try to build with openssl legacy provider #2702
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
name: Build and Deploy | |
on: | |
push: | |
branches: [feature/*, dev, test] | |
env: | |
REGISTRY: ghcr.io | |
REGISTRY_USERNAME: ${{ secrets.CONTAINER_REGISTRY_USERNAME }} | |
REGISTRY_PASSWORD: ${{ secrets.CONTAINER_REGISTRY_PASSWORD }} | |
jobs: | |
build: | |
runs-on: ubuntu-latest | |
steps: | |
- name: Docker meta | |
id: docker_meta | |
uses: docker/metadata-action@v3 | |
with: | |
images: ${{ env.REGISTRY }}/bcgov/api-services-portal/api-services-portal | |
- name: Set DEPLOY_ID which will deploy a custom deploy to 'dev' environment | |
run: | | |
echo '::set-output name=DEPLOY_ID::${{ steps.docker_meta.outputs.version }}' | |
echo '::set-output name=APP_VERSION::${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.version'] }}' | |
echo '::set-output name=APP_REVISION::${{ fromJSON(steps.docker_meta.outputs.json).labels['org.opencontainers.image.revision'] }}' | |
id: set-deploy-id | |
- name: Get deploy ID | |
run: echo "The DEPLOY_ID is ${{ steps.set-deploy-id.outputs.DEPLOY_ID }}" | |
- uses: actions/checkout@v2 | |
- name: Install oc | |
uses: redhat-actions/oc-installer@v1 | |
with: | |
version: '4.6' | |
- name: Authenticate to silver and set context | |
uses: redhat-actions/oc-login@v1 | |
with: | |
openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }} | |
openshift_token: ${{ secrets.OPENSHIFT_TOKEN }} | |
# Disables SSL cert checking. Use this if you don't have the certificate authority data. | |
insecure_skip_tls_verify: true | |
namespace: ${{ env.OPENSHIFT_NAMESPACE }} | |
- name: Login to DockerHub | |
uses: docker/login-action@v1 | |
with: | |
registry: ${{ env.REGISTRY }} | |
username: ${{ env.REGISTRY_USERNAME }} | |
password: ${{ env.REGISTRY_PASSWORD }} | |
- uses: actions/cache@v2 | |
with: | |
path: /tmp/.buildx-cache | |
key: ${{ runner.os }}-buildx-${{ github.sha }} | |
restore-keys: | | |
${{ runner.os }}-buildx- | |
- name: Set up Docker Buildx | |
id: buildx | |
uses: docker/setup-buildx-action@v1 | |
- name: Build | |
uses: docker/build-push-action@v2 | |
with: | |
cache-from: type=local,src=/tmp/.buildx-cache | |
cache-to: type=local,dest=/tmp/.buildx-cache | |
context: . | |
file: Dockerfile | |
tags: ${{ steps.docker_meta.outputs.tags }} | |
load: true | |
build-args: | | |
GITHUB_API_TOKEN=${{ secrets.CONTAINER_REGISTRY_PASSWORD }} | |
APP_VERSION=${{ steps.set-deploy-id.outputs.APP_VERSION }} | |
APP_REVISION=${{ steps.set-deploy-id.outputs.APP_REVISION }} | |
- name: Push | |
run: docker push ${{ steps.docker_meta.outputs.tags }} | |
- name: 'Get Helm' | |
if: github.ref != 'refs/heads/dev' | |
run: | | |
curl -L -O https://get.helm.sh/helm-v3.4.2-linux-amd64.tar.gz | |
tar -xf helm-v3.4.2-linux-amd64.tar.gz | |
- name: 'Deploy Database' | |
if: github.ref != 'refs/heads/dev' | |
run: | | |
export PATH=$PATH:`pwd`/linux-amd64 | |
echo ' | |
image: | |
registry: docker.pkg.github.com | |
repository: bcgov-dss/api-serv-infra/mongodb | |
tag: 5.0-7a639fba | |
