kubernetes.yaml

name: Reusable Kubernetes with option to push images to Github or ECR
on:
  workflow_call:
    inputs:
      artifactName:
        required: false
        description: If provided, downloads a previously uploaded artifact (has to be in the same workflow). Both artifactPath and artifactName have to be passed.
        default: ""
        type: string
      artifactPath:
        required: false
        description: If provided, downloads a previously uploaded artifact (has to be in the same workflow). Both artifactPath and artifactName have to be passed.
        default: ""
        type: string
      botEmail:
        required: false
        description: The email of the bot that will appear in the GitOps commit
        default: dev.bot@parcellab.com
        type: string
      deploymentRepoPath:
        required: false
        description: The path within the deployment repository that holds all version files
        default: namespaces
        type: string
      deploymentRepoValuesPath:
        required: false
        description: The path within the deployment repository that holds all values files
        default: ""
        type: string
      deploymentRepoURL:
        required: false
        description: The repository within Github that holds the version file to deploy via GitOps
        default: parcelLab/deployment
        type: string
      imageTargets:
        required: false
        description: If provided, sets targets for as many image builds as targets specified. When bakeFile is provided, these are Docker Buildx Bake targets.
        default: ""
        type: string
      bakeFile:
        required: false
        description: If provided, builds the imageTargets with Docker Buildx Bake instead of docker/build-push-action.
        default: ""
        type: string
      preScript:
        required: false
        description: If provided, runs a script after repo checkout and before the docker image is built. Useful in case that you need to build a package outside of the docker image (and load the artifacts via copy).
        default: ""
        type: string
      registryUsername:
        required: false
        description: The username for the container registry
        default: parcellab-dev-bot
        type: string
      enableContainerScan:
        required: false
        description: Apply the container scan
        default: true
        type: boolean
      runner:
        required: false
        description: Runner type
        default: ubuntu-latest
        type: string
      timeoutMinutes:
        required: false
        description: Maximum minutes before the job is cancelled
        default: 40
        type: number
      sentryOrg:
        required: false
        description: The Sentry organization that will hold the deployment
        default: ""
        type: string
      sentryProject:
        required: false
        description: The slug of the organization name in Sentry
        default: ""
        type: string
      sentryUrl:
        required: false
        description: The URL used to connect to Sentry. (Only required for Self-Hosted Sentry).
        default: "https://sentry.io/"
        type: string
      sentryEnvironment:
        required: false
        description: Slug of the environment used by the application to report error to Sentry
        default: ""
        type: string
      slackChannelProd:
        required: false
        description: The Slack channel id to show production deployments
        default: ""
        type: string
      slackChannelStaging:
        required: false
        description: The Slack channel id to show staging deployments
        default: ""
        type: string
      slackChannelTest:
        required: false
        description: The Slack channel id to show test deployments
        default: ""
        type: string
      versionFilePath:
        required: false
        description: The relative file path to the folder that holds the application Kubernetes values
        default: values.yaml
        type: string
      appName:
        required: false
        description: Application name fallback for non-deployment validation runs
        default: ""
        type: string
      env:
        required: false
        description: Environment fallback for non-deployment validation runs
        default: test
        type: string
      ref:
        required: false
        description: Git ref fallback for non-deployment validation runs
        default: ""
        type: string
      sha:
        required: false
        description: Git SHA fallback for non-deployment validation runs
        default: ""
        type: string
      versionKey:
        required: false
        description: Values key fallback for non-deployment validation runs
        default: ""
        type: string
      pushToEnvTag:
        required: false
        description: Whether to push the env tag in the GitOps commit step
        default: false
        type: boolean
      containerContext:
        required: false
        description: Container context fallback for non-deployment validation runs
        default: .
        type: string
      containerFile:
        required: false
        description: Container file fallback for non-deployment validation runs
        default: Containerfile
        type: string
    secrets:
      npmGithubReadToken:
        required: false
        description: The Github token with permissions to read NPM private packages
      repoAccessToken:
        required: false
        description: The Github token to perform operations cross-repo (not github.token!)
