ci-prod.yml

name: Build & Deploy App to Production
on:
  workflow_dispatch:
    inputs:
      # commit hash (for frontend deploy to fleek)
      commit:
        description: "Branch/Commit ref"
        default: "origin/master"
        type: string

jobs:
  build-and-test:
    name: Build and Test
    # environment: production

    # run only when code is compiling and tests are passing
    runs-on: ubuntu-latest

    outputs:
      dockerTag: ${{ steps.compute.outputs.docker_tag }}

    services:
      # Label used to access the service container
      postgres:
        # Docker Hub image
        image: postgres:11.5
        # Provide the password for postgres
        env:
          POSTGRES_DB: testdb
        # Set health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          # Maps tcp port 5432 on service container to the host
          - 5432:5432

      redis:
        image: redis
        # Set health checks to wait until redis has started
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379

    env:
      DJANGO_SETTINGS_MODULE: app.settings
      SUPRESS_DEBUG_TOOLBAR: 1
      GITCOIN_API_USER: ${{ secrets.GITCOIN_API_USER }}
      GITHUB_API_TOKEN: ${{ secrets.GITCOIN_API_TOKEN }}
      POLYGONSCAN_API_KEY: ${{ secrets.POLYGONSCAN_API_KEY }}

    # steps to perform in job
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Use Node.js 14
        uses: actions/setup-node@v2
        with:
          node-version: 14.20.1
          cache: "yarn"

      - name: Use Python 3.7
        uses: "actions/setup-python@v2"
        with:
          python-version: 3.7
          cache: "pip"

      - name: Setup Env
        run: |
          echo "PYTHONPATH=/home/runner/work/web/web/app" >> $GITHUB_ENV
          cp app/app/ci.env app/app/.env
          pip install pip==20.0.2 setuptools wheel --upgrade

      - name: Fetch and Install GeoIP database files
        run: |
          sudo apt-get update && sudo apt-get install -y libmaxminddb-dev libsodium-dev libsecp256k1-dev
          cp dist/*.gz ./
          gunzip GeoLite2-City.mmdb.tar.gz && gunzip GeoLite2-Country.mmdb.tar.gz
          tar -xvf GeoLite2-City.mmdb.tar && tar -xvf GeoLite2-Country.mmdb.tar
          sudo mkdir -p /opt/GeoIP/
          sudo mv GeoLite2-City_20200128/*.mmdb /opt/GeoIP/
          sudo mv GeoLite2-Country_20200128/*.mmdb /opt/GeoIP/

      - name: Install libvips, Node, and Python dependencies
        run: |
          sudo apt-get install -y libvips libvips-dev
          node --version
          yarn install
          pip install -r requirements/test.txt
          yarn run eslint
          yarn run stylelint
          (cd app; python ./manage.py collectstatic --noinput --disable-collectfast)

      # - name: Run management commands
      #   run: |
      #     python app/manage.py migrate
      #     python app/manage.py fetch_gas_prices

      # - name: Run Python and UI tests
      #   run: |
      #     pytest -p no:ethereum -p no:warnings
      #     bin/ci/cypress-run

      # - name: Generate Markdown documentation and static docs page
      #   run: pydocmd build

      # - name: Deploy to Github Pages 🚀
      #   uses: peaceiris/actions-gh-pages@v3
      #   if: github.ref == 'refs/heads/master'
      #   with:
      #     github_token: ${{ secrets.GITHUB_TOKEN }}
      #     publish_dir: _build/site
      #     cname: docs.gitcoin.coind

      - name: Compute some values
        id: compute
        run: |
          echo "::set-output name=docker_tag::gitcoin/web:${GITHUB_SHA: -10}"

      - name: Login to Docker Hub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      
      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1

      - name: Deploy to Docker Hub 🚀
        uses: docker/build-push-action@v2
        with:
          context: ./
          file: ./Dockerfile-prod
          builder: ${{ steps.buildx.outputs.name }}
          push: true
          tags: |
            ${{ steps.compute.outputs.docker_tag }}
            gitcoin/web:production-gha
          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/web:buildcache-production
          cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/web:buildcache-production,mode=max

      - run: |
          npm install
          pulumi stack select -c gitcoin/production/dev
          pulumi config -s gitcoin/production/dev set aws:region us-west-2 --non-interactive
        working-directory: infra/production
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
      
      # Run pulumi actions
      # - uses: pulumi/actions@v3
      #   id: pulumi
      #   with:
      #     command: preview
      #     stack-name: gitcoin/production/dev
      #     upsert: false
      #     work-dir: infra/production
      #   env:
      #     PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
      #     PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }} 
      #     AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      #     AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      #     AWS_REGION: ${{ secrets.AWS_REGION }}
      #     DB_NAME: ${{ secrets.DB_NAME }}
      #     DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
      #     DB_USER: ${{ secrets.DB_USER }}
      #     DOCKER_GTC_WEB_IMAGE: ${{ needs.build-and-test.outputs.dockerTag }}
      #     DATADOG_KEY: ${{ secrets.DATADOG_KEY }}
      #     ROUTE_53_ZONE: ${{ secrets.ROUTE_53_ZONE }}
      #     DOMAIN: ${{ secrets.DOMAIN }}
      #     SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
      #     GITHUB_CLIENT_ID: ${{ secrets.GTC_GITHUB_CLIENT_ID }}
      #     GITHUB_CLIENT_SECRET: ${{ secrets.GTC_GITHUB_CLIENT_SECRET }}
      #     TEMP_DATABASE: ${{ secrets.TEMP_DATABASE }}
      #     DATABASE_URL: ${{ secrets.DATABASE_URL }}
      #     READ_REPLICA_1_DATABASE_URL: ${{secrets.READ_REPLICA_1_DATABASE_URL}}
      #     READ_REPLICA_2_DATABASE_URL: ${{secrets.READ_REPLICA_2_DATABASE_URL}}
      #     READ_REPLICA_3_DATABASE_URL: ${{secrets.READ_REPLICA_3_DATABASE_URL}}
      #     READ_REPLICA_4_DATABASE_URL: ${{secrets.READ_REPLICA_4_DATABASE_URL}}
      #     GITHUB_API_TOKEN: ${{ secrets.GTC_GITHUB_API_TOKEN }}
      #     GITHUB_API_USER: ${{ secrets.GTC_GITHUB_API_USER }}
      #     GITHUB_APP_NAME: ${{ secrets.GTC_GITHUB_APP_NAME }}