pullPolicy: IfNotPresent | |
pullSecrets: | |
- dev-github-read-packages-creds | |
auth: | |
rootPassword: "s3cr3t" | |
serviceAccount: | |
create: false | |
name: asp-service-account | |
arbiter: | |
enabled: false | |
rbac: | |
create: true | |
updateStrategy: | |
type: RollingUpdate | |
rollingUpdate: | |
maxSurge: 0 | |
maxUnavailable: 100% | |
readinessProbe: | |
timeoutSeconds: 30 | |
periodSeconds: 120 | |
livenessProbe: | |
timeoutSeconds: 30 | |
periodSeconds: 120 | |
persistence: | |
enabled: true | |
size: 2Gi | |
resources: | |
requests: | |
cpu: 85m | |
memory: 480M | |
limits: | |
cpu: 300m | |
memory: 720M | |
podSecurityContext: | |
enabled: true | |
fsGroup: ${{ secrets.RUNNING_UID_GID }} | |
containerSecurityContext: | |
enabled: true | |
runAsUser: ${{ secrets.RUNNING_UID_GID }} | |
' > values.yaml | |
helm repo add bitnami https://charts.bitnami.com/bitnami | |
helm upgrade --install proto-asp-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}-db --version 12.1.31 -f values.yaml --history-max 3 bitnami/mongodb | |
- name: 'Deploy Backend' | |
if: github.ref != 'refs/heads/dev' | |
run: | | |
export PATH=$PATH:`pwd`/linux-amd64 | |
echo " | |
podAnnotations: | |
sha: $GITHUB_SHA | |
replicaCount: 1 | |
rollingUpdate: | |
maxUnavailable: 100% | |
maxSurge: 0% | |
image: | |
repository: ${{ env.REGISTRY }}/bcgov/api-services-portal/api-services-portal | |
tag: ${{ steps.set-deploy-id.outputs.DEPLOY_ID }} | |
pullPolicy: Always | |
imagePullSecrets: | |
- name: dev-github-read-packages-creds | |
podSecurityContext: | |
fsGroup: ${{ secrets.RUNNING_UID_GID }} | |
securityContext: | |
runAsUser: ${{ secrets.RUNNING_UID_GID }} | |
containerPort: 3000 | |
resources: | |
requests: | |
cpu: 20m | |
memory: 400M | |
limits: | |
cpu: 100m | |
memory: 800M | |
serviceAccount: | |
create: false | |
name: asp-service-account | |
oauthProxy: | |
enabled: true | |
image: | |
repository: ${{ env.REGISTRY }}/bcgov-dss/api-serv-infra/oauth2-proxy | |
tag: 7.2.1-8c743f0c | |
pullPolicy: IfNotPresent | |
config: | |
upstream: http://127.0.0.1:3000 | |
client-id: ${{ secrets.OIDC_CLIENT_ID }} | |
client-secret: ${{ secrets.OIDC_CLIENT_SECRET }} | |
oidc-issuer-url: ${{ secrets.OIDC_ISSUER }} | |
redirect-url: https://api-services-portal-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}.apps.silver.devops.gov.bc.ca/oauth2/callback | |
skip-auth-regex: '/login|/health|/public|/docs|/redirect|/_next|/images|/devportal|/manager|/about|/maintenance|/admin/session|/ds/api|/feed/|/signout|/content|^[/]$' | |
whitelist-domain: authz-apps-gov-bc-ca.dev.api.gov.bc.ca | |
skip-provider-button: 'true' | |
profile-url: ${{ secrets.OIDC_ISSUER }}/protocol/openid-connect/userinfo | |
insecure-oidc-allow-unverified-email: 'true' | |
oidc-email-claim: 'sub' | |
pass-basic-auth: 'false' | |
pass-access-token: 'true' | |
set-xauthrequest: 'true' | |
skip-jwt-bearer-tokens: 'false' | |
set-authorization-header: 'false' | |
pass-authorization-header: 'false' | |
env: | |
SESSION_SECRET: | |
value: '234873290483290' | |
secure: true | |
AUTH_STRATEGY: | |
