Merge pull request #369 from beyondessential/dependabot/cargo/axum-te… #683
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD | |
| on: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write # Tailscale OIDC | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse | |
| jobs: | |
| build-binaries: | |
| name: Build ${{ matrix.arch }} binaries | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| matrix: | |
| include: | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| target: aarch64-unknown-linux-gnu | |
| steps: | |
| - name: Free up space | |
| run: sudo rm -rf /opt/hostedtoolcache /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup || true | |
| - uses: actions/checkout@v7.0.0 | |
| - name: Configure toolchain | |
| run: | | |
| rustup toolchain install --profile minimal --no-self-update stable | |
| rustup default stable | |
| rustup target add ${{ matrix.target }} | |
| - uses: taiki-e/install-action@v2.82.2 | |
| with: | |
| tool: just | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: ${{ matrix.arch }}-release | |
| # The runner image ships with Node + npm; private-server's build.rs | |
| # uses them to produce the embedded private-web/dist/ bundle. | |
| - name: Build binaries | |
| run: just build-servers-release ${{ matrix.target }} | |
| env: | |
| RUSTFLAGS: "-C target-feature=+crt-static" | |
| - name: Prepare artifacts | |
| run: | | |
| mkdir -p artifacts/${{ matrix.arch }} | |
| cargo metadata --format-version=1 --no-deps \ | |
| | jq -r '.packages[].targets[] | select(.kind | index("bin")) | .name' \ | |
| | while IFS= read -r bin; do | |
| cp "target/${{ matrix.target }}/release/$bin" "artifacts/${{ matrix.arch }}/" | |
| done | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: binaries-${{ matrix.arch }} | |
| path: artifacts/${{ matrix.arch }}/ | |
| retention-days: 1 | |
| build-image: | |
| name: Build container image | |
| runs-on: ubuntu-24.04 | |
| needs: [build-binaries] | |
| outputs: | |
| image-tag: ${{ steps.tag.outputs.value }} | |
| steps: | |
| - name: Login to ghcr.io | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin | |
| - uses: actions/checkout@v7.0.0 | |
| - id: tag | |
| run: echo "value=sha-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" | |
| - name: Download ARM64 binaries | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: binaries-arm64 | |
| path: .github/build-context/arm64/ | |
| # Stage the public-server's static assets into the build context. | |
| - name: Stage static assets | |
| run: cp -r static .github/build-context/static | |
| - name: Setup buildkit | |
| uses: docker/setup-buildx-action@v4.1.0 | |
| - uses: docker/metadata-action@v6.1.0 | |
| id: meta | |
| with: | |
| images: ghcr.io/beyondessential/canopy | |
| tags: | | |
| type=raw,value=latest | |
| type=raw,value=${{ steps.tag.outputs.value }} | |
| labels: | | |
| org.opencontainers.image.vendor=BES International | |
| org.opencontainers.image.title=Canopy | |
| org.opencontainers.image.url=https://www.bes.au/products/tamanu/ | |
| org.opencontainers.image.source=https://github.com/beyondessential/canopy/ | |
| org.opencontainers.image.licenses=GPL-3.0-or-later | |
| - name: Build and push | |
| uses: docker/build-push-action@v7.2.0 | |
| with: | |
| context: .github/build-context | |
| file: .github/Dockerfile.native | |
| platforms: linux/arm64 | |
| push: true | |
| labels: ${{ steps.meta.outputs.labels }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| deploy: | |
| name: Deploy | |
| runs-on: ubuntu-24.04 | |
| needs: [build-image] | |
| steps: | |
| - name: Checkout ops repo | |
| uses: actions/checkout@v7.0.0 | |
| with: | |
| repository: beyondessential/ops | |
| ssh-key: ${{ secrets.OPS_SSH }} | |
| ref: ${{ vars.OPS_REF }} | |
| path: ops | |
| # Drop ops/.git so pulumi doesn't pick it up as the repo context. | |
| - name: Strip ops/.git | |
| run: rm -rf ops/.git | |
| - name: Connect to Tailscale | |
| uses: tailscale/github-action@v4.1.2 | |
| with: | |
| oauth-client-id: ${{ vars.TS_OAUTH_CLIENT_ID }} | |
| audience: api.tailscale.com/${{ vars.TS_OAUTH_CLIENT_ID }} | |
| tags: ${{ vars.TS_TAGS }} | |
| - name: Configure kubeconfig | |
| run: | | |
| sudo tailscale set --operator=$USER | |
| tailscale configure kubeconfig ${{ vars.TS_K8S_OPERATOR_HOSTNAME }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: lts/* | |
| - name: Install pulumi dependencies | |
| run: | | |
| cd ops/pulumi | |
| npm ci | |
| - name: Install pulumi CLI | |
| uses: pulumi/actions@v7 | |
| - name: Authenticate to Pulumi Cloud | |
| uses: pulumi/auth-actions@v2.1.0 | |
| with: | |
| organization: bes | |
| requested-token-type: urn:pulumi:token-type:access_token:organization | |
| - name: Pulumi up | |
| run: | | |
| cd ops/${{ vars.OPS_PULUMI_PATH }} | |
| pulumi stack select ${{ vars.PULUMI_STACK }} | |
| pulumi config refresh | |
| pulumi config set imageTag ${{ needs.build-image.outputs.image-tag }} | |
| pulumi up --yes |