aurask/.gitea/workflows/aurask-release.yml

name: aurask-release

on:
  push:
    branches:
      - master
    paths:
      - .gitea/workflows/aurask-release.yml
      - deploy/images/aurask-api/**
      - deploy/images/aurask-web/**
      - deploy/k3s/base/**
      - src/aurask/**
      - tests/**
      - pyproject.toml
      - README.md
      - AGENTS.md
      - Aurask_Technical_Operations_Plan.md
  workflow_dispatch:

permissions:
  contents: read

env:
  REGISTRY_HOST: registry.mydevcloud.love
  REGISTRY_NAMESPACE: devcloud
  DEPLOY_HOST: 64.90.15.15
  DEPLOY_USER: root
  AURASK_NAMESPACE: aurask

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Install job dependencies
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install -y docker.io openssh-client curl          

      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run unit tests
        env:
          PYTHONPATH: src
        run: |
          python3 -m unittest discover -s tests -v          

      - name: Prepare SSH key
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts          

      - name: Login private registry
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY_HOST}" --username "${{ secrets.REGISTRY_USER }}" --password-stdin          

      - name: Build and push aurask-api image
        run: |
          api_image="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/aurask-api"
          docker build -t "${api_image}:${GITHUB_SHA}" -t "${api_image}:latest" -f deploy/images/aurask-api/Dockerfile .
          docker push "${api_image}:${GITHUB_SHA}"
          docker push "${api_image}:latest"          

      - name: Build and push aurask-web image
        run: |
          web_image="${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/aurask-web"
          docker build -t "${web_image}:${GITHUB_SHA}" -t "${web_image}:latest" deploy/images/aurask-web
          docker push "${web_image}:${GITHUB_SHA}"
          docker push "${web_image}:latest"          

      - name: Deploy aurask base manifests
        run: |
          scp -i ~/.ssh/id_ed25519 -r deploy/k3s/base "${DEPLOY_USER}@${DEPLOY_HOST}:/tmp/aurask-release"
          ssh -i ~/.ssh/id_ed25519 "${DEPLOY_USER}@${DEPLOY_HOST}" "
            set -euo pipefail
            kubectl create namespace ${AURASK_NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -
            kubectl -n ${AURASK_NAMESPACE} create secret docker-registry devcloud-registry \
              --docker-server=${REGISTRY_HOST} \
              --docker-username='${{ secrets.REGISTRY_USER }}' \
              --docker-password='${{ secrets.REGISTRY_PASSWORD }}' \
              --dry-run=client -o yaml | kubectl apply -f -
            kubectl apply -k /tmp/aurask-release
            kubectl -n ${AURASK_NAMESPACE} set image deployment/aurask-api api=${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/aurask-api:${GITHUB_SHA}
            kubectl -n ${AURASK_NAMESPACE} set image deployment/aurask-web web=${REGISTRY_HOST}/${REGISTRY_NAMESPACE}/aurask-web:${GITHUB_SHA}
            kubectl -n ${AURASK_NAMESPACE} rollout status deployment/aurask-api --timeout=600s
            kubectl -n ${AURASK_NAMESPACE} rollout status deployment/aurask-web --timeout=600s
            kubectl -n ${AURASK_NAMESPACE} get pods -o wide
          "