  deploy:
    name: Deploy
    needs: build-and-test
    environment: production
    runs-on: ubuntu-latest

    steps:

      - name: Checkout code
        uses: actions/checkout@v2

      - name: Use Node.js
        uses: actions/setup-node@v2
        with:
          # node-version: ${{ matrix.node-version }}
          cache: "npm"
          cache-dependency-path: infra/production/package-lock.json

      # Install pulumi dependencies
      # Select the new pulumi stack 
      - run: |
          npm install
          pulumi stack select -c gitcoin/production/dev
          pulumi config -s gitcoin/production/dev set aws:region us-west-2 --non-interactive
        working-directory: infra/production
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}

      # Run pulumi actions
      - uses: pulumi/actions@v3
        id: pulumi
        with:
          command: up
          stack-name: gitcoin/production/dev
          upsert: false
          work-dir: infra/production
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
          PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }} 
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_REGION: ${{ secrets.AWS_REGION }}
          DB_NAME: ${{ secrets.DB_NAME }}
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
          DB_USER: ${{ secrets.DB_USER }}
          DOCKER_GTC_WEB_IMAGE: ${{ needs.build-and-test.outputs.dockerTag }}
          DATADOG_KEY: ${{ secrets.DATADOG_KEY }}
          ROUTE_53_ZONE: ${{ secrets.ROUTE_53_ZONE }}
          DOMAIN: ${{ secrets.DOMAIN }}
          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
          GITHUB_CLIENT_ID: ${{ secrets.GTC_GITHUB_CLIENT_ID }}
          GITHUB_CLIENT_SECRET: ${{ secrets.GTC_GITHUB_CLIENT_SECRET }}
          TEMP_DATABASE: ${{ secrets.TEMP_DATABASE }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          READ_REPLICA_1_DATABASE_URL: ${{secrets.READ_REPLICA_1_DATABASE_URL}}
          READ_REPLICA_2_DATABASE_URL: ${{secrets.READ_REPLICA_2_DATABASE_URL}}
          READ_REPLICA_3_DATABASE_URL: ${{secrets.READ_REPLICA_3_DATABASE_URL}}
          READ_REPLICA_4_DATABASE_URL: ${{secrets.READ_REPLICA_4_DATABASE_URL}}
          GITHUB_API_TOKEN: ${{ secrets.GTC_GITHUB_API_TOKEN }}
          GITHUB_API_USER: ${{ secrets.GTC_GITHUB_API_USER }}
          GITHUB_APP_NAME: ${{ secrets.GTC_GITHUB_APP_NAME }}
          OLD_REDIS_URL: ${{ secrets.OLD_REDIS_URL }}
          SECRET_KEY: ${{ secrets.SECRET_KEY }}
          ETHERSCAN_API_KEY: ${{ secrets.ETHERSCAN_API_KEY }}
          GTC_DIST_KEY: ${{ secrets.GTC_DIST_KEY }}
          GTC_DIST_API_URL: ${{ secrets.GTC_DIST_API_URL }}
          BRIGHTID_PRIVATE_KEY: ${{ secrets.BRIGHTID_PRIVATE_KEY }}
          ALCHEMY_KEY: ${{ secrets.ALCHEMY_KEY }}
          AWS_STAR_GITCOIN_CERT: ${{ secrets.AWS_STAR_GITCOIN_CERT }}
          SENDGRID_API_KEY: ${{ secrets.SENDGRID_API_KEY }}

      # The static files are already bundled and located in the folder /code/app/static in the container
      - name: Copy static files to bucket
        run: |
          mkdir static_files_to_deploy
          mkdir docker_bin
          
          cat <<EOT >> docker_bin/static_files.sh
          #!/bin/bash
          cp -Rf /code/app/static/* /static_files_to_deploy/
          EOT

          docker run -v $(pwd)/static_files_to_deploy:/static_files_to_deploy -v $(pwd)/docker_bin:/code/app/bin -e DATABASE_URL=${{ steps.pulumi.outputs.rdsConnectionUrl }} ${{ needs.build-and-test.outputs.dockerTag }} sh /code/app/bin/static_files.sh
          
          echo "Syncing to bucket: ${{ steps.pulumi.outputs.bucketName }}"
          echo "Source folder: $(pwd)/static_files_to_deploy"

          aws s3 sync $(pwd)/static_files_to_deploy s3://${{ steps.pulumi.outputs.bucketName }}/static --acl public-read --delete
        env:
          # We need AWS_EC2_METADATA_DISABLED, because: https://github.com/actions/checkout/issues/440
          AWS_EC2_METADATA_DISABLED: true
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          BUNDLE_USE_CHECKSUM: 'false'