From 618c331b2ac67c496c3a3dcf16c31826cd7512ef Mon Sep 17 00:00:00 2001 From: Rajat Ahuja Date: Mon, 10 Aug 2026 13:11:59 -0400 Subject: [PATCH] chore: update gcp/fly deployment yamls (#1005) * chore: update gcp/fly deployment yamls * fix: coderabbit comments --- .github/workflows/fly-deploy-prod.yml | 61 ------------------- .github/workflows/fly-deploy.yml | 61 ------------------- .github/workflows/push-gcp-registry-prod.yml | 52 +++++++++++----- .../workflows/push-gcp-registry-staging.yml | 52 +++++++++++----- 4 files changed, 74 insertions(+), 152 deletions(-) delete mode 100644 .github/workflows/fly-deploy-prod.yml delete mode 100644 .github/workflows/fly-deploy.yml diff --git a/.github/workflows/fly-deploy-prod.yml b/.github/workflows/fly-deploy-prod.yml deleted file mode 100644 index b13da23e..00000000 --- a/.github/workflows/fly-deploy-prod.yml +++ /dev/null @@ -1,61 +0,0 @@ -# See https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/ - -name: Fly Deploy (Production Environment) -permissions: - contents: read -on: - push: - tags: - - v* - workflow_dispatch: - inputs: - version: - description: "Version to deploy (without v prefix)" - required: true - type: string - default: 'manual' - -jobs: - deploy-honcho-prod-image: - name: Deploy Honcho Image (Production Environment) - runs-on: ubuntu-latest - concurrency: - group: deploy-prod-group - cancel-in-progress: true - steps: - - uses: actions/checkout@v4 - - uses: superfly/flyctl-actions/setup-flyctl@1.5 - - run: | - # Determine the image label based on trigger type - if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then - IMAGE_LABEL="deployment-${{ github.event.inputs.version }}" - else - IMAGE_LABEL="deployment-${{ github.ref_name }}" - fi - flyctl deploy -a honcho-prod-image --remote-only --build-only --push --no-cache --image-label "$IMAGE_LABEL" - env: - FLY_API_TOKEN: ${{ secrets.FLY_PROD_API_TOKEN }} - - prompt-service: - name: Push to Service (Production Environment) - needs: deploy-honcho-prod-image - runs-on: ubuntu-latest - steps: - - name: Send POST request - env: - GITHUB_REF_NAME: ${{ github.ref_name }} - run: | - # Determine version and image label based on trigger type - if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then - TAG="${{ github.event.inputs.version }}" - IMAGE_LABEL="honcho-prod-image:deployment-${{ github.event.inputs.version }}" - else - TAG=${GITHUB_REF_NAME#v} - IMAGE_LABEL="honcho-prod-image:deployment-${GITHUB_REF_NAME}" - fi - - curl --fail -X POST \ - -H "Content-Type: application/json" \ - -H "Authorization: Bearer ${{ secrets.PROD_ENV_WEBHOOK_SECRET }}" \ - -d "{\"version\":\"$TAG\",\"image_label\":\"$IMAGE_LABEL\"}" \ - "${{ secrets.PROD_ENV_URL }}/webhooks/v1/add_honcho_version" diff --git a/.github/workflows/fly-deploy.yml b/.github/workflows/fly-deploy.yml deleted file mode 100644 index 2a3cbc8c..00000000 --- a/.github/workflows/fly-deploy.yml +++ /dev/null @@ -1,61 +0,0 @@ -# See https://fly.io/docs/app-guides/continuous-deployment-with-github-actions/ - -name: Fly Deploy (Test Environment) -permissions: - contents: read -on: - push: - tags: - - v* - workflow_dispatch: - inputs: - version: - description: "Version to deploy (without v prefix)" - required: true - type: string - default: 'manual' - -jobs: - deploy-honcho-image: - name: Deploy Honcho Image (Test Environment) - runs-on: ubuntu-latest - concurrency: - group: deploy-test-group - cancel-in-progress: true - steps: - - uses: actions/checkout@v4 - - uses: superfly/flyctl-actions/setup-flyctl@1.5 - - run: | - # Determine the image label based on trigger type - if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then - IMAGE_LABEL="deployment-${{ github.event.inputs.version }}" - else - IMAGE_LABEL="deployment-${{ github.ref_name }}" - fi - flyctl deploy -a honcho-image --remote-only --build-only --push --no-cache --image-label "$IMAGE_LABEL" - env: - FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }} - - prompt-service: - name: Push to Service (Test Environment) - runs-on: ubuntu-latest - needs: deploy-honcho-image - steps: - - name: Send POST request - env: - GITHUB_REF_NAME: ${{ github.ref_name }} - run: | - # Determine version and image label based on trigger type - if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then - TAG="${{ github.event.inputs.version }}" - IMAGE_LABEL="honcho-image:deployment-${{ github.event.inputs.version }}" - else - TAG=${GITHUB_REF_NAME#v} - IMAGE_LABEL="honcho-image:deployment-${GITHUB_REF_NAME}" - fi - - curl --fail -X POST \ - -H "Content-Type: application/json" \ - -H "Authorization: Bearer ${{ secrets.TEST_ENV_WEBHOOK_SECRET }}" \ - -d "{\"version\":\"$TAG\",\"image_label\":\"$IMAGE_LABEL\"}" \ - "${{ secrets.TEST_ENV_URL }}/webhooks/v1/add_honcho_version" diff --git a/.github/workflows/push-gcp-registry-prod.yml b/.github/workflows/push-gcp-registry-prod.yml index d5d9fc42..81195928 100644 --- a/.github/workflows/push-gcp-registry-prod.yml +++ b/.github/workflows/push-gcp-registry-prod.yml @@ -7,13 +7,6 @@ on: push: tags: - v* - workflow_dispatch: - inputs: - version: - description: "Version to deploy (without v prefix)" - required: true - type: string - default: "manual" env: GCP_PROJECT_ID: ${{ secrets.PROD_GCP_PROJECT_ID }} @@ -25,9 +18,26 @@ env: jobs: build-and-push: runs-on: ubuntu-latest + outputs: + version: ${{ steps.version.outputs.version }} steps: - name: Checkout uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Resolve and verify version + id: version + run: | + VERSION="${GITHUB_REF_NAME#v}" + # A running instance serves this version at /openapi.json, so it must + # match the version being deployed. + PYPROJECT_VERSION="$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)" + if [[ "$VERSION" != "$PYPROJECT_VERSION" ]]; then + echo "::error::pyproject.toml version '$PYPROJECT_VERSION' does not match tag '$GITHUB_REF_NAME'. Bump pyproject.toml before tagging." + exit 1 + fi + echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Authenticate to GCP uses: google-github-actions/auth@v2 @@ -42,15 +52,27 @@ jobs: - name: Build and push image env: - VERSION: ${{ github.event.inputs.version }} + VERSION: ${{ steps.version.outputs.version }} run: | - # Determine the image label based on trigger type - if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then - IMAGE_LABEL="deployment-${VERSION}" - else - IMAGE_LABEL="deployment-${GITHUB_REF_NAME}" - fi BASE="${{ env.GCP_AR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GCP_AR_REPO }}/${{ env.IMAGE_NAME }}" - TAG="$BASE:$IMAGE_LABEL" + TAG="$BASE:deployment-v${VERSION}" docker build -t "$TAG" . docker push "$TAG" + + prompt-service: + name: Push to Service (Production Environment) + runs-on: ubuntu-latest + needs: build-and-push + steps: + - name: Send POST request + env: + VERSION: ${{ needs.build-and-push.outputs.version }} + run: | + # Name and tag only; the registry path is supplied downstream. + IMAGE_LABEL="${{ env.IMAGE_NAME }}:deployment-v${VERSION}" + + curl --fail --connect-timeout 10 --max-time 60 -X POST \ + -H "Content-Type: application/json" \ + -H "Authorization: Bearer ${{ secrets.PROD_ENV_WEBHOOK_SECRET }}" \ + -d "{\"version\":\"$VERSION\",\"image_label\":\"$IMAGE_LABEL\"}" \ + "${{ secrets.PROD_ENV_URL }}/webhooks/v1/add_honcho_version" diff --git a/.github/workflows/push-gcp-registry-staging.yml b/.github/workflows/push-gcp-registry-staging.yml index f41a38de..636f9a4c 100644 --- a/.github/workflows/push-gcp-registry-staging.yml +++ b/.github/workflows/push-gcp-registry-staging.yml @@ -7,13 +7,6 @@ on: push: tags: - v* - workflow_dispatch: - inputs: - version: - description: "Version to deploy (without v prefix)" - required: true - type: string - default: "manual" env: GCP_PROJECT_ID: ${{ secrets.STAGING_GCP_PROJECT_ID }} @@ -25,9 +18,26 @@ env: jobs: build-and-push: runs-on: ubuntu-latest + outputs: + version: ${{ steps.version.outputs.version }} steps: - name: Checkout uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Resolve and verify version + id: version + run: | + VERSION="${GITHUB_REF_NAME#v}" + # A running instance serves this version at /openapi.json, so it must + # match the version being deployed. + PYPROJECT_VERSION="$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)" + if [[ "$VERSION" != "$PYPROJECT_VERSION" ]]; then + echo "::error::pyproject.toml version '$PYPROJECT_VERSION' does not match tag '$GITHUB_REF_NAME'. Bump pyproject.toml before tagging." + exit 1 + fi + echo "version=$VERSION" >> "$GITHUB_OUTPUT" - name: Authenticate to GCP uses: google-github-actions/auth@v2 @@ -42,15 +52,27 @@ jobs: - name: Build and push image env: - VERSION: ${{ github.event.inputs.version }} + VERSION: ${{ steps.version.outputs.version }} run: | - # Determine the image label based on trigger type - if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then - IMAGE_LABEL="deployment-${VERSION}" - else - IMAGE_LABEL="deployment-${GITHUB_REF_NAME}" - fi BASE="${{ env.GCP_AR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GCP_AR_REPO }}/${{ env.IMAGE_NAME }}" - TAG="$BASE:$IMAGE_LABEL" + TAG="$BASE:deployment-v${VERSION}" docker build -t "$TAG" . docker push "$TAG" + + prompt-service: + name: Push to Service (Staging Environment) + runs-on: ubuntu-latest + needs: build-and-push + steps: + - name: Send POST request + env: + VERSION: ${{ needs.build-and-push.outputs.version }} + run: | + # Name and tag only; the registry path is supplied downstream. + IMAGE_LABEL="${{ env.IMAGE_NAME }}:deployment-v${VERSION}" + + curl --fail --connect-timeout 10 --max-time 60 -X POST \ + -H "Content-Type: application/json" \ + -H "Authorization: Bearer ${{ secrets.TEST_ENV_WEBHOOK_SECRET }}" \ + -d "{\"version\":\"$VERSION\",\"image_label\":\"$IMAGE_LABEL\"}" \ + "${{ secrets.TEST_ENV_URL }}/webhooks/v1/add_honcho_version"