Apollon/.github/workflows/deploy-prod.yml at main · ls1intum/Apollon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: Deploy to Production

on:
  workflow_dispatch:
    inputs:
      image-tag:
        type: string
        required: true
        description: "Image tag to deploy (e.g., 3.0.1 or sha-abc123)"
      deploy-app:
        type: boolean
        default: true
        description: (Re-)deploy server + webapp
      deploy-db:
        type: boolean
        default: false
        description: (Re-)deploy Redis database. Usually not necessary.
      deploy-proxy:
        type: boolean
        default: false
        description: (Re-)deploy Traefik reverse proxy. Usually not necessary.
  workflow_call:
    inputs:
      image-tag:
        type: string
        required: true
        description: "Image tag to deploy"
      deploy-app:
        type: boolean
        default: true
        description: (Re-)deploy server + webapp
      deploy-db:
        type: boolean
        default: false
        description: (Re-)deploy Redis database. Usually not necessary.
      deploy-proxy:
        type: boolean
        default: false
        description: (Re-)deploy Traefik reverse proxy. Usually not necessary.

concurrency:
  group: deploy-production
  cancel-in-progress: false

# The called deploy-docker-compose.yml jobs request contents:read + packages:read
# (GHCR image existence check). A called reusable workflow cannot request more
# than its caller grants, so an empty `{}` here fails the run at startup.
permissions:
  contents: read
  packages: read

jobs:
  deploy-db:
    if: ${{ inputs.deploy-db }}
    uses: ls1intum/.github/.github/workflows/deploy-docker-compose.yml@main
    with:
      environment: Production
      docker-compose-file: "./docker/compose.db.yml"
      main-image-name: ls1intum/apollon/server
      image-tag: ${{ inputs.image-tag }}
      deployment-base-path: "/opt/apollon/db"
    secrets: inherit

  deploy-proxy:
    if: ${{ inputs.deploy-proxy }}
    uses: ls1intum/.github/.github/workflows/deploy-docker-compose.yml@main
    with:
      environment: Production
      docker-compose-file: "./docker/compose.proxy.yml"
      main-image-name: ls1intum/apollon/server
      image-tag: ${{ inputs.image-tag }}
      deployment-base-path: "/opt/apollon/proxy"
    secrets: inherit

  deploy-app:
    if: ${{ inputs.deploy-app }}
    uses: ls1intum/.github/.github/workflows/deploy-docker-compose.yml@main
    with:
      environment: Production
      docker-compose-file: "./docker/compose.app.yml"
      main-image-name: ls1intum/apollon/server
      image-tag: ${{ inputs.image-tag }}
      deployment-base-path: "/opt/apollon/app"
    secrets: inherit

  # Publish the matching over-the-air web-bundle update for the mobile app right
  # after the web app is deployed ("deploy == OTA publish"). Opt-in: only runs
  # where the ENABLE_LIVE_UPDATE variable is "true", so operators who don't ship
  # a mobile app are unaffected.
  publish-live-update:
    needs: deploy-app
    if: ${{ inputs.deploy-app && vars.ENABLE_LIVE_UPDATE == 'true' }}
    uses: ./.github/workflows/ios-live-update.yml
    with:
      # Build the OTA bundle from the SAME commit as the deployed image, not from
      # whatever ref this workflow was dispatched on — otherwise a rollback or a
      # redeploy of an older `sha-<commit>` tag would ship a web bundle that does
      # not match the web app that just went live.
      source-ref: ${{ inputs.image-tag }}
    secrets: inherit