cd.yml

# Useful GitHub Actions docs:
#
# - https://help.github.com/en/actions
# - https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions
# - https://help.github.com/en/actions/configuring-and-managing-workflows/configuring-a-workflow
# - https://help.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions

name: Continuous Deployment

# only allow one deploy workflow to be running at a time
# serializes multiple outstanding deploys if PRs are merged before the last deploy finishes
# ref: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#concurrency
concurrency: deploy

# Only trigger the workflow when pushing to master or a label is applied to a
# Pull Request
on:
  push:
    branches:
      - master
      - test-this-pr/**
  pull_request:
    types: [labeled]

# Global environment variables
env:
  # gcloud versions at https://cloud.google.com/sdk/docs/release-notes, update
  # to latest when updating.
  #
  GCLOUD_SDK_VERION: "387.0.0"
  # kubectl versions at https://github.com/kubernetes/kubernetes/tags, update to
  # second latest minor for a broad compatibility range when updating.
  #
  KUBECTL_VERSION: "v1.23.7"
  # helm versions at https://github.com/helm/helm/tags, use latest when
  # updating.
  #
  HELM_VERSION: "v3.9.0"
  # cert-mangaer versions at https://cert-manager.io/docs/release-notes/, update
  # to latest when updating and make sure to read upgrade notes. "kubectl apply"
  # will be done on CRDs but sometimes more is needed.
  #
  # NOTE: Updates to CERT_MANAGER_VERSION should also be done in the
  #       test-helm-template.yaml workflow.
  #
  CERT_MANAGER_VERSION: "v0.15.2"

  GIT_COMMITTER_EMAIL: ci-user@github.local
  GIT_COMMITTER_NAME: CI User
  GIT_AUTHOR_EMAIL: ci-user@github.local
  GIT_AUTHOR_NAME: CI User

jobs:
  # In this dedicated job to deploy our staging environment we build and push
  # images that the jobs to deploy to the production environments depend on.
  staging-deploy:
    # Only run the job if the 'test-staging' label is present OR if the event
    # is a push to master
    if: |
      (github.event.label.name == 'test-staging') ||
      ((github.event_name == 'push') && (github.ref == 'refs/heads/master')) ||
      ((github.event_name == 'push') && contains(github.ref, 'test-this-pr'))
    runs-on: ubuntu-20.04

    strategy:
      fail-fast: false  # Do not cancel all jobs if one fails
      matrix:
        include:
          # Now we have only one staging environment, but we have had two when
          # we transitioned from one k8s cluster to another.
          # - The domain name staging.mybinder.org currently refers to
          #   gke2.staging.mybinder.org through a CNAME but during the
          #   transition they were separate.
          # - When we have two separate staging environments it can be useful to
          #   pass --image-prefix to override the chartpress.yaml configuration
          #   for one of the environments.
          - federation_member: staging
            binder_url: https://gke2.staging.mybinder.org
            hub_url: https://hub.gke2.staging.mybinder.org
            chartpress_args: ""
            helm_version: ""

    steps:
      - name: "Stage 0: Update env vars based on job matrix arguments"
        run: |
          if [ -n "${{ matrix.helm_version }}" ]; then
              echo "HELM_VERSION=${{ matrix.helm_version }}" >> $GITHUB_ENV
          fi

      # Action Repo: https://github.com/actions/checkout
      - name: "Stage 0: Checkout repo"
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      # Action Repo: https://github.com/actions/setup-python
      - name: "Stage 0: Setup Python 3.8"
        uses: actions/setup-python@v1
        with:
          python-version: 3.8

      # Action Repo: https://github.com/actions/cache
      - name: "Stage 0: Cache pip dependencies"
        uses: actions/cache@v2
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: "Stage 1: Install dependencies"
        run: |
          pip install --upgrade setuptools pip
          pip install --upgrade -r requirements.txt

      # Action Repo: https://github.com/google-github-actions/setup-gcloud
      - name: "Stage 1: Install gcloud ${{ env.GCLOUD_SDK_VERION }}"
        uses: google-github-actions/setup-gcloud@v0
        with:
          version: ${{ env.GCLOUD_SDK_VERION }}

      # Action Repo: https://github.com/Azure/setup-kubectl
      - name: "Stage 1: Install kubectl ${{ env.KUBECTL_VERSION }}"
        uses: azure/setup-kubectl@v1
        with:
          version: ${{ env.KUBECTL_VERSION }}

      - name: "Stage 1: Install and setup helm ${{ env.HELM_VERSION }}"
        run: |
          curl -sf https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | DESIRED_VERSION=${HELM_VERSION} bash
          helm dependency update ./mybinder

