generated from CDCgov/template
-
Notifications
You must be signed in to change notification settings - Fork 40
162 lines (146 loc) · 5.47 KB
/
validate_resources.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
name: Validate Resources
on:
pull_request:
branches:
- production
- main
- test
push:
branches:
- production
- main
- test
schedule:
- cron: "36 3 * * *"
env:
AZURE_CREDENTIALS: '{"clientId":"${{ secrets.AZURE_CLIENT_ID }}","clientSecret":"${{ secrets.AZURE_CLIENT_SECRET }}","subscriptionId":"${{ secrets.AZURE_SUBSCRIPTION_ID }}","tenantId":"${{ secrets.AZURE_TENANT_ID }}"}'
jobs:
pre_job:
name: Set Build Environment
runs-on: ubuntu-latest
outputs:
env_name: ${{ env.VALIDATE_ENV }}
steps:
- name: Check out changes
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
- name: Build vars
id: build_vars
uses: ./.github/actions/build-vars
- name: Force env if schedule
shell: bash
run: |
if [[ ${{ github.event_name == 'schedule' }} == 'true' ]]; then
echo "VALIDATE_ENV=prod" >> $GITHUB_ENV
else
echo "VALIDATE_ENV=${{ steps.build_vars.outputs.env_name }}" >> $GITHUB_ENV
fi
validate_dns:
name: Check infrastructure resources
if: ${{ needs.pre_job.outputs.env_name && (github.actor != 'dependabot[bot]') }}
needs:
- pre_job
environment: ${{ needs.pre_job.outputs.env_name }}
concurrency: ${{ needs.pre_job.outputs.env_name }}
runs-on: ubuntu-latest
steps:
- name: Check Out Changes
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
- name: Connect to VPN and login to Azure
uses: ./.github/actions/vpn-azure
with:
env-name: ${{ needs.pre_job.outputs.env_name }}
tls-key: ${{ secrets.TLS_KEY }}
ca-cert: ${{ secrets.CA_CRT}}
user-crt: ${{ secrets.USER_CRT }}
user-key: ${{ secrets.USER_KEY }}
sp-creds: ${{ env.AZURE_CREDENTIALS }}
- name: Restart DNS if failure
uses: ./.github/actions/retry
with:
timeout_seconds: 60
max_attempts: 3
retry_wait_seconds: 180
command: dig google.com @10.0.2.4
shell: bash
on_retry_command: >-
az container stop --name pdh${{ needs.pre_job.outputs.env_name }}-dns
-g prime-data-hub-${{ needs.pre_job.outputs.env_name }};
az container start --name pdh${{ needs.pre_job.outputs.env_name }}-dns
-g prime-data-hub-${{ needs.pre_job.outputs.env_name }};
- name: Restart legacy SFTP if wrong ip
if: needs.pre_job.outputs.env_name != 'prod'
uses: ./.github/actions/retry
with:
timeout_seconds: 60
max_attempts: 3
retry_wait_seconds: 180
command: |
ip=$(az container show --name pdh${{ needs.pre_job.outputs.env_name }}-sftpserver \
-g prime-data-hub-${{ needs.pre_job.outputs.env_name }} -o tsv --query 'ipAddress.ip')
last_octet=${ip: -2}
if [[ $last_octet -ne 20 ]]; then exit 1; fi
shell: bash
on_retry_command: >-
az container stop --name pdh${{ needs.pre_job.outputs.env_name }}-sftpserver
-g prime-data-hub-${{ needs.pre_job.outputs.env_name }};
az container start --name pdh${{ needs.pre_job.outputs.env_name }}-sftpserver
-g prime-data-hub-${{ needs.pre_job.outputs.env_name }};
optimize_demo_dbs:
name: Optimize demo databases
if: github.event_name == 'schedule'
runs-on: ubuntu-latest
strategy:
matrix:
env_name: [ demo1, demo2, demo3 ]
steps:
- name: Check Out Changes
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
- uses: azure/login@v2
with:
creds: ${{ env.AZURE_CREDENTIALS }}
- name: Reduce database replica sizes
uses: ./.github/actions/retry
with:
timeout_minutes: 180
max_attempts: 3
retry_wait_seconds: 1800
command: |
REPLICA_COUNT=$(az postgres server list -g prime-data-hub-${{ matrix.env_name }} --query '[*].name' | \
jq '[.[] | select(contains("pgsql-replica"))] | length')
if [[ ${REPLICA_COUNT} -gt 0 ]]; then
az postgres server update -g prime-data-hub-${{ matrix.env_name }} -n pdh${{ matrix.env_name }}-pgsql-replica --sku-name GP_Gen5_4
fi
shell: bash
vpn_validation:
name: VPN Validation
if: github.event_name == 'schedule'
runs-on: ubuntu-latest
continue-on-error: true
strategy:
max-parallel: 2
matrix:
env_name: [ prod, staging, demo1, demo2, demo3 ]
environment: ${{ matrix.env_name }}
concurrency: ${{ matrix.env_name }}
steps:
- name: Check Out Changes
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938
- uses: azure/login@v2
with:
creds: ${{ env.AZURE_CREDENTIALS }}
- name: Fetch VPN DNS IP
id: fetch_vpn_ip
shell: bash
run: |
DNS_IP=$(az container show -g prime-data-hub-${{ matrix.env_name }} \
--name pdh${{ matrix.env_name }}-dns --query 'ipAddress.ip' -o tsv)
echo "dns_ip=$DNS_IP" >> $GITHUB_OUTPUT
- name: Connect to VPN
uses: ./.github/actions/vpn-azure
with:
env-name: ${{ matrix.env_name }}
tls-key: ${{ secrets.TLS_KEY }}
ca-cert: ${{ secrets.CA_CRT}}
user-crt: ${{ secrets.USER_CRT }}
user-key: ${{ secrets.USER_KEY }}
dns-ip: ${{ steps.fetch_vpn_ip.outputs.dns_ip }}