Skip to content

Deploy through the fleet repo instead of a self-hosted runner #1857

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hahn-kev merged 1 commit into from
Oct 22, 2026
Merged

Deploy through the fleet repo instead of a self-hosted runner #1857

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
70 changes: 60 additions & 10 deletions .github/workflows/integrate-and-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,19 @@ on:
image-tag-next-app:
type: string
required: true
k8s-environment:
description: "Folder under languageforge/ in the fleet repo to deploy to: staging or production"
type: string
required: true
deploy-domain:
description: "The domain the environment is served from, shown on the deployment"
type: string
required: true

# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets
secrets:
kube-context:
fleet-repo-ssh-key:
description: "Deploy key with write access to the fleet repo named by the FLEET_REPO repository variable"
required: true
image-repo-username:
required: true
Expand Down Expand Up @@ -78,7 +87,7 @@ jobs:
run: make unit-tests-ci
-
name: Log in to Docker Hub
uses: docker/login-action@v2
uses: docker/login-action@v3
with:
username: ${{ secrets.image-repo-username }}
password: ${{ secrets.image-repo-password }}
Expand All @@ -95,6 +104,7 @@ jobs:
run: docker push --all-tags ${{ steps.image.outputs.NAMESPACE }}

outputs:
TAG_LFMERGE: ${{ steps.image.outputs.TAG_LFMERGE }}
IMAGE_APP: ${{ steps.image.outputs.NAMESPACE }}:${{ steps.image.outputs.TAG_APP }}
IMAGE_PROXY: ${{ steps.image.outputs.NAMESPACE }}:${{ steps.image.outputs.TAG_PROXY }}
IMAGE_NEXT_APP: ${{ steps.image.outputs.NAMESPACE }}:${{ steps.image.outputs.TAG_NEXT_APP }}
Expand All @@ -104,16 +114,56 @@ jobs:
uses: ./.github/workflows/e2e-tests.yml

deploy:
runs-on: [self-hosted, languageforge]
# Deploys by bumping the image tags in the fleet repo (vars.FLEET_REPO, the
# same repo LexBox deploys through). Fleet watches that repo and rolls the
# cluster forward; nothing here talks to Kubernetes directly.
#
# The deploy checks out and pushes to the fleet repo, so two deploys to the
# same environment at once could conflict on push. Serialise per environment.
concurrency: ${{ inputs.k8s-environment }}
runs-on: ubuntu-latest

needs: [integrate, e2e-tests]

environment:
name: ${{ inputs.k8s-environment }}
url: https://${{ inputs.deploy-domain }}

steps:
-
uses: sillsdev/common-github-actions/install-kubectl@v1
-
run: |
kubectl --context ${{ secrets.kube-context }} -n languageforge set image deployment/app app=${{ needs.integrate.outputs.IMAGE_APP }}
kubectl --context ${{ secrets.kube-context }} -n languageforge set image deployment/next-proxy next-proxy=${{ needs.integrate.outputs.IMAGE_PROXY }}
kubectl --context ${{ secrets.kube-context }} -n languageforge set image deployment/next-app next-app=${{ needs.integrate.outputs.IMAGE_NEXT_APP }}
kubectl --context ${{ secrets.kube-context }} -n languageforge set image deployment/lfmerge lfmerge=${{ needs.integrate.outputs.IMAGE_LFMERGE }}
name: Checkout fleet repo
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: ${{ vars.FLEET_REPO }}
ssh-key: ${{ secrets.fleet-repo-ssh-key }}
path: fleet
ref: main
-
name: Update image tags in fleet kustomization.yaml
uses: mikefarah/yq@504fc38780cc46be8444ea1b72fb55919fc0bfb0 # v4.54.1
env:
KUSTOMIZATION: fleet/languageforge/${{ inputs.k8s-environment }}/kustomize/kustomization.yaml
TAG_APP: ${{ inputs.image-tag-app }}
TAG_PROXY: ${{ inputs.image-tag-proxy }}
TAG_NEXT_APP: ${{ inputs.image-tag-next-app }}
TAG_LFMERGE: ${{ needs.integrate.outputs.TAG_LFMERGE }}
with:
cmd: |
yq eval -i '
(.images[] | select(.name == "sillsdev/web-languageforge").newTag) = strenv(TAG_APP) |
(.images[] | select(.name == "sillsdev/web-languageforge-next-proxy").newTag) = strenv(TAG_PROXY) |
(.images[] | select(.name == "sillsdev/web-languageforge-next-app").newTag) = strenv(TAG_NEXT_APP) |
(.images[] | select(.name == "ghcr.io/sillsdev/lfmerge").newTag) = strenv(TAG_LFMERGE)
' "$KUSTOMIZATION"
-
name: Show resulting image tags
run: grep -E "name:|newTag:" "fleet/languageforge/${{ inputs.k8s-environment }}/kustomize/kustomization.yaml"
-
name: Push to fleet repo
uses: EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8 # v11.1.1
with:
default_author: github_actions
message: "[Language Forge] Update ${{ inputs.k8s-environment }} images to ${{ inputs.image-tag-app }}"
cwd: "./fleet/"
add: "languageforge/${{ inputs.k8s-environment }}/*"
push: true
4 changes: 3 additions & 1 deletion .github/workflows/production.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,11 @@ jobs:
image-tag-app: $(echo ${{ github.ref }} | sed 's/refs\/tags\/v//')
image-tag-proxy: next-proxy-$(echo ${{ github.ref }} | sed 's/refs\/tags\/v//')
image-tag-next-app: next-app-$(echo ${{ github.ref }} | sed 's/refs\/tags\/v//')
k8s-environment: production
deploy-domain: languageforge.org

# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecrets
secrets:
kube-context: ${{ secrets.K8S_PRODUCTION_CONTEXT }}
fleet-repo-ssh-key: ${{ secrets.FLEET_REPO_SSH_KEY }}
image-repo-username: ${{ secrets.DOCKERHUB_USERNAME }}
image-repo-password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
24 changes: 13 additions & 11 deletions .github/workflows/staging.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,17 @@ on:

jobs:
staging:
# https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_iduses
uses: sillsdev/web-languageforge/.github/workflows/integrate-and-deploy.yml@develop
with:
image-tag-app: develop-$(date +%Y%m%d)-${{ github.sha }}
image-tag-proxy: develop-next-proxy-$(date +%Y%m%d)-${{ github.sha }}
image-tag-next-app: develop-next-app-$(date +%Y%m%d)-${{ github.sha }}
# https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#jobsjob_iduses
uses: sillsdev/web-languageforge/.github/workflows/integrate-and-deploy.yml@develop
with:
image-tag-app: develop-$(date +%Y%m%d)-${{ github.sha }}
image-tag-proxy: develop-next-proxy-$(date +%Y%m%d)-${{ github.sha }}
image-tag-next-app: develop-next-app-$(date +%Y%m%d)-${{ github.sha }}
k8s-environment: staging
deploy-domain: staging.languageforge.org

# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecrets
secrets:
kube-context: ${{ secrets.K8S_STAGING_CONTEXT }}
image-repo-username: ${{ secrets.DOCKERHUB_USERNAME }}
image-repo-password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecrets
secrets:
fleet-repo-ssh-key: ${{ secrets.FLEET_REPO_SSH_KEY }}
image-repo-username: ${{ secrets.DOCKERHUB_USERNAME }}
image-repo-password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
10 changes: 3 additions & 7 deletions docs/RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,9 @@ Current workflow:
1. merge PR into or make commits on `develop` branch
1. this will kick off the GHA (`.github/workflows/staging.yml`) to build, test and publish the necessary images to Docker Hub (https://hub.docker.com/r/sillsdev/web-languageforge/tags) and deploy this code to the staging environment.

Update the image tags in `staging/kustomization.yaml`
Deployment is done the same way as LexBox: the workflow commits the new image tags to `languageforge/staging/kustomize/kustomization.yaml` in the fleet repo (the `FLEET_REPO` repository variable, pushed with the `FLEET_REPO_SSH_KEY` deploy key) and Rancher Fleet rolls the cluster forward from there.

Staging deployments can be manually run with `make deploy-staging`.
Note, this command assumes that the staging k8s context is named dallas-rke
To deploy manually, edit the image tags in that file in the fleet repo and push to `main`.

### Production

Expand All @@ -35,10 +34,7 @@ Current workflow:
1. "Publish" the new release
1. this will kick off the GHA (`.github/workflows/production.yml`) to build, test and publish the necessary images to Docker Hub (https://hub.docker.com/r/sillsdev/web-languageforge/tags) and deploy this code to the production environment at https://languageforge.org

Update the image tags in `prod/kustomization.yaml`

Production deployments can be manually run with `make deploy-prod`.
Note, this command assumes that the staging k8s context is named aws-rke
Production deploys the same way as staging, via `languageforge/production/kustomize/kustomization.yaml` in the fleet repo.

### Base PHP image

Expand Down
Loading