value: Oauth2Proxy | |
KONG_URL: | |
value: '${{ secrets.KONG_URL_DEV}}' | |
MONGO_URL: | |
value: 'mongodb://proto-asp-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}-db-mongodb:27017' | |
MONGO_USER: | |
value: root | |
secure: true | |
MONGO_PASSWORD: | |
value: s3cr3t | |
secure: true | |
FEEDER_URL: | |
value: 'http://proto-asp-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}-feeder-generic-api' | |
GITHUB_API_TOKEN: | |
value: '${{ secrets.GH_TOKEN_FOR_CONTENT}}' | |
secure: true | |
OIDC_ISSUER: | |
value: '${{ secrets.OIDC_ISSUER }}' | |
JWKS_URL: | |
value: '${{ secrets.OIDC_ISSUER }}/protocol/openid-connect/certs' | |
EXTERNAL_URL: | |
value: 'https://api-services-portal-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}.apps.silver.devops.gov.bc.ca' | |
SSR_API_ROOT: | |
value: 'http://localhost:7999' | |
NEXT_PUBLIC_API_ROOT: | |
value: 'https://api-services-portal-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}.apps.silver.devops.gov.bc.ca' | |
NEXT_PUBLIC_GRAFANA_URL: | |
value: 'https://grafana-apps-gov-bc-ca.dev.api.gov.bc.ca' | |
NEXT_PUBLIC_KUBE_CLUSTER: | |
value: 'feature-silver' | |
NEXT_PUBLIC_HELP_DESK_URL: | |
value: 'https://dpdd.atlassian.net/servicedesk/customer/portal/1/group/2' | |
NEXT_PUBLIC_HELP_CHAT_URL: | |
value: 'https://chat.developer.gov.bc.ca/channel/aps-ops' | |
NEXT_PUBLIC_HELP_ISSUE_URL: | |
value: 'https://github.com/bcgov/api-services-portal/issues' | |
NEXT_PUBLIC_HELP_API_DOCS_URL: | |
value: '/ds/api/v3/console/' | |
NEXT_PUBLIC_HELP_SUPPORT_URL: | |
value: 'https://developer.gov.bc.ca/docs/default/component/aps-infra-platform-docs/' | |
NEXT_PUBLIC_HELP_RELEASE_URL: | |
value: 'https://developer.gov.bc.ca/docs/default/component/aps-infra-platform-docs/reference/releases/' | |
NEXT_PUBLIC_HELP_STATUS_URL: | |
value: 'https://uptime.com/s/bcgov-dss' | |
NEXT_PUBLIC_DEVELOPER_IDS: | |
value: 'idir,bceid,bcsc,github' | |
NEXT_PUBLIC_PROVIDER_IDS: | |
value: 'idir' | |
NEXT_PUBLIC_ACCOUNT_BCEID_URL: | |
value: 'https://www.test.bceid.ca/logon.aspx?returnUrl=/profile_management' | |
NEXT_PUBLIC_ACCOUNT_BCSC_URL: | |
value: 'https://id.gov.bc.ca/account/' | |
GWA_API_URL: | |
value: 'https://gwa-api-gov-bc-ca.dev.api.gov.bc.ca' | |
GWA_PROD_ENV_SLUG: | |
value: 'FB000000' | |
GWA_RES_SVR_CLIENT_ID: | |
value: '${{ secrets.OIDC_CLIENT_ID }}' | |
secure: true | |
GWA_RES_SVR_CLIENT_SECRET: | |
value: '${{ secrets.OIDC_CLIENT_SECRET }}' | |
secure: true | |
KEYCLOAK_AUTH_URL: | |
value: '${{ secrets.KEYCLOAK_AUTH }}' | |
KEYCLOAK_REALM: | |
value: '${{ secrets.KEYCLOAK_REALM }}' | |
COOKIE_SECURE: | |
value: 'true' | |
LOG_LEVEL: | |
value: 'debug' | |
DISABLE_LOGGING: | |
value: 'true' | |
EMAIL_ENABLED: | |
value: 'true' | |
EMAIL_FROM: | |
value: '[email protected]' | |
EMAIL_HOST: | |
value: 'apps.smtp.gov.bc.ca' | |
readinessProbe: | |
exec: | |
command: | |
- sh | |
- -c | |
- 'state=\$(curl -XGET -m 2 --silent -f -H \"Accept: application/json\" http://localhost:3000/health | jq -r \".status | ascii_downcase\"); if [ ! \"\$state\" == \"ready\" ]; then exit 1; fi' | |
