[GH-171] - Update deploy.yml to Send Notifications to Microsoft Teams and Align with Other Repos #173
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -3,38 +3,43 @@ name: Deploy the UW Directory | |
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| target-stage: | ||
| required: true | ||
| default: eval | ||
| description: > | ||
| (target-stage) | ||
| Which cluster you want to deploy to. | ||
| Choose from dev, eval, prod. | ||
| target-version: | ||
| required: false | ||
| description: > | ||
| (target-version) | ||
| The semver you want to deploy. If you do not provide this, the workflow | ||
| will promote from the "previous" cluster (dev -> eval, eval -> prod). | ||
| associated-record: | ||
| required: false | ||
| description: > | ||
| (associated-record) | ||
| Only required if target-stage is prod. | ||
| A link to an RFC, Jira, or other document associated | ||
| with this change. | ||
|
|
||
| env: | ||
| GCLOUD_TOKEN: ${{ secrets.GCR_TOKEN }} | ||
| UW_DIRECTORY_DEPLOY_MS_TEAMS_WEBHOOK_URL: ${{ secrets.UW_DIRECTORY_DEPLOY_MS_TEAMS_WEBHOOK_URL }} | ||
|
|
||
| jobs: | ||
|
There was a problem hiding this comment. "creates a slack notification for the deployment (except for developer instances)" There was a problem hiding this comment. Yes, great call @goulter - Thanks! It's handled here: https://github.com/UWIT-IAM/uw-husky-directory/pull/173/files#diff-28802fbf11c83a2eee09623fb192785e7ca92a3f40602a517c011b947a1822d3L167 + - name: Notify Teams of Deployment Start
+ # creates MS Teams notification for the deployment (except for developer instances),
+ if: env.target_stage == 'dev' || env.target_stage == 'eval' || env.target_stage == 'prod'Just to confirm, do we have developer instances like identity.UW? Either way, this won't send notifications if we create them in the future. :) There was a problem hiding this comment. Oh, thats a great point. There are no developer instances of the directory. |
||
| # The `configure` job reconciles the target version (if it wasn't explicitly provided) | ||
| # and prepares the deployment context. Additionally, a Teams notification is sent at the | ||
| # start of the deployment in the `deploy` job, and another notification is sent upon | ||
| # deployment completion (regardless of success or failure) in the `notify-teams-finish` job. | ||
| configure: | ||
| env: | ||
| target_stage: ${{ github.event.inputs.target-stage }} | ||
| target_version: ${{ github.event.inputs.target-version }} | ||
| associated_record: ${{ github.event.inputs.associated-record }} | ||
| outputs: | ||
| target-version: ${{ steps.reconcile-version.outputs.target-version }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
|
|
@@ -43,26 +48,28 @@ jobs: | |
| # currently validate this record, because endpoints usually require | ||
| # authentication. | ||
| - name: Verify prod deployment record | ||
| if: github.event.inputs.target-stage == 'prod' | ||
| run: | | ||
| if [[ -z "${{ env.associated_record }}" ]] | ||
| then | ||
| echo "Deployment to prod requires a link to an associated record" | ||
| exit 1 | ||
| fi | ||
| # If the entity who created this deployment did not provide a version, | ||
| # we will derive the version from the target stage's "previous" environment. | ||
| # This means that deployments to eval will promote from dev, and deployments | ||
| # to prod will promote from eval. It's OK if the same version is re-deployed, | ||
| # it will have the same net effect of a `kubectl rollout restart`. | ||
| # If the entity does provide a semver (target_version), that is used. | ||
|
|
||
