mirror of
https://github.com/trustgraph-ai/trustgraph.git
synced 2026-07-01 17:39:39 +02:00
76 lines
2.1 KiB
YAML
76 lines
2.1 KiB
YAML
|
|
name: Deploy to prod
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
# Deploys on master branch
|
|
branches:
|
|
- master
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: 'write'
|
|
packages: read
|
|
|
|
jobs:
|
|
|
|
deploy:
|
|
|
|
name: Deploy to prod
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Get version
|
|
id: version
|
|
run: echo VERSION=sha-$(git rev-parse --short HEAD) >> $GITHUB_OUTPUT
|
|
|
|
# Python package version MUST be a semantic version, but also doesn't
|
|
# matter, so just setting to 0.0.0.
|
|
# The container version MUST change on every push to get Cloud Run
|
|
# to re-deploy, so is based on git hash.
|
|
- name: Build container
|
|
run: make PACKAGE_VERSION=0.0.0 VERSION=${{ steps.version.outputs.VERSION }}
|
|
|
|
- name: Log in to the container registry
|
|
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- id: auth
|
|
name: Authenticate with Google Cloud
|
|
uses: google-github-actions/auth@v2
|
|
with:
|
|
token_format: access_token
|
|
workload_identity_provider: projects/351149249312/locations/global/workloadIdentityPools/deploy/providers/github
|
|
service_account: deploy@trustgraph-ai.iam.gserviceaccount.com
|
|
access_token_lifetime: 900s
|
|
create_credentials_file: true
|
|
|
|
- name: Login to Artifact Registry
|
|
uses: redhat-actions/podman-login@v1
|
|
with:
|
|
registry: europe-west1-docker.pkg.dev
|
|
username: oauth2accesstoken
|
|
password: ${{ steps.auth.outputs.access_token }}
|
|
|
|
- name: Install Pulumi
|
|
run: cd pulumi && npm install
|
|
|
|
- name: Applying infrastructure 🚀🙏
|
|
uses: pulumi/actions@v3
|
|
with:
|
|
command: up
|
|
stack-name: prod
|
|
work-dir: pulumi
|
|
cloud-url: gs://trustgraph-ai-deploy/config-svc
|
|
env:
|
|
PULUMI_CONFIG_PASSPHRASE: ""
|
|
IMAGE_VERSION: ${{ steps.version.outputs.VERSION }}
|
|
|