timeoutSeconds: 3 | |
periodSeconds: 10 | |
" > values.yaml | |
helm repo add bcgov http://bcgov.github.io/helm-charts | |
helm upgrade --install proto-asp-${{ steps.set-deploy-id.outputs.DEPLOY_ID }} -f values.yaml --history-max 3 bcgov/generic-api | |
- name: 'Deploy Routes' | |
if: github.ref != 'refs/heads/dev' | |
run: | | |
export PATH=$PATH:`pwd`/linux-amd64 | |
echo " | |
routes: | |
- host: api-services-portal-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}.apps.silver.devops.gov.bc.ca | |
targetPort: http | |
service: proto-asp-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}-generic-api | |
wildcardPolicy: None | |
tls: | |
termination: edge | |
" > values.yaml | |
helm repo add bcgov http://bcgov.github.io/helm-charts | |
helm upgrade --install proto-asp-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}-routes -f values.yaml --history-max 3 bcgov/ocp-route | |
- name: 'Seed Data' | |
if: github.ref != 'refs/heads/dev' | |
run: | | |
export PATH=$PATH:`pwd`/linux-amd64 | |
cd .github/workflows | |
SERVICE=proto-asp-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}-feeder-generic-api \ | |
PORTAL_URL=https://api-services-portal-${{ steps.set-deploy-id.outputs.DEPLOY_ID }}.apps.silver.devops.gov.bc.ca \ | |
OIDC_ISSUER=${{ secrets.OIDC_ISSUER }} \ | |
OIDC_CLIENT_ID=${{ secrets.OIDC_CLIENT_ID }} \ | |
OIDC_CLIENT_SECRET=${{ secrets.OIDC_CLIENT_SECRET }} \ | |
./scripts/init.sh | |
- name: Authenticate to Gold and set context | |
if: github.ref == 'refs/heads/test' | |
uses: redhat-actions/oc-login@v1 | |
with: | |
openshift_server_url: ${{ secrets.OPENSHIFT_GOLD_SERVER }} | |
openshift_token: ${{ secrets.OPENSHIFT_GOLD_TOKEN }} | |
insecure_skip_tls_verify: true | |
namespace: ${{ secrets.OPENSHIFT_GOLD_TEST_NAMESPACE }} | |
- name: 'Restart Portal in Gold Test Namespace' | |
if: github.ref == 'refs/heads/test' | |
run: | | |
oc rollout restart deployment/bcgov-aps-portal-generic-api -n ${{ secrets.OPENSHIFT_GOLD_TEST_NAMESPACE }} | |
oc rollout restart deployment/bcgov-aps-portal-batch-generic-api -n ${{ secrets.OPENSHIFT_GOLD_TEST_NAMESPACE }} | |
- name: 'Create Pull Request for Release' | |
if: github.ref == 'refs/heads/test' | |
uses: actions/github-script@v6 | |
with: | |
script: | | |
const { repo, owner } = context.repo; | |
const openPrs = await github.rest.pulls.list({ | |
owner, | |
repo, | |
head: '${{ github.ref_name }}', | |
base: 'main', | |
state: 'open' | |
}) | |
if(openPrs.data.length === 0){ | |
await github.rest.pulls.create({ | |
title: 'Create Latest Release', | |
owner, | |
repo, | |
head: '${{ github.ref_name }}', | |
base: 'main', | |
body: [ | |
'This Pull Request is auto-created by [actions/github-script](https://github.com/actions/github-script).', | |
'Please update this PR with appropriate labels to target specific type of release' | |
].join('\n\n'), | |
draft: true | |
}); | |
} else { | |
console.log("There is already an open Pull Request in place.\n") | |
openPrs.data.forEach((item) => { | |
console.log(item.html_url) | |
}) | |
} |