postgres/.github/workflows/cleanup-stale-ec2.yml at develop · supabase/postgres · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
name: Cleanup Stale Build Resources

on:
  schedule:
    # Run daily at 06:00 UTC
    - cron: "0 6 * * *"
  workflow_dispatch:

jobs:
  cleanup:
    name: Delete stale build resources
    runs-on: blacksmith-4vcpu-ubuntu-2404
    strategy:
      matrix:
        region:
          - ap-southeast-1
          - us-east-1

    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v7.0.1

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v6.3.0
        with:
          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
          aws-region: ${{ matrix.region }}

      - name: Cleanup stale AMI build resources
        shell: bash
        timeout-minutes: 60 # AWS creds expire after 1h
        env:
          AWS_MAX_ATTEMPTS: 6
          OK_TO_DESTROY: "true"
        run: ci/cleanup-stale-ami-build-resources.sh 2>&1 | tee "$RUNNER_TEMP/cleanup.log"

      - name: Summarize cleanup
        if: always()
        run: ci/summarize-cleanup-log.sh "${{ matrix.region }}" "$RUNNER_TEMP/cleanup.log" > "$RUNNER_TEMP/summary.txt"

      - name: Upload summary
        if: always()
        uses: actions/upload-artifact@v4.6.2
        with:
          name: cleanup-summary-${{ matrix.region }}
          path: ${{ runner.temp }}/summary.txt
          if-no-files-found: ignore

  notify:
    name: Notify Slack
    needs: cleanup
    if: always()
    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
      actions: read # to read the cleanup jobs' durations
      contents: read

    steps:
      - name: Checkout scripts
        uses: actions/checkout@v6.0.1
        with:
          sparse-checkout: ci
          persist-credentials: false

      - name: Download summaries
        uses: actions/download-artifact@v4.3.0
        with:
          pattern: cleanup-summary-*
          path: summaries

      - name: Add job durations
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          shopt -s nullglob
          # one "region<TAB>seconds" line per cleanup job; a failed lookup just leaves durations as n/a
          gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/attempts/$GITHUB_RUN_ATTEMPT/jobs" \
            --jq '.jobs[] | select(.name | startswith("Delete stale build resources")) | [(.name | capture("\\((?<region>[^)]+)\\)").region), ((.completed_at | fromdate) - (.started_at | fromdate))] | @tsv' \
            >"$RUNNER_TEMP/durations.tsv" || : >"$RUNNER_TEMP/durations.tsv"
          summaries=(summaries/*/summary.txt)
          if ((${#summaries[@]} > 0)); then
            ci/add-job-durations.sh "$RUNNER_TEMP/durations.tsv" "${summaries[@]}"
          fi

      - name: Build Slack payload
        env:
          CLEANUP_RESULT: ${{ needs.cleanup.result }}
          SLACK_CHANNEL: C0C16MJ8WHX
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          shopt -s nullglob
          ci/build-slack-payload.sh summaries/*/summary.txt | tee "$RUNNER_TEMP/payload.json"

      - name: Slack Notification
        uses: slackapi/slack-github-action@v4.0.0
        with:
          webhook: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
          webhook-type: incoming-webhook
          errors: true
          payload-file-path: ${{ runner.temp }}/payload.json