Continuous Deployment.yml

name: GitOps Continuous Deployment

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - '**.php'

run-name: ${{ github.workflow }} by @${{ github.actor }} from ${{ github.ref_name }}

env:
  APP_CONTAINER_REPO: ${{ vars.APP_CONTAINER_REPO }}
  K3S_FOLDER: "./k3s"
  K3S_REPOSITORY: "allysonsilva/blog-k3s"

jobs:

  short-sha:
    runs-on: ubuntu-latest
    outputs:
      value: ${{ steps.extract-short-sha.outputs.value }}
    steps:
      - name: Extrair os primeiros 7 caracteres do $GITHUB_SHA
        id: extract-short-sha
        run: echo "value=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT

  build:
    needs: short-sha
    if: (!contains(github.event.head_commit.message, 'skip deploy'))
    name: Deploy New Blog Version
    runs-on: ubuntu-latest

    env:
      APP_BUILD_CONTAINER_PATH: ${{ github.workspace }}/k3s/app/php

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Copy .dockerignore
        run: |-
          cd ${K3S_FOLDER} && make docker/config-env
          cp .dockerignore ./../

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Vultr Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ vars.VULTR_CONTAINER_REGISTRY_HOST }}
          username: ${{ secrets.VULTR_CONTAINER_REGISTRY_USERNAME }}
          password: ${{ secrets.VULTR_CONTAINER_REGISTRY_PASSWORD }}

      - name: Extract Docker metadata
        id: docker-app-metadata
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.APP_CONTAINER_REPO }}

      # Build and push Docker image with Buildx (don't push on PR)
      - name: Build && Push [FRONT-END]
        if: ${{ vars.WITH_BUILD_APP_FRONTEND == 'true' }} && github.event_name != 'pull_request'
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          target: frontend
          tags: ${{ env.APP_CONTAINER_REPO }}:frontend
          file: ${{ env.APP_BUILD_CONTAINER_PATH }}/Dockerfile
          cache-from: |
            type=gha,scope=frontend
            type=registry,ref=${{ env.APP_CONTAINER_REPO }}:frontend
          cache-to: |
            type=gha,mode=max,scope=frontend

      - name: Build && Push [EXTENSIONS + PACKAGES]
        if: ${{ vars.WITH_BUILD_APP_DEPENDENCIES == 'true' }} && github.event_name != 'pull_request'
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          target: dependencies
          tags: ${{ env.APP_CONTAINER_REPO }}:dependencies
          file: ${{ env.APP_BUILD_CONTAINER_PATH }}/Dockerfile
          cache-from: |
            type=gha,scope=dependencies
            type=registry,ref=${{ env.APP_CONTAINER_REPO }}:dependencies
          cache-to: |
            type=gha,mode=max,scope=dependencies

      - name: Build && Push [VENDOR]
        if: ${{ vars.WITH_BUILD_APP_VENDOR == 'true' }}
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          target: vendor
          tags: ${{ env.APP_CONTAINER_REPO }}:vendor
          file: ${{ env.APP_BUILD_CONTAINER_PATH }}/Dockerfile
          cache-from: |
            type=gha,scope=vendor
            type=registry,ref=${{ env.APP_CONTAINER_REPO }}:vendor
          cache-to: |
            type=gha,mode=max,scope=vendor

      - name: Build && Push [MAIN-APP] 🔥
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          target: main
          file: ${{ env.APP_BUILD_CONTAINER_PATH }}/Dockerfile
          # platforms: linux/amd64,linux/arm64
          build-args: |
            "GITHUB_SHA=$GITHUB_SHA"
            "GITHUB_REF=$GITHUB_REF"
          cache-from: |
            type=gha,scope=dependencies
            type=gha,scope=vendor
            type=gha,scope=frontend
            type=gha,scope=main
            type=registry,ref=${{ env.APP_CONTAINER_REPO }}:dependencies
            type=registry,ref=${{ env.APP_CONTAINER_REPO }}:vendor
            type=registry,ref=${{ env.APP_CONTAINER_REPO }}:frontend
            type=registry,ref=${{ env.APP_CONTAINER_REPO }}:latest
          cache-to: |
            type=gha,mode=max,scope=main
          tags: |
            ${{ env.APP_CONTAINER_REPO }}:latest
            ${{ env.APP_CONTAINER_REPO }}:${{ needs.short-sha.outputs.value }}