      slackBotToken:
        required: false
        description: The Slack bot token to write messages in the desired channels (required if slack channel ids are provided)
      sentryAuthToken:
        required: false
        description: Authentication token for Sentry
jobs:
  initialize:
    environment: ${{ github.event.deployment.payload.env || inputs.env }}
    runs-on: ${{ inputs.runner }}
    timeout-minutes: ${{ inputs.timeoutMinutes }}
    outputs:
      channel-id: ${{ steps.vars.outputs.channel-id }}
      version: ${{ steps.vars.outputs.version }}
    steps:
      - name: Check if 'env' input is provided
        run: |
          DEPLOY_ENV="${{ github.event.deployment.payload.env || inputs.env }}"
          if [ -z "$DEPLOY_ENV" ]; then
            echo "ERROR: 'env' input is missing or empty!"
            exit 1
          fi
      - name: Load deployment variables
        id: vars
        run: |
          REF="${{ github.event.deployment.ref || inputs.ref }}"
          SHA="${{ github.event.deployment.sha || inputs.sha || github.sha }}"
          DEPLOY_ENV="${{ github.event.deployment.payload.env || inputs.env }}"
          if [[ "$DEPLOY_ENV" == 'prod' ]]
          then
            # shellcheck disable=SC2086
            echo "version=${REF##*/}" >> $GITHUB_OUTPUT
            # shellcheck disable=SC2086
            echo "channel-id=${{ inputs.slackChannelProd }}" >> $GITHUB_OUTPUT
          elif [[ "$DEPLOY_ENV" == 'test' ]]
          then
            # shellcheck disable=SC2086
            echo "version=${SHA:0:7}" >> $GITHUB_OUTPUT
            # shellcheck disable=SC2086
            echo "channel-id=${{ inputs.slackChannelTest }}" >> $GITHUB_OUTPUT
          else
            # shellcheck disable=SC2086
            echo "version=${SHA:0:7}" >> $GITHUB_OUTPUT
            # shellcheck disable=SC2086
            echo "channel-id=${{ inputs.slackChannelStaging }}" >> $GITHUB_OUTPUT
          fi
      - name: Start ${{ github.event.deployment.payload.name || inputs.appName }} deployment
        if: github.event_name == 'deployment'
        uses: chrnorm/deployment-status@v2
        with:
          deployment-id: ${{ github.event.deployment.id }}
          environment-url: ${{ github.event.deployment.payload.url }}
          environment: ${{ github.event.deployment.payload.env }}
          state: "in_progress"
          token: ${{ github.token }}

  build:
    needs: [initialize]
    uses: parcelLab/ci/.github/workflows/build-image.yaml@v9
    with:
      artifactName: ${{ inputs.artifactName }}
      artifactPath: ${{ inputs.artifactPath }}
      bakeFile: ${{ inputs.bakeFile }}
      imageTargets: ${{ inputs.imageTargets }}
      preScript: ${{ inputs.preScript }}
      enableContainerScan: ${{ inputs.enableContainerScan }}
      runner: ${{ inputs.runner }}
      timeoutMinutes: ${{ inputs.timeoutMinutes }}
      version: ${{ needs.initialize.outputs.version }}
      appName: ${{ github.event.deployment.payload.name || inputs.appName }}
      env: ${{ github.event.deployment.payload.env || inputs.env }}
      containerContext: ${{ github.event.deployment.payload.container.context || inputs.containerContext }}
      containerFile: ${{ github.event.deployment.payload.container.file || inputs.containerFile }}
    secrets:
      npmGithubReadToken: ${{ secrets.npmGithubReadToken }}

  commit:
    needs: [initialize, build]
    environment: ${{ github.event.deployment.payload.env || inputs.env }}
    concurrency:
      group: commit-${{ inputs.deploymentRepoURL }}-${{ github.event.deployment.payload.env || inputs.env }}
    runs-on: ${{ inputs.runner }}
    timeout-minutes: ${{ inputs.timeoutMinutes }}
    steps:
      - name: Checkout ${{ inputs.deploymentRepoURL }} git repository
        uses: actions/checkout@v7
        with:
          repository: ${{ inputs.deploymentRepoURL }}
          path: remote
          token: ${{ secrets.repoAccessToken }}
          ref: main
      - name: Deploy ${{ github.sha }} to ${{ github.event.deployment.environment || inputs.env }} values
        uses: mikefarah/yq@v4.53.2
        with:
          cmd: yq '(.${{ github.event.deployment.payload.kubernetes.versionKey || inputs.versionKey }} = "${{ needs.initialize.outputs.version }}")' -i remote/${{ inputs.deploymentRepoPath }}/values.yaml
      - name: Commit and push new image tag
        run: |
          set -euxo pipefail
          cd remote
          git config user.email "$GIT_USER_EMAIL"
          git config user.name "$GIT_USER_NAME"
          git add .
