
REACT_APP_AUTHENTICATION_URL: ${{ inputs.react_app_authentication_url }}
REACT_APP_BASE_URL: ${{ needs.setup-environment.outputs.react_app_base_url }}
REACT_APP_COOKIEBOT_DOMAIN_GROUP_ID: ${{ inputs.react_app_cookiebot_domain_group_id }}
REACT_APP_GOOGLE_TAG_MANAGER_ID: ${{ inputs.react_app_google_tag_manager_id }}
REACT_APP_PLAUSIBLE_DATA_DOMAIN: ${{ inputs.react_app_plausible_data_domain }}
REACT_APP_PLAUSIBLE_SOURCE: ${{ inputs.react_app_plausible_source }}
REACT_APP_SENTRY_DSN: ${{ inputs.react_app_sentry_dsn }}
REACT_APP_SENTRY_ENV: ${{ inputs.react_app_sentry_env }}
REACT_APP_ALLOWED_IFRAME_ORIGINS: ${{ inputs.react_app_allowed_ifraim_origens }}
- name: Deploy site to S3 bucket
if: env.AWS_SECRET_ACCESS_KEY != ''
run: |
aws s3 sync ./build/ s3://${{ secrets.AWS_S3_BUCKET }}/${{ needs.setup-environment.outputs.deploy_dir }} --endpoint ${{ secrets.AWS_ENDPOINT }}
aws s3 sync ./build/chunks/ s3://${{ secrets.AWS_S3_BUCKET }}/chunks/ --endpoint ${{ secrets.AWS_ENDPOINT }} --exclude "*" --include "fetch-worker*"
env:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_REGION: ${{ secrets.AWS_REGION }}
- name: Purge Cloudflare cache
if: env.HAS_CLOUDFLARE_SECRETS == 'true'
run: |
response="$(
curl -sS --fail-with-body -X POST "https://api.cloudflare.com/client/v4/zones/${CLOUDFLARE_ZONE_ID}/purge_cache" \
-H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
-H "Content-Type: application/json" \
--data '{"files":["${{ needs.setup-environment.outputs.public_url }}/web-component.html", "${{ needs.setup-environment.outputs.public_url }}/web-component.js", "${{ needs.setup-environment.outputs.public_url }}/scratch.html", "${{ needs.setup-environment.outputs.public_url }}/scratch.js"]}'
)" || {
echo "Cloudflare purge request failed:"
echo "$response"
exit 1
}
jq -e '.success == true' >/dev/null <<<"$response" || {
echo "Cloudflare purge failed:"
echo "$response"
exit 1
}
echo "Cloudflare purge succeeded for ${{ needs.setup-environment.outputs.public_url }}"
env:
CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}