  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs:
      - short-sha
      - build

    steps:
      - name: Checkout K3S Code
        uses: actions/checkout@v2
        with:
          repository: ${{ env.K3S_REPOSITORY }}
          persist-credentials: false
          fetch-depth: 0
          ref: main

      - name: Setup Kustomize
        uses: imranismail/setup-kustomize@v2
        with:
          kustomize-version: "5.4.3"

      - name: Set $FULL_CONTAINER_REPO
        run: |
          # echo "SHORT_SHA=${GITHUB_SHA::7}" >> $GITHUB_ENV
          echo "FULL_CONTAINER_REPO=$APP_CONTAINER_REPO:${{ needs.short-sha.outputs.value }}" >> $GITHUB_ENV

      - name: Update Kubernetes manifests 🏗️
        run: |
          cd app/argocd/blog
          kustomize edit set image blog-image=$FULL_CONTAINER_REPO || true
          cat kustomization.yaml
          cd ../queue-worker
          kustomize edit set image queue-worker-image=$FULL_CONTAINER_REPO || true
          cat kustomization.yaml
          cd ../scheduler
          kustomize edit set image scheduler-image=$FULL_CONTAINER_REPO || true
          cat kustomization.yaml

      - name: Commit to GitHub
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git diff --quiet || git commit -am "ci: Rolling image to tag ${{ needs.short-sha.outputs.value }} 🚀"

      - name: Push - Update Kubernetes manifests 🚚
        uses: ad-m/github-push-action@master
        with:
          repository: ${{ env.K3S_REPOSITORY }}
          github_token: ${{ secrets.BLOG_K3S_PAT_TOKEN }}
          branch: main

      # https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-warp-to-tunnel/
      - name: Cloudflare Warp - ByPass GitHub Actions
        uses: Boostport/setup-cloudflare-warp@v1
        with:
          organization: ${{ secrets.CLOUDFLARE_ORGANIZATION }}
          auth_client_id: ${{ secrets.CLOUDFLARE_AUTH_CLIENT_ID }}
          auth_client_secret: ${{ secrets.CLOUDFLARE_AUTH_CLIENT_SECRET }}
          configure_docker_dns: true

      - name: 'Update APP - Deploy Blue-Green 🚀'
        uses: appleboy/ssh-action@v1.2.1
        with:
          # ssh-keygen -t ed25519 -b 4096 -C "github-actions-deployment" -f ~/.ssh/github_actions
          # Add ed25519 key into Authorized keys: cat ~/.ssh/github_actions.pub | ssh b@B 'cat >> .ssh/authorized_keys'
          host: ${{ secrets.SSH_HOST }}
          username: ${{ secrets.SSH_USER }}
          # Copy rsa Private key: cat ~/.ssh/github_actions | pbcopy
          key: ${{ secrets.SSH_CONTENT_PRIVATE_KEY }}
          port: ${{ secrets.SSH_PORT }}
          command_timeout: 1m
          script: |
            kubectl config set-context --current --namespace=argocd
            kubectl argo rollouts abort blog-rollout 2>/dev/null || true
            argocd app sync argocd/blog --async > /dev/null 2>&1 || true
            kubectl config set-context --current --namespace=default

  k3s:
    name: Update K3S Submodule
    runs-on: ubuntu-latest
    permissions:
      contents: write
    needs: deploy

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
        with:
          submodules: recursive

      - name: Git Submodule Update
        run: |
          git pull --recurse-submodules
          git submodule update --remote --recursive

      - name: Commit update
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git commit -am "Auto updated submodule references"

      - name: Push changes
        uses: ad-m/github-push-action@master
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}