From 322bfd9be1fe071c696d6dbc8d5af9f7e50cd310 Mon Sep 17 00:00:00 2001 From: Jun-te Kim Date: Thu, 22 Jan 2026 00:36:02 +0000 Subject: [PATCH] propogate --- .github/workflows/stripe-to-invoice.yml | 266 +++++------------------- 1 file changed, 48 insertions(+), 218 deletions(-) diff --git a/.github/workflows/stripe-to-invoice.yml b/.github/workflows/stripe-to-invoice.yml index 7dbb4b7..6f33510 100644 --- a/.github/workflows/stripe-to-invoice.yml +++ b/.github/workflows/stripe-to-invoice.yml @@ -10,13 +10,15 @@ on: - "*" workflow_dispatch: +env: + POSTGRES_DB: stripe_invoice + jobs: # -------------------------------------------------- # BUILD IMAGE # -------------------------------------------------- build: runs-on: ubuntu-22.04 - steps: - uses: actions/checkout@v4 @@ -41,44 +43,18 @@ jobs: tags: docker.io/kimjunte/stripe_to_invoice:${{ env.GITHUB_REF_SLUG }} # -------------------------------------------------- - # DEPLOY POSTGRES (DEV + PROD) + # DEPLOY POSTGRES # -------------------------------------------------- deploy-db: - name: Deploy Postgres (PV + PVC + Deployment) runs-on: mealcraft-runners needs: build - steps: - uses: actions/checkout@v4 - - - name: Install kubectl - run: | - sudo apt-get update - sudo apt-get install -y curl ca-certificates gettext - curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" - sudo install -m 0755 kubectl /usr/local/bin/kubectl - - - name: Configure kubeconfig (in-cluster) - run: | - KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT" - SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) - CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt - - kubectl config set-cluster microk8s \ - --server="$KUBE_HOST" \ - --certificate-authority="$CA_CERT" - - kubectl config set-credentials runner --token="$SA_TOKEN" - - kubectl config set-context runner-context \ - --cluster=microk8s \ - --user=runner - - kubectl config use-context runner-context + - uses: ./.github/actions/kubectl-setup - name: Decide environment run: | - if [[ "$GITHUB_REF" == refs/heads/main || "$GITHUB_REF" == refs/tags/* || "$GITHUB_REF" == refs/heads/release/* ]]; then + if [[ "$GITHUB_REF" == refs/heads/release/* || "$GITHUB_REF" == refs/tags/* ]]; then echo "ENV=prod" >> $GITHUB_ENV echo "NAMESPACE=default" >> $GITHUB_ENV echo "PG_VOLUME=stripe_invoice_prod" >> $GITHUB_ENV @@ -93,57 +69,26 @@ jobs: export ENV NAMESPACE PG_VOLUME envsubst < db/k8s/postgres/stripe-to-invoice-db.yaml | kubectl apply -f - - # -------------------------------------------------- # APPLY DB + APP SECRETS # -------------------------------------------------- secrets: - name: Apply runtime secrets runs-on: mealcraft-runners needs: deploy-db - steps: - uses: actions/checkout@v4 - - - name: Install kubectl - run: | - sudo apt-get update - sudo apt-get install -y curl ca-certificates gettext - curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" - sudo install -m 0755 kubectl /usr/local/bin/kubectl - - - name: Configure kubeconfig (in-cluster) - run: | - KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT" - SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) - CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt - - kubectl config set-cluster microk8s \ - --server="$KUBE_HOST" \ - --certificate-authority="$CA_CERT" - - kubectl config set-credentials runner --token="$SA_TOKEN" - - kubectl config set-context runner-context \ - --cluster=microk8s \ - --user=runner - - kubectl config use-context runner-context + - uses: ./.github/actions/kubectl-setup - name: Decide environment run: | - if [[ "$GITHUB_REF" == refs/heads/main || "$GITHUB_REF" == refs/tags/* || "$GITHUB_REF" == refs/heads/release/* ]]; then - echo "ENV=prod" >> $GITHUB_ENV - echo "NAMESPACE=default" >> $GITHUB_ENV - echo "RUNTIME_SECRET=postgres-prod" >> $GITHUB_ENV + if [[ "$ENV" == "prod" ]]; then echo "POSTGRES_HOST=postgres-prod.default.svc.cluster.local" >> $GITHUB_ENV - echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV + echo "RUNTIME_SECRET=postgres-prod" >> $GITHUB_ENV + echo "NAMESPACE=default" >> $GITHUB_ENV else - echo "ENV=dev" >> $GITHUB_ENV - echo "NAMESPACE=dev" >> $GITHUB_ENV - echo "RUNTIME_SECRET=postgres-dev" >> $GITHUB_ENV echo "POSTGRES_HOST=postgres-dev.dev.svc.cluster.local" >> $GITHUB_ENV - echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV + echo "RUNTIME_SECRET=postgres-dev" >> $GITHUB_ENV + echo "NAMESPACE=dev" >> $GITHUB_ENV fi - name: Apply DB secret @@ -155,159 +100,66 @@ jobs: if [[ "$ENV" == "prod" ]]; then USER="$PROD_POSTGRES_USER" PASS="$PROD_POSTGRES_PASSWORD" - RUNTIME_SECRET=postgres-prod - NAMESPACE=default else USER="$DEV_POSTGRES_USER" PASS="$DEV_POSTGRES_PASSWORD" - RUNTIME_SECRET=postgres-dev - NAMESPACE=dev fi DATABASE_URL="postgres://${USER}:${PASS}@${POSTGRES_HOST}:5432/${POSTGRES_DB}?sslmode=disable" - kubectl create secret generic $RUNTIME_SECRET \ - --namespace $NAMESPACE \ + kubectl create secret generic "$RUNTIME_SECRET" \ + -n "$NAMESPACE" \ + --from-literal=DATABASE_URL="$DATABASE_URL" \ --from-literal=POSTGRES_USER="$USER" \ --from-literal=POSTGRES_PASSWORD="$PASS" \ --from-literal=POSTGRES_DB="$POSTGRES_DB" \ - --from-literal=DATABASE_URL="$DATABASE_URL" \ --dry-run=client -o yaml | kubectl apply -f - - - name: Apply app secrets run: | - set -e set -a source stripe_to_invoice/deployment/secrets/.env set +a if [[ "$ENV" == "prod" ]]; then - NAMESPACE=default - STRIPE_SECRET_KEY="$PROD_STRIPE_SECRET_KEY" - STRIPE_CLIENT_ID="$PROD_STRIPE_CLIENT_ID" - STRIPE_REDIRECT_URI="$PROD_STRIPE_REDIRECT_URI" - APP_URL="$PROD_APP_URL" - XERO_CLIENT_ID="$PROD_XERO_CLIENT_ID" - XERO_CLIENT_SECRET="$PROD_XERO_SECRET_KEY" - XERO_REDIRECT_URI="$PROD_XERO_REDIRECT_URI" - AWS_REGION="$PROD_AWS_REGION" - STRIPE_WEBHOOK_SECRET="$PROD_STRIPE_WEBHOOK_SECRET" - SES_FROM_EMAIL="$PROD_SES_FROM_EMAIL" + export STRIPE_SECRET_KEY="$PROD_STRIPE_SECRET_KEY" + export STRIPE_CLIENT_ID="$PROD_STRIPE_CLIENT_ID" + export STRIPE_REDIRECT_URI="$PROD_STRIPE_REDIRECT_URI" + export APP_URL="$PROD_APP_URL" + export XERO_CLIENT_ID="$PROD_XERO_CLIENT_ID" + export XERO_CLIENT_SECRET="$PROD_XERO_SECRET_KEY" + export XERO_REDIRECT_URI="$PROD_XERO_REDIRECT_URI" + export AWS_REGION="$PROD_AWS_REGION" + export STRIPE_WEBHOOK_SECRET="$PROD_STRIPE_WEBHOOK_SECRET" + export