Match Ohmywishes profile and list flows #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test and deploy to Yandex Cloud | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| id-token: write | |
| concurrency: | |
| group: rollapp-production | |
| cancel-in-progress: true | |
| env: | |
| YC_FOLDER_ID: b1gebpfrhvkd43r38q98 | |
| YC_DEPLOY_SA_ID: ajea75b2e3r8kiigmice | |
| YC_REGISTRY_ID: crpvg7pqnbpjl26q93f6 | |
| YC_VM_ID: epd40l0koqqqietvpd18 | |
| IMAGE_REPOSITORY: cr.yandex/crpvg7pqnbpjl26q93f6/rollapp | |
| PUBLIC_URL: https://xn--80avakiab.xn--p1ai | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 25 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Test and build | |
| run: npm run check | |
| - name: Log in to Yandex Container Registry via OIDC | |
| uses: yc-actions/yc-cr-login@v3 | |
| with: | |
| yc-sa-id: ${{ env.YC_DEPLOY_SA_ID }} | |
| - name: Build and push immutable image | |
| env: | |
| IMAGE_SHA: ${{ env.IMAGE_REPOSITORY }}:${{ github.sha }} | |
| run: | | |
| docker build --platform linux/amd64 --tag "$IMAGE_SHA" . | |
| docker push "$IMAGE_SHA" | |
| - name: Exchange GitHub OIDC token for Yandex IAM token | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| OIDC_TOKEN="$(curl -fsS \ | |
| -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \ | |
| "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https%3A%2F%2Fgithub.com%2Frolloutrf" \ | |
| | jq -er '.value')" | |
| IAM_TOKEN="$(curl -fsS -X POST https://auth.yandex.cloud/oauth/token \ | |
| -H 'Content-Type: application/x-www-form-urlencoded' \ | |
| --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \ | |
| --data-urlencode 'requested_token_type=urn:ietf:params:oauth:token-type:access_token' \ | |
| --data-urlencode "audience=${YC_DEPLOY_SA_ID}" \ | |
| --data-urlencode "subject_token=${OIDC_TOKEN}" \ | |
| --data-urlencode 'subject_token_type=urn:ietf:params:oauth:token-type:id_token' \ | |
| | jq -er '.access_token')" | |
| echo "::add-mask::${IAM_TOKEN}" | |
| echo "YC_IAM_TOKEN=${IAM_TOKEN}" >> "$GITHUB_ENV" | |
| - name: Install pinned Yandex Cloud CLI | |
| run: | | |
| sudo curl -fsSL \ | |
| https://storage.yandexcloud.net/yandexcloud-yc/release/0.201.0/linux/amd64/yc \ | |
| -o /usr/local/bin/yc | |
| sudo chmod 0755 /usr/local/bin/yc | |
| yc version | |
| - name: Deploy image to production VM | |
| env: | |
| IMAGE_SHA: ${{ env.IMAGE_REPOSITORY }}:${{ github.sha }} | |
| run: | | |
| sed -e "s|__IMAGE__|${IMAGE_SHA}|g" \ | |
| -e "s|__VERSION__|${GITHUB_SHA}|g" \ | |
| deploy/docker-compose.template.yml > deploy/docker-compose.yml | |
| yc compute instance update-container \ | |
| --id "$YC_VM_ID" \ | |
| --docker-compose-file deploy/docker-compose.yml \ | |
| --folder-id "$YC_FOLDER_ID" \ | |
| --async | |
| - name: Verify production health | |
| run: | | |
| for attempt in $(seq 1 30); do | |
| if curl -fsS --max-time 10 "${PUBLIC_URL}/api/healthz" \ | |
| | jq -e --arg expected "$GITHUB_SHA" '.ok == true and .version == $expected' >/dev/null; then | |
| echo "Rollapp is healthy at ${PUBLIC_URL}" | |
| for redirect_url in \ | |
| "https://rollapp.51-250-110-17.sslip.io/api/healthz" \ | |
| "https://www.xn--80avakiab.xn--p1ai/api/healthz"; do | |
| redirect_result="$(curl -sS --max-time 10 -o /dev/null -w '%{http_code} %{redirect_url}' "$redirect_url")" | |
| if [ "$redirect_result" != "301 ${PUBLIC_URL}/api/healthz" ]; then | |
| echo "Unexpected canonical redirect for ${redirect_url}: ${redirect_result}" >&2 | |
| exit 1 | |
| fi | |
| done | |
| exit 0 | |
| fi | |
| echo "Waiting for production (${attempt}/30)..." | |
| sleep 5 | |
| done | |
| echo "Production health check failed" >&2 | |
| exit 1 |