Irving López
fcec92ea1d
Sincroniza el scaffold canónico desde templates/web-backend-python/ del repo IDP. Reemplaza el placeholder mínimo previo (.gitea/workflows/ci.yaml, README.md, .gitignore, catalog-info.yaml) por el scaffold completo documentado en ADR-053 §3: - code/ — FastAPI app con /health (db check), /metrics, /demo estático, middleware correlation_id, settings Pydantic, db.py con SQLAlchemy - code/alembic/ — migración inicial vacía + env.py usando MIGRATION_DATABASE_URL - code/tests/ — pytest + httpx TestClient (test_health, test_demo) - helm/APP_NAME/ — chart con Deployment, Service, IngressRoute Traefik, NetworkPolicy, ServiceMonitor, Job alembic-upgrade como hook pre-upgrade,pre-install (backoffLimit: 0) - coralware-shape.yaml — manifiesto v1alpha1 del contrato del shape - claim-mariadb.yaml — AddonClaim declarativo (uso futuro ADR-052) - catalog-info.yaml — entidad Backstage actualizada - .gitea/workflows/APP_NAME-build.yaml — invoca reusable workflow ADR-038 + job helm-deploy con KUBECONFIG_TENANT_B64 Placeholders __APP_NAME__, __TIER__, __TENANT_ID__, __TENANT_ID_NODASHES__ serán sustituidos server-side por repo-provisioner cuando materialice el template para un tenant (pendiente — ADR-053 §11.5). El openspec/ del golden path NO se sincroniza al repo Gitea (gobernanza interna de Coralware). Refs: ADR-052, ADR-053, poc-nexobms.md (PoC NexoBMS Demetrio).
84 lines
2.9 KiB
YAML
84 lines
2.9 KiB
YAML
name: __APP_NAME__ — build & deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'code/**'
|
|
- 'helm/**'
|
|
- '.gitea/workflows/__APP_NAME__-build.yaml'
|
|
|
|
jobs:
|
|
# Tests + build + push a Harbor — patrón ADR-038 reusable workflow.
|
|
build:
|
|
uses: coralware/IDP/.gitea/workflows/_python-microservice.yaml@main
|
|
with:
|
|
service_name: __APP_NAME__
|
|
service_dir: code
|
|
uses_metrics: false
|
|
coverage_threshold: 80 # menor que el IDP interno (90); el dev sube cuando madure
|
|
trivy_exit_code: 0 # informacional en MVP; subir a 1 antes de producción
|
|
enforce_rollback: false # rollout lo gestiona el job helm-deploy abajo
|
|
|
|
# Deploy al cluster del tenant — Helm upgrade --install con hook Alembic.
|
|
helm-deploy:
|
|
needs: build
|
|
runs-on: [self-hosted, linux/amd64]
|
|
container: alpine/helm:3.14.4
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install kubectl
|
|
run: apk add --no-cache kubectl
|
|
|
|
- name: Decodificar kubeconfig del tenant
|
|
env:
|
|
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_TENANT_B64 }}
|
|
run: |
|
|
if [ -z "$KUBECONFIG_B64" ]; then
|
|
echo "ERROR: secret KUBECONFIG_TENANT_B64 no configurado en el proyecto Gitea."
|
|
echo "tenant-manager debe provisionarlo al crear el repo."
|
|
exit 1
|
|
fi
|
|
mkdir -p /root/.kube
|
|
echo "$KUBECONFIG_B64" | base64 -d > /root/.kube/config
|
|
chmod 600 /root/.kube/config
|
|
|
|
- name: Helm upgrade --install
|
|
env:
|
|
TENANT_ID: ${{ vars.TENANT_ID }}
|
|
TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
|
|
TENANT_TIER: ${{ vars.TENANT_TIER }}
|
|
IMAGE_TAG: ${{ needs.build.outputs.image_tag }}
|
|
run: |
|
|
helm upgrade --install __APP_NAME__ ./helm/__APP_NAME__ \
|
|
--namespace tenant-${TENANT_ID_NODASHES}-apps \
|
|
--create-namespace \
|
|
--set image.tag=${IMAGE_TAG} \
|
|
--set tenantId=${TENANT_ID} \
|
|
--set tenantIdNodashes=${TENANT_ID_NODASHES} \
|
|
--set tier=${TENANT_TIER} \
|
|
--wait --timeout 5m
|
|
|
|
- name: Verificar rollout
|
|
env:
|
|
TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
|
|
run: |
|
|
kubectl -n tenant-${TENANT_ID_NODASHES}-apps \
|
|
rollout status deploy/__APP_NAME__ --timeout=3m
|
|
|
|
- name: Smoke check post-deploy
|
|
env:
|
|
INGRESS_HOST: __APP_NAME__-${{ vars.TENANT_ID_NODASHES }}.apps.coralware.cloud
|
|
run: |
|
|
for i in $(seq 1 12); do
|
|
if wget -q -O - --timeout=10 "https://${INGRESS_HOST}/health" | grep -q '"status":"ok"'; then
|
|
echo "Smoke OK: /health responde 200 con db:up"
|
|
exit 0
|
|
fi
|
|
echo "Intento ${i}/12 — /health aún no responde, esperando 5s…"
|
|
sleep 5
|
|
done
|
|
echo "ERROR: /health no respondió 200 dentro del timeout"
|
|
exit 1
|