| # Output: `target-version`: The reconciled version to deploy. | ||
| - name: Reconcile target deployment version | ||
| id: reconcile-version | ||
| run: | | ||
| set -x | ||
| if [[ -z "${{ env.target_version }}" ]] | ||
| then | ||
| case "${target_stage}" in | ||
| prod) | ||
| source_stage=eval | ||
| ;; | ||
|
|
@@ -73,73 +80,20 @@ jobs: | |
| source_stage=dev | ||
| ;; | ||
| esac | ||
| target_version=$(./scripts/get-deployed-version.sh -s ${target_stage}) | ||
|
|
||
| if [[ "${source_stage}" == "poetry" ]] | ||
| then | ||
| source ./scripts/globals.sh | ||
| target_version=$(get_poetry_version) | ||
| else | ||
| target_version=$(./scripts/get-deployed-version.sh -s ${source_stage}) | ||
| fi | ||
| else | ||
| target_version="${{ env.target_version }}" | ||
|
There was a problem hiding this comment. can you clarify the change? (lines 84/93) There was a problem hiding this comment. @goulter : It is used to directly set the For more details please check https://github.com/UWIT-IAM/identity-uw/blob/develop/.github/workflows/deploy-from-ui.yml#L98 There was a problem hiding this comment. I should have been more specific. Why not keep There was a problem hiding this comment. The change from In this case, we've already confirmed that The original code would ignore the user-provided version and always pull from the source stage, which defeats the purpose of allowing version specification through the input variable. This change allows for two clear paths:
I've also made this diagram to help visually understand the logic: 
There was a problem hiding this comment. Oh, so, the existing code was broke, lovely. Thanks for fixing it. |
||
| fi | ||
| echo "***target_version=${target_version}" >> $GITHUB_OUTPUT | ||
| echo "::set-output name=target-version::${target_version}" | ||
|
|
||
| # The deploy job simply runs the deploy script. This script will wait for | ||
| # deployments to complete before exiting. If the deployment times out, | ||
|
|
@@ -155,52 +109,159 @@ jobs: | |
| cancel-in-progress: false | ||
| env: | ||
| target_version: ${{ needs.configure.outputs.target-version }} | ||
| target_stage: ${{ github.event.inputs.target-stage }} | ||
| associated_record: ${{ github.event.inputs.associated-record }} | ||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
| - name: Notify Teams of Deployment Start | ||
| run: | | ||
| associated_record="${{ github.event.inputs.associated-record }}" | ||
| target_stage="${{ github.event.inputs.target-stage }}" | ||
|
|
||
| # Determine associated record value based on target stage and input | ||
| if [ -z "$associated_record" ]; then | ||
| if [ "$target_stage" != "prod" ]; then | ||
| associated_record="Not required (deployment to $target_stage)" | ||
| else | ||
| associated_record="Missing (required for production)" | ||
| fi | ||
| fi | ||
|
|
||
| curl -H "Content-Type: application/json" \ | ||
| -d '{ | ||
| "type": "message", | ||
| "attachments": [ | ||
| { | ||
| "contentType": "application/vnd.microsoft.card.adaptive", | ||
| "content": { | ||
| "$schema": "http://adaptivecards.io/schemas/adaptive-card.json", | ||
| "type": "AdaptiveCard", | ||
| "version": "1.4", | ||
| "body": [ | ||
| { | ||
| "type": "TextBlock", | ||
| "size": "Large", | ||
| "weight": "Bolder", | ||
| "text": "UW Directory - Deployment Notification" | ||
| }, | ||
| { | ||
| "type": "TextBlock", | ||
| "text": "Deployment to stage **${{ github.event.inputs.target-stage }}** is starting.", | ||
| "wrap": true | ||
| }, | ||
| { | ||
| "type": "FactSet", | ||
| "facts": [ | ||
| {"title": "Stage:", "value": "${{ github.event.inputs.target-stage }}"}, | ||
