104 lines
4.1 KiB
YAML
104 lines
4.1 KiB
YAML
name: __APP_NAME__ — build & deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'code/**'
|
|
- 'helm/**'
|
|
- '.gitea/workflows/__APP_NAME__-build.yaml'
|
|
|
|
jobs:
|
|
# Tests + build + push a Harbor — patrón ADR-038 reusable workflow.
|
|
build:
|
|
uses: coralware/IDP/.gitea/workflows/_python-microservice.yaml@main
|
|
with:
|
|
service_name: __APP_NAME__
|
|
service_dir: code
|
|
uses_metrics: false
|
|
coverage_threshold: 80 # menor que el IDP interno (90); el dev sube cuando madure
|
|
trivy_exit_code: 0 # informacional en MVP; subir a 1 antes de producción
|
|
enforce_rollback: false # rollout lo gestiona el job helm-deploy abajo
|
|
|
|
# Deploy al cluster del tenant — Helm upgrade --install con hook Alembic.
|
|
# El runner corre executor=host (ci-system: container.enabled=false, ADR-043):
|
|
# los steps se ejecutan directo sobre el pod runner, sin Docker daemon. Por eso
|
|
# NO se usa `container:` — kubectl ya viene en la imagen del runner; helm se
|
|
# instala en runtime (la NetworkPolicy de los runners permite egress 443).
|
|
helm-deploy:
|
|
needs: build
|
|
runs-on: [self-hosted, buildkit]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Instalar helm
|
|
run: |
|
|
HELM_VERSION=v3.14.4
|
|
case "$(uname -m)" in
|
|
x86_64) ARCH=amd64 ;;
|
|
aarch64) ARCH=arm64 ;;
|
|
*) echo "Arquitectura no soportada: $(uname -m)"; exit 1 ;;
|
|
esac
|
|
mkdir -p "${HOME}/.local/bin"
|
|
curl -fsSL "https://get.helm.sh/helm-${HELM_VERSION}-linux-${ARCH}.tar.gz" \
|
|
| tar -xz -C /tmp "linux-${ARCH}/helm"
|
|
mv "/tmp/linux-${ARCH}/helm" "${HOME}/.local/bin/helm"
|
|
chmod +x "${HOME}/.local/bin/helm"
|
|
echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
|
|
"${HOME}/.local/bin/helm" version
|
|
|
|
- name: Decodificar kubeconfig del tenant
|
|
env:
|
|
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_TENANT_B64 }}
|
|
run: |
|
|
if [ -z "$KUBECONFIG_B64" ]; then
|
|
echo "ERROR: secret KUBECONFIG_TENANT_B64 no configurado en el proyecto Gitea."
|
|
echo "tenant-manager debe provisionarlo al crear el repo."
|
|
exit 1
|
|
fi
|
|
mkdir -p "${HOME}/.kube"
|
|
echo "$KUBECONFIG_B64" | base64 -d > "${HOME}/.kube/config"
|
|
chmod 600 "${HOME}/.kube/config"
|
|
|
|
- name: Helm upgrade --install
|
|
env:
|
|
TENANT_ID: ${{ vars.TENANT_ID }}
|
|
TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
|
|
TENANT_TIER: ${{ vars.TENANT_TIER }}
|
|
IMAGE_TAG: ${{ needs.build.outputs.image_tag }}
|
|
# ADR-054: en cluster tenant los namespaces son funcionales (apps/addons),
|
|
# sin tenant-id en el nombre — el cluster ya es el sandbox del tenant.
|
|
run: |
|
|
helm upgrade --install __APP_NAME__ ./helm/__APP_NAME__ \
|
|
--namespace apps \
|
|
--create-namespace \
|
|
--set image.tag=${IMAGE_TAG} \
|
|
--set tenantId=${TENANT_ID} \
|
|
--set tenantIdNodashes=${TENANT_ID_NODASHES} \
|
|
--set tier=${TENANT_TIER} \
|
|
--wait --timeout 5m
|
|
|
|
- name: Verificar rollout
|
|
run: |
|
|
kubectl -n apps rollout status deploy/__APP_NAME__ --timeout=3m
|
|
|
|
- name: Smoke check post-deploy
|
|
# FQDN con tenant-id CON guiones — coincide con el A record que crea
|
|
# cloudflare-provisioner (Gap 5) y con el host del Ingress NGINX
|
|
# (helm/APP_NAME/values.yaml). Antes usaba TENANT_ID_NODASHES, lo
|
|
# que no resolvía al A record canónico — corregido APERTURA COVE
|
|
# Sesión 3 (TENANT-INGRESS-CONTROLLER-MISMATCH).
|
|
env:
|
|
INGRESS_HOST: __APP_NAME__-${{ vars.TENANT_ID }}.apps.coralware.cloud
|
|
run: |
|
|
for i in $(seq 1 12); do
|
|
if wget -q -O - --timeout=10 "https://${INGRESS_HOST}/health" | grep -q '"status":"ok"'; then
|
|
echo "Smoke OK: /health responde 200 con db:up"
|
|
exit 0
|
|
fi
|
|
echo "Intento ${i}/12 — /health aún no responde, esperando 5s…"
|
|
sleep 5
|
|
done
|
|
echo "ERROR: /health no respondió 200 dentro del timeout"
|
|
exit 1
|