95 lines
3.5 KiB
YAML
95 lines
3.5 KiB
YAML
name: Deploy to S3
|
|
|
|
# main only. Everything else is covered by ci.yml, which runs the same checks
|
|
# without deploying.
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
# Nothing was verified before this existed: a frontend that failed to compile
|
|
# would zip and ship exactly like a working one. `deploy` now needs this job,
|
|
# so a red main does not reach the bucket.
|
|
checks:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3
|
|
|
|
# 22 to match frontend/Dockerfile, so CI resolves the same tree the
|
|
# production image builds from.
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
|
|
# 3.11 is the floor in pyproject.toml and the version the project's conda
|
|
# env runs.
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Install Python dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
pip install -e ".[dev]"
|
|
pip install -r backend/requirements.txt
|
|
|
|
- name: Run checks
|
|
run: bash scripts/ci-checks.sh
|
|
|
|
deploy:
|
|
needs: checks
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3
|
|
|
|
# frontend/node_modules is excluded, and that is safe because of what
|
|
# happens to this object downstream. CodeDeploy pulls it, extracts to
|
|
# /opt/codedeploy-extracted-5, copies the tree to
|
|
# /home/ec2-user/utopia-ai-hr-ats-portal-deployment-group and runs
|
|
# `docker compose --env-file ./backend/.env up -d --build`. The only Node
|
|
# service is the frontend, whose image does `npm ci` from the lockfile,
|
|
# and frontend/.dockerignore excludes node_modules/ from the build context
|
|
# outright. So the committed tree was carried into every artifact and then
|
|
# thrown away unread. It was 90 MB of a 33 MB compressed upload.
|
|
#
|
|
# node_modules is still tracked in git, which is the reason it was here at
|
|
# all. Untracking it is a separate change and affects other branches.
|
|
- name: Archive project
|
|
run: |
|
|
apt-get update -y
|
|
apt-get install -y zip
|
|
zip -r utopia-ai-hr-ats-portal.zip . \
|
|
-x ".git/*" \
|
|
-x ".gitea/*" \
|
|
-x ".gitignore" \
|
|
-x "frontend/node_modules/*" \
|
|
-x "*.DS_Store"
|
|
|
|
- name: Install AWS CLI
|
|
run: |
|
|
apt-get update -y
|
|
apt-get install -y curl unzip
|
|
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
|
|
unzip -q awscliv2.zip
|
|
./aws/install
|
|
aws --version
|
|
|
|
# The credentials live only on this step. There used to be a separate
|
|
# "Configure AWS credentials" step above that set the same three variables
|
|
# and then only echoed a message — env: is scoped to its own step, so
|
|
# those values were discarded before anything could use them. It was doing
|
|
# nothing, and it read as though credentials were set up globally.
|
|
- name: Upload files to S3
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.DEVOPS_USER_AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.DEVOPS_USER_AWS_SECRET_ACCESS_KEY }}
|
|
AWS_DEFAULT_REGION: us-east-1
|
|
run: |
|
|
echo "Uploading repo contents to S3..."
|
|
aws s3 cp utopia-ai-hr-ats-portal.zip s3://utopia-ai-s3-repo-bucket/utopia-ai-hr-ats-portal.zip
|