Merge branch 'main' into EW-1021 #6144
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Auto-deployment for Branches | |
| on: | |
| push: | |
| branches-ignore: | |
| - dependabot/** | |
| pull_request: | |
| types: [labeled] | |
| permissions: | |
| contents: read | |
| jobs: | |
| branch_meta: | |
| # this basically means do not execute it as dependabot unless it is labeled as ready-for-ci | |
| # because automated processes and pr from forks are dangerous, therefore those prs won't have access to secrets, labeling them acts like allow-listing them | |
| # more details here https://docs.github.com/en/rest/dependabot/secrets?apiVersion=2022-11-28 | |
| # even when re-running an action manually the actor stays the same as of mid 2022, details here https://github.blog/changelog/2022-07-19-differentiating-triggering-actor-from-executing-actor/ | |
| #https://github.com/actions/runner/issues/1173#issuecomment-1354501147 when false equals true, you have to come up with something ... | |
| if: | | |
| (github.actor == 'dependabot[bot]' && | |
| contains(github.event.issue.labels.*.name, 'ready-for-ci') == 'true') || | |
| github.actor != 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| branch: ${{ steps.extract_branch_meta.outputs.branch }} | |
| sha: ${{ steps.extract_branch_meta.outputs.sha }} | |
| steps: | |
| - name: Extract branch meta | |
| shell: bash | |
| id: extract_branch_meta | |
| run: | | |
| if [ "${{ github.event_name }}" == 'pull_request' ]; then | |
| echo "branch=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT | |
| echo "sha=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT | |
| else | |
| echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT | |
| echo "sha=${{ github.sha }}" >> $GITHUB_OUTPUT | |
| fi | |
| deploy: | |
| needs: | |
| - branch_meta | |
| uses: ./.github/workflows/deploy.yml | |
| with: | |
| branch: ${{ needs.branch_meta.outputs.branch }} | |
| secrets: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| DEV_VAULT_BRB: ${{ secrets.DEV_VAULT_BRB }} | |
| DEV_VAULT_NBC: ${{ secrets.DEV_VAULT_NBC }} | |
| DEV_VAULT_THR: ${{ secrets.DEV_VAULT_THR }} | |
| DEV_VAULT_DBC: ${{ secrets.DEV_VAULT_DBC }} | |
| DEV_KUBE_CONFIG_BRB: ${{ secrets.DEV_KUBE_CONFIG_BRB }} | |
| DEV_KUBE_CONFIG_NBC: ${{ secrets.DEV_KUBE_CONFIG_NBC }} | |
| DEV_KUBE_CONFIG_THR: ${{ secrets.DEV_KUBE_CONFIG_THR }} | |
| DEV_KUBE_CONFIG_DBC: ${{ secrets.DEV_KUBE_CONFIG_DBC }} | |
| deploy-successful: | |
| needs: | |
| - deploy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "deploy was successful" |