| {"title": "Version:", "value": "${{ needs.configure.outputs.target-version }}"}, | ||
| {"title": "Associated Record:", "value": "'"${associated_record}"'"}, | ||
| {"title": "Initiated By:", "value": "${{ github.actor }}"} | ||
| ] | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| }' \ | ||
| "${{ env.UW_DIRECTORY_DEPLOY_MS_TEAMS_WEBHOOK_URL }}" | ||
|
|
||
| - name: Set up Python 3.10 | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: '3.10' | ||
|
|
||
| - name: Install Poetry with pip | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| python -m pip install poetry | ||
| poetry --version | ||
|
|
||
| - name: Run Poetry Install | ||
| run: | | ||
| sudo apt-get -y install jq | ||
| poetry install --no-root | ||
|
|
||
| - uses: actions/checkout@v3 | ||
| - uses: ./.github/actions/configure-docker | ||
| with: | ||
| project-name: ${{ secrets.IAM_GCR_REPO }} | ||
| gcr-token: ${{ secrets.GCR_TOKEN }} | ||
| - run: | | ||
| gcloud auth activate-service-account --key-file=${GOOGLE_APPLICATION_CREDENTIALS} | ||
| ./scripts/deploy.sh -g -t ${target_stage} -v ${target_version} -r "${{ github.event.inputs.associated-record }}" | ||
| # probably need to account for -x, --dry-run at some point. lets see how things go. | ||
|
|
||
| notify-teams-finish: | ||
| runs-on: ubuntu-latest | ||
| needs: [ configure, deploy ] | ||
| steps: | ||
| - name: Notify Teams of Deployment Completion | ||
| if: always() # This step runs regardless of success or failure | ||
| run: | | ||
| deploy_result="${{ needs.deploy.result }}" | ||
| deploy_status="Failed" | ||
| associated_record="${{ github.event.inputs.associated-record }}" | ||
| target_stage="${{ github.event.inputs.target-stage }}" | ||
|
|
||
| if [ "$deploy_result" == "success" ]; then | ||
| deploy_status="Succeeded" | ||
| fi | ||
|
|
||
| # Determine associated record value based on target stage and input | ||
| if [ -z "$associated_record" ]; then | ||
| if [ "$target_stage" != "prod" ]; then | ||
| associated_record="Not required (deployment to $target_stage)" | ||
| else | ||
| associated_record="Missing (required for production)" | ||
| fi | ||
| fi | ||
|
|
||
| curl -H "Content-Type: application/json" \ | ||
| -d '{ | ||
| "type": "message", | ||
| "attachments": [ | ||
| { | ||
| "contentType": "application/vnd.microsoft.card.adaptive", | ||
| "content": { | ||
| "$schema": "http://adaptivecards.io/schemas/adaptive-card.json", | ||
| "type": "AdaptiveCard", | ||
| "version": "1.4", | ||
| "body": [ | ||
| { | ||
| "type": "TextBlock", | ||
| "size": "Large", | ||
| "weight": "Bolder", | ||
| "text": "UW Directory - Deployment Notification" | ||
| }, | ||
| { | ||
| "type": "TextBlock", | ||
| "text": "Deployment to stage **${{ github.event.inputs.target-stage }}** has **'"$deploy_status"'**.", | ||
| "wrap": true | ||
| }, | ||
| { | ||
| "type": "FactSet", | ||
| "facts": [ | ||
| {"title": "Stage:", "value": "${{ github.event.inputs.target-stage }}"}, | ||
| {"title": "Version:", "value": "${{ needs.configure.outputs.target-version }}"}, | ||
| {"title": "Associated Record:", "value": "'"${associated_record}"'"}, | ||
| {"title": "Initiated By:", "value": "${{ github.actor }}"}, | ||
| {"title": "Status:", "value": "'"$deploy_status"'"} | ||
| ] | ||
| } | ||
| ], | ||
| "actions": [ | ||
| { | ||
| "type": "Action.OpenUrl", | ||
| "title": "View Workflow", | ||
| "url": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| }' \ | ||
| "${{ env.UW_DIRECTORY_DEPLOY_MS_TEAMS_WEBHOOK_URL }}" | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Reference #identity-uw