SES_FROM_EMAIL="$PROD_SES_FROM_EMAIL" else - STRIPE_SECRET_KEY="$DEV_STRIPE_SECRET_KEY" - STRIPE_CLIENT_ID="$DEV_STRIPE_CLIENT_ID" - STRIPE_REDIRECT_URI="$DEV_STRIPE_REDIRECT_URI" - APP_URL="$DEV_APP_URL" - XERO_CLIENT_ID="$DEV_XERO_CLIENT_ID" - XERO_CLIENT_SECRET="$DEV_XERO_SECRET_KEY" - XERO_REDIRECT_URI="$DEV_XERO_REDIRECT_URI" - AWS_REGION="$DEV_AWS_REGION" - STRIPE_WEBHOOK_SECRET="$DEV_STRIPE_WEBHOOK_SECRET" - SES_FROM_EMAIL="$DEV_SES_FROM_EMAIL" + export STRIPE_SECRET_KEY="$DEV_STRIPE_SECRET_KEY" + export STRIPE_CLIENT_ID="$DEV_STRIPE_CLIENT_ID" + export STRIPE_REDIRECT_URI="$DEV_STRIPE_REDIRECT_URI" + export APP_URL="$DEV_APP_URL" + export XERO_CLIENT_ID="$DEV_XERO_CLIENT_ID" + export XERO_CLIENT_SECRET="$DEV_XERO_SECRET_KEY" + export XERO_REDIRECT_URI="$DEV_XERO_REDIRECT_URI" + export AWS_REGION="$DEV_AWS_REGION" + export STRIPE_WEBHOOK_SECRET="$DEV_STRIPE_WEBHOOK_SECRET" + export SES_FROM_EMAIL="$DEV_SES_FROM_EMAIL" fi - : "${STRIPE_SECRET_KEY:?missing STRIPE_SECRET_KEY}" - : "${STRIPE_CLIENT_ID:?missing STRIPE_CLIENT_ID}" - : "${APP_URL:?missing APP_URL}" - : "${STRIPE_REDIRECT_URI:?missing STRIPE_REDIRECT_URI}" - : "${XERO_CLIENT_ID:?missing XERO_CLIENT_ID}" - : "${XERO_CLIENT_SECRET:?missing XERO_CLIENT_SECRET}" - : "${XERO_REDIRECT_URI:?missing XERO_REDIRECT_URI}" - : "${AWS_REGION:?missing AWS_REGION}" - : "${SES_FROM_EMAIL:?missing SES_FROM_EMAIL}" - - export \ - STRIPE_SECRET_KEY \ - STRIPE_CLIENT_ID \ - STRIPE_REDIRECT_URI \ - APP_URL \ - XERO_CLIENT_ID \ - XERO_CLIENT_SECRET \ - XERO_REDIRECT_URI \ - AWS_REGION \ - STRIPE_WEBHOOK_SECRET \ - SES_FROM_EMAIL \ - NAMESPACE - - envsubst < stripe_to_invoice/deployment/secrets/stripe-secrets.yaml \ - | kubectl apply -f - + envsubst < stripe_to_invoice/deployment/secrets/stripe-secrets.yaml | kubectl apply -f - # -------------------------------------------------- # RUN ATLAS MIGRATIONS # -------------------------------------------------- migrate: - name: Run DB migrations (Atlas) runs-on: mealcraft-runners needs: secrets - steps: - uses: actions/checkout@v4 - - - name: Install Atlas - uses: ariga/setup-atlas@v0 - - - name: Install kubectl - run: | - sudo apt-get update - sudo apt-get install -y curl ca-certificates gettext - curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" - sudo install -m 0755 kubectl /usr/local/bin/kubectl - - - name: Configure kubeconfig (in-cluster) - run: | - KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT" - SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) - CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt - - kubectl config set-cluster microk8s \ - --server="$KUBE_HOST" \ - --certificate-authority="$CA_CERT" - - kubectl config set-credentials runner --token="$SA_TOKEN" - - kubectl config set-context runner-context \ - --cluster=microk8s \ - --user=runner - - kubectl config use-context runner-context - - - - name: Install netcat - run: | - sudo apt-get update - sudo apt-get install -y netcat-openbsd + - uses: ariga/setup-atlas@v0 + - uses: ./.github/actions/kubectl-setup - name: Decide environment run: | - if [[ "$GITHUB_REF" == refs/heads/main || "$GITHUB_REF" == refs/tags/* || "$GITHUB_REF" == refs/heads/release/* ]]; then - echo "ENV=prod" >> $GITHUB_ENV - echo "POSTGRES_HOST=postgres-prod.default.svc.cluster.local" >> $GITHUB_ENV - echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV - else - echo "ENV=dev" >> $GITHUB_ENV - echo "POSTGRES_HOST=postgres-dev.dev.svc.cluster.local" >> $GITHUB_ENV - echo "POSTGRES_DB=stripe_invoice" >> $GITHUB_ENV - fi - - - name: Wait for Postgres TCP - run: | - set -e - for i in {1..30}; do - if nc -z "$POSTGRES_HOST" 5432; then - echo "Postgres is accepting connections" - exit 0 - fi - echo "Waiting for Postgres ($i/30)..." - sleep 5 - done - echo "Postgres never became ready" - exit 1 - - - name: Run migrations (using K8s secret) - run: | - set -e - if [[ "$ENV" == "prod" ]]; then SECRET=postgres-prod NAMESPACE=default @@ -315,12 +167,15 @@ jobs: SECRET=postgres-dev NAMESPACE=dev fi + echo "SECRET=$SECRET" >> $GITHUB_ENV + echo "NAMESPACE=$NAMESPACE" >> $GITHUB_ENV - DATABASE_URL=$(kubectl get secret "$SECRET" \ - -n "$NAMESPACE" \ + - name: Run migrations + run: | + DATABASE_URL=$(kubectl get secret "$SECRET" -n "$NAMESPACE" \ -o jsonpath='{.data.DATABASE_URL}' | base64 -d) - echo "Running Atlas migrations against $POSTGRES_HOST" + echo "$DATABASE_URL" | sed -E 's#(postgres://[^:]+:)[^@]+#\1****#' atlas migrate apply \ --dir file://db/atlas/stripe_invoice/migrations \ @@ -331,39 +186,15 @@ jobs: # -------------------------------------------------- deploy: runs-on: mealcraft-runners - needs: - - build - - secrets - - migrate - + needs: [build, secrets, migrate] steps: - uses: actions/checkout@v4 - - - name: Install kubectl - run: | - sudo apt-get update - sudo apt-get install -y curl ca-certificates gettext - curl -LO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" - sudo install -m 0755 kubectl /usr/local/bin/kubectl - - - name: Configure kubeconfig (in-cluster) - run: | - KUBE_HOST="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT" - SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) - CA_CERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt - NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace) - - kubectl config set-cluster microk8s --server="$KUBE_HOST" --certificate-authority="$CA_CERT" - kubectl config set-credentials runner --token="$SA_TOKEN" - kubectl config set-context runner-context --cluster=microk8s --user=runner --namespace="$NAMESPACE" - kubectl config use-context runner-context - - - name: Inject slug variables - uses: rlespinasse/github-slug-action@v4 + - uses: ./.github/actions/kubectl-setup + - uses: rlespinasse/github-slug-action@v4 - name: Decide environment run: | - if [[ "$GITHUB_REF" == refs/heads/release/* || "$GITHUB_REF" == refs/tags/* ]]; then + if [[ "$ENV" == "prod" ]]; then echo "NAMESPACE=default" >> $GITHUB_ENV echo "DB_ENV=prod" >> $GITHUB_ENV echo "HOSTNAME=stripe-to-invoice.juntekim.com" >> $GITHUB_ENV @@ -376,5 +207,4 @@ jobs: - name: Deploy application run: | export IMAGE="docker.io/kimjunte/stripe_to_invoice:$GITHUB_REF_SLUG" - export NAMESPACE DB_ENV HOSTNAME envsubst < stripe_to_invoice/deployment/deployment.yaml | kubectl apply -f -