      # Action Repo: https://github.com/sliteteam/github-action-git-crypt-unlock
      - name: "Stage 2: Unlock git-crypt secrets"
        uses: sliteteam/github-action-git-crypt-unlock@a09ea5079c1b0e1887d4c8d7a4b20f00b5c2d06b
        env:
          GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}

      # Action Repo: https://github.com/Azure/docker-login
      - name: "Stage 2: Login to Docker"
        uses: azure/docker-login@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: "Stage 3: Run chartpress to build/push images and updates values.yaml"
        run: |
          chartpress --push ${{ matrix.chartpress_args }}

      - name: "Stage 4: Deploy to staging"
        run: |
          python ./deploy.py ${{ matrix.federation_member }}
        env:
          TERM: xterm

      # Action Repo: https://github.com/nick-invision/retry
      - name: "Stage 4: Verify staging works"
        uses: nick-invision/retry@39da88d5f7d15a96aed861dbabbe8b7443e3182a
        with:
          timeout_minutes: 10
          max_attempts: 3
          command: pytest -vx --color=yes --numprocesses=2 --binder-url=${{ matrix.binder_url }} --hub-url=${{ matrix.hub_url }} tests/

      - name: "Stage 5: Post message to Grafana that deployment to production has started"
        run: |
          source secrets/grafana-api-key
          export PULL_REQUEST_ID=$(git log -1 --pretty=%B | head -n1 | sed 's/^.*#\([0-9]*\).*/\1/')
          export AUTHOR_NAME="$(git log  -1 --pretty=%aN)"
          export PULL_REQUEST_TITLE="$(git log --pretty=%B -1 | tail -n+3)"
          python post-grafana-annotation.py  \
            --grafana-url https://grafana.mybinder.org \
            --tag deployment-start \
            "$(echo -en ${PULL_REQUEST_TITLE}\\n\\n${AUTHOR_NAME}: https://github.com/${{ github.repository }}/pull/${PULL_REQUEST_ID})" \
          || echo "failed!"

  prod-deploy:
    # Previous job must have successfully completed for this job to execute
    # - https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idneeds
    needs: staging-deploy

    # Only run job if the event is a push to master
    if: github.event_name == 'push' && github.ref == 'refs/heads/master'

    runs-on: ubuntu-20.04

    # We run this job multiple times with different parameters
    # - https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstrategy
    strategy:
      fail-fast: false  # Do not cancel all jobs if one fails
      matrix:
        include:
          - federation_member: prod
            binder_url: https://gke.mybinder.org
            hub_url: https://hub.gke.mybinder.org
            chartpress_args: ""
            helm_version: ""
          - federation_member: turing
            binder_url: https://turing.mybinder.org
            hub_url: https://hub.mybinder.turing.ac.uk
            chartpress_args: ""
            helm_version: ""
          - federation_member: ovh
            binder_url: https://ovh.mybinder.org
            hub_url: https://hub-binder.mybinder.ovh
            # image-prefix should match ovh registry config in secrets/config/ovh.yaml
            chartpress_args: "--push --image-prefix=3i2li627.gra7.container-registry.ovh.net/binder/mybinder-"
            helm_version: ""

    steps:
      - name: "Stage 0: Update env vars based on job matrix arguments"
        run: |
          if [ -n "${{ matrix.helm_version }}" ]; then
              echo "HELM_VERSION=${{ matrix.helm_version }}" >> $GITHUB_ENV
          fi

      - name: "Stage 0: Checkout repo"
        uses: actions/checkout@v2
        with:
          fetch-depth: 0

      - name: "Stage 0: Setup Python 3.8"
        uses: actions/setup-python@v1
        with:
          python-version: 3.8

      - name: "Stage 0: Cache pip dependencies"
        uses: actions/cache@v2
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-

      - name: "Stage 1: Install dependencies"
        run: |
          pip install --upgrade setuptools pip
          pip install --upgrade -r requirements.txt

      # - https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idif
      - name: "Stage 1: Install gcloud ${{ env.GCLOUD_SDK_VERION }}"
        if: matrix.federation_member == 'prod'
        uses: google-github-actions/setup-gcloud@v0
        with:
          version: ${{ env.GCLOUD_SDK_VERION }}

      - name: "Stage 1: Install Azure CLI"
        if: matrix.federation_member == 'turing'
        run: |
          sudo apt-get update && sudo apt-get install ca-certificates curl apt-transport-https lsb-release gnupg && curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/microsoft.asc.gpg > /dev/null && AZ_REPO=$(lsb_release -cs) && echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ $AZ_REPO main" | sudo tee /etc/apt/sources.list.d/azure-cli.list && sudo apt-get update && sudo apt-get install azure-cli