          git commit -m "chore(deploy): set $ENV image tag to $VERSION"
          if [ "$PUSH_TO_ENV_TAG" = "true" ]; then
            echo "Set new image tag to $ENV"
            NEW_SHA=$(git rev-parse HEAD)
            git tag -fa "$ENV" -m "$ENV deploy $VERSION ($NEW_SHA)" "$NEW_SHA"
            git push origin -f "refs/tags/$ENV"
          else
            git push origin main
          fi
        env:
          GIT_USER_EMAIL: dev.bot@parcellab.com
          GIT_USER_NAME: parcellab-dev-bot
          ENV: ${{ github.event.deployment.payload.env || inputs.env }}
          VERSION: ${{ needs.initialize.outputs.version }}
          PUSH_TO_ENV_TAG: ${{ github.event.deployment.payload.pushToEnvTag || inputs.pushToEnvTag }}
      - if: success() && github.event_name == 'deployment'
        name: Successful ${{ github.event.deployment.payload.name || inputs.appName }} deployment
        uses: chrnorm/deployment-status@v2
        with:
          deployment-id: ${{ github.event.deployment.id }}
          environment-url: ${{ github.event.deployment.payload.url }}
          environment: ${{ github.event.deployment.payload.env }}
          state: "success"
          token: ${{ github.token }}
      - if: failure() && github.event_name == 'deployment'
        name: Failed ${{ github.event.deployment.payload.name || inputs.appName }} deployment
        uses: chrnorm/deployment-status@v2
        with:
          deployment-id: ${{ github.event.deployment.id }}
          environment-url: ${{ github.event.deployment.payload.url }}
          environment: ${{ github.event.deployment.payload.env }}
          state: "failure"
          token: ${{ github.token }}
      - if: success() && github.event_name == 'deployment' && needs.initialize.outputs.channel-id != ''
        name: Notify ${{ github.event.deployment.payload.name || inputs.appName }} deployment success
        continue-on-error: true
        uses: darioblanco/slack-deployment@main
        env:
          SLACK_BOT_TOKEN: ${{ secrets.slackBotToken }}
        with:
          channel_id: ${{ needs.initialize.outputs.channel-id }}
          deployment_description: ${{ github.event.deployment.payload.description == null && 'No description' || github.event.deployment.payload.description }}
          deployment_name: ${{ github.event.deployment.payload.name == null && 'unknown' || github.event.deployment.payload.name }}
          environment: ${{ github.event.deployment.payload.env == null && 'unknown' || github.event.deployment.payload.env }}
          owner: ${{ github.event.deployment.payload.author == null && inputs.registryUsername || github.event.deployment.payload.author }}
          package: ${{ github.event.deployment.payload.name == null && 'unknown' || github.event.deployment.payload.name }}
          ref: ${{ github.event.deployment.ref == null && 'unknown' || github.event.deployment.ref }}
          repo: ${{ github.repository }}
          sha: ${{ github.sha }}
          status_url: ${{ github.event.deployment.payload.statusUrl == null && 'https://github.com' || github.event.deployment.payload.statusUrl }}
          url: ${{ github.event.deployment.payload.url == null && 'https://github.com' || github.event.deployment.payload.url }}
          version: ${{ needs.initialize.outputs.version }}
      - if: success() && inputs.sentryOrg != '' && inputs.sentryProject != ''
        name: Create Sentry release
        uses: getsentry/action-release@v3
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.sentryAuthToken }}
          SENTRY_ORG: ${{ inputs.sentryOrg }}
          SENTRY_PROJECT: ${{ inputs.sentryProject }}
          SENTRY_URL: ${{ inputs.sentryUrl }}
        with:
          environment: ${{ inputs.sentryEnvironment != '' && inputs.sentryEnvironment || github.event.deployment.payload.env || inputs.env }}
          set_commits: skip
          version: ${{ needs.initialize.outputs.version }}
        continue-on-error: true
      - name: Clean up images
        uses: actions/delete-package-versions@v5
        with:
          package-name: ${{ github.event.deployment.payload.name || inputs.appName }}
          package-type: container
          min-versions-to-keep: "500"
          token: ${{ secrets.repoAccessToken }}
        continue-on-error: true