      - name: "Stage 1: Install kubectl ${{ env.KUBECTL_VERSION }}"
        uses: azure/setup-kubectl@v1
        with:
          version: ${{ env.KUBECTL_VERSION }}

      - name: "Stage 1: Install and setup helm ${{ env.HELM_VERSION }}"
        run: |
          curl -sf https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | DESIRED_VERSION=${HELM_VERSION} bash
          helm dependency update ./mybinder

      - name: "Stage 2: Unlock git-crypt secrets"
        uses: sliteteam/github-action-git-crypt-unlock@a09ea5079c1b0e1887d4c8d7a4b20f00b5c2d06b
        env:
          GIT_CRYPT_KEY: ${{ secrets.GIT_CRYPT_KEY }}

      # Action Repo: https://github.com/Azure/docker-login
      - name: "Stage 3: Login to Docker regstry (OVH)"
        if: matrix.federation_member == 'ovh'
        uses: azure/docker-login@v1
        with:
          login-server: 3i2li627.gra7.container-registry.ovh.net
          username: ${{ secrets.DOCKER_USERNAME_OVH }}
          password: ${{ secrets.DOCKER_PASSWORD_OVH }}

      - name: "Stage 3: Run chartpress to update values.yaml"
        run: |
          chartpress ${{ matrix.chartpress_args || '--skip-build' }}

      - name: "Stage 4: Deploy to ${{ matrix.federation_member }}"
        run: |
          python ./deploy.py ${{ matrix.federation_member }} ${{ matrix.cluster_name || matrix.federation_member }} --name ${{ matrix.release_name || matrix.federation_member }}
        env:
          TERM: xterm

      - name: "Stage 4: Verify ${{ matrix.federation_member }} works"
        uses: nick-invision/retry@39da88d5f7d15a96aed861dbabbe8b7443e3182a
        with:
          timeout_minutes: 10
          max_attempts: 3
          command: pytest -vx --color=yes --numprocesses=2 --binder-url=${{ matrix.binder_url }} --hub-url=${{ matrix.hub_url }} tests/

  report-status:
    # This job will wait for staging-deploy to finish and report its status
    #
    # This job will only run on push events made to test-this-pr/** branches
    if: github.event_name == 'push' && contains(github.ref, 'test-this-pr')
    environment: test-this-pr-env
    runs-on: ubuntu-latest
    steps:
      # Poll the GitHub REST API and wait for staging-deploy job to finish
      - name: Wait for staging-deploy completion
        id: staging-deploy-status
        shell: bash
        run: |
          STATUS=""
          CONCLUSION=""

          while [ "$STATUS" != "completed" ]; do
            RESPONSE=$(curl --silent --request GET \
              --url 'https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs' \
              --header 'Authorization: token ${{ secrets.TEST_THIS_PR_ACCESS_TOKEN }}' \
              --header 'Accept: application/vnd.github.v3+json')

            STATUS=$(echo $RESPONSE | jq -r '.jobs[] | select(.name | startswith("staging-deploy")) | .status')
            echo "Status: $STATUS"

            if [[ "$STATUS" == "completed" ]]; then
              CONCLUSION=$(echo $RESPONSE | jq -r '.jobs[] | select(.name | startswith("staging-deploy")) | .conclusion')
              echo "Conclusion: $CONCLUSION"
            else
              sleep 30s
            fi
          done

          echo "::set-output name=status::$STATUS"
          echo "::set-output name=conclusion::$CONCLUSION"

      - name: Set PR number as variable
        id: get-pr-number
        shell: bash
        run: |
          PR_NUM=$(echo ${{ github.ref }} | awk -F'/' '{print $NF}')
          echo "::set-output name=prnum::$PR_NUM"

      - name: Comment on PR with Job Status and delete the test branch
        if: ${{ steps.staging-deploy-status.outputs.status }} == 'completed'
        uses: actions/github-script@v4.0.2
        with:
          github-token: ${{ secrets.TEST_THIS_PR_ACCESS_TOKEN }}
          script: |
            var JOB_STATUS = process.env.JOB_STATUS;
            var PR_NUMBER = process.env.PR_NUMBER;

            github.git.deleteRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: `heads/test-this-pr/${PR_NUMBER}`
            })

            github.issues.createComment({
              issue_number: PR_NUMBER,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `**Job status:** ${JOB_STATUS}\nBranch 'test-this-pr/${PR_NUMBER}' has been deleted`
            })
        env:
          JOB_STATUS: ${{ steps.staging-deploy-status.outputs.conclusion }}
          PR_NUMBER: ${{ steps.get-pr-number.outputs.prnum }}