cicd.yml

name: CI/CD

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the master branch
  push:
    branches: [ main ]
  
  # Runs when provision has successfully completed
  workflow_run:
    workflows: [Provision server]
    types:
      - completed

jobs:
  build:
    name: "Build and push"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout branch
        uses: actions/checkout@v2

      - name: Login to Dockerhub
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push api docker image
        run: |
          docker build -t ${{ secrets.DOCKER_USERNAME }}/minitwitimage:latest . -f ./server/Dockerfile
          docker push ${{ secrets.DOCKER_USERNAME }}/minitwitimage:latest

      - name: Build and push client docker image
        run: |
          docker build -t ${{ secrets.DOCKER_USERNAME }}/minitwit-client:latest . -f ./client/Dockerfile
          docker push ${{ secrets.DOCKER_USERNAME }}/minitwit-client:latest

  # Doesnt work ATM, see https://github.com/Azure/container-scan/issues/122
  # Instead we have set up snyk.io to continuesly monitor our container directly from Docker Hub
  scan:
    name: "Scan the container"
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: Azure/container-scan@v0
        with:
          image-name: ${{ secrets.DOCKER_USERNAME }}/minitwitimage:latest
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

  copy:
    name: "Copy docker-compose file"
    needs: build
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@master
    - name: copy file to manager node via ssh password
      uses: appleboy/scp-action@master
      with:
        key: ${{ secrets.XSSH_PRIVATE_KEY }}
        host: ${{ secrets.XSERVER_IP }}
        username: ${{ secrets.XSERVER_USER }}
        port: 22
        strip_components: 2
        source: "./swarm/docker-compose.yml, ./swarm/filebeat.yml, ./swarm/grafana/, ./swarm/prometheus/"
        target: "/root"
    - name: copy file to worker node via ssh password
      uses: appleboy/scp-action@master
      with:
        key: ${{ secrets.XSSH_PRIVATE_KEY }}
        host: ${{ secrets.WORKER_IP }}
        username: ${{ secrets.XSERVER_USER }}
        port: 22
        strip_components: 2
        source: "./swarm/filebeat.yml"
        target: "/root"

  deploy:
    name: "Deploy to worker droplet"
    needs: copy
    runs-on: ubuntu-latest
    steps:
    - name: Shh into worker node
      uses: appleboy/ssh-action@v0.1.4
      with:
        key: ${{ secrets.XSSH_PRIVATE_KEY }}
        host: ${{ secrets.WORKER_IP }}
        username: ${{ secrets.XSERVER_USER }}
        port: 22
        script: |
          cd /root
          chown root filebeat.yml
          chmod go-w filebeat.yml

          mkdir /var/prom_data
          chown nobody /var/prom_data

    - name: Deploy to Digital Ocean droplet via SSH action
      uses: appleboy/ssh-action@v0.1.4
      env:
        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
        MYSQL_USER: ${{ secrets.XMYSQL_USER }}
        MYSQL_DATABASE: ${{ secrets.XMYSQL_DATABASE }}
        MYSQL_PASSWORD: ${{ secrets.XMYSQL_PASSWORD }}
        MYSQL_ADDRESS: ${{ secrets.XMYSQL_ADDRESS }}
        MYSQL_PORT: 25060
        GRAFANA_ADMIN_USERNAME: ${{ secrets.GRAFANA_ADMIN_USERNAME }}
        GRAFANA_ADMIN_PASSWORD: ${{ secrets.GRAFANA_ADMIN_PASSWORD }}
        ELK_USER: ${{ secrets.ELK_USER }}
        ELASTIC_USER: ${{ secrets.ELASTIC_USER }}
        ELASTIC_PASSWORD: ${{ secrets.ELASTIC_PASSWORD }}
        BUCKET_NAME: ${{ secrets.BUCKET_NAME }}
        SECRET_KEY: ${{ secrets.SECRET_KEY }}
        ACCESS_KEY: ${{ secrets.ACCESS_KEY }}
        STACK_NAME: ${{ secrets.STACK_NAME }}
        PROMETHEUS_BACKUP_INTERVAL: ${{ secrets.PROMETHEUS_BACKUP_INTERVAL }}
        SPACE_ENDPOINT: ${{ secrets.SPACE_ENDPOINT }}
      with:
        key: ${{ secrets.XSSH_PRIVATE_KEY }}
        host: ${{ secrets.XSERVER_IP }}
        username: ${{ secrets.XSERVER_USER }}
        port: 22
        envs: DOCKER_USERNAME,MYSQL_USER,MYSQL_DATABASE,MYSQL_PORT,MYSQL_ADDRESS,MYSQL_PASSWORD,GRAFANA_ADMIN_USERNAME,GRAFANA_ADMIN_PASSWORD,ELK_USER,ELASTIC_USER,ELASTIC_PASSWORD,STACK_NAME,ACCESS_KEY,SECRET_KEY,BUCKET_NAME,PROMETHEUS_BACKUP_INTERVAL,SPACE_ENDPOINT
        script: |
          mkdir /var/prom_data
          chown nobody /var/prom_data

          cd /root
          export DOCKER_USERNAME=$DOCKER_USERNAME
          export MYSQL_USER=$MYSQL_USER
          export MYSQL_DATABASE=$MYSQL_DATABASE
          export MYSQL_PASSWORD=$MYSQL_PASSWORD
          export MYSQL_ADDRESS=$MYSQL_ADDRESS
          export MYSQL_PORT=$MYSQL_PORT
          export GRAFANA_ADMIN_USERNAME=$GRAFANA_ADMIN_USERNAME
          export GRAFANA_ADMIN_PASSWORD=$GRAFANA_ADMIN_PASSWORD
          export ELK_USER=$ELK_USER
          export ELASTIC_USER=$ELASTIC_USER
          export ELASTIC_PASSWORD=$ELASTIC_PASSWORD
          export STACK_NAME=$STACK_NAME
          export ACCESS_KEY=$ACCESS_KEY
          export SECRET_KEY=$SECRET_KEY
          export BUCKET_NAME=$BUCKET_NAME
          export PROMETHEUS_BACKUP_INTERVAL=$PROMETHEUS_BACKUP_INTERVAL
          export SPACE_ENDPOINT=$SPACE_ENDPOINT
          
          chown root filebeat.yml
          chmod go-w filebeat.yml

          docker-compose pull
          docker stack deploy --compose-file docker-compose.yml $STACK_NAME

  versioning:
    name: "Tag and release"
    needs: deploy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Bump version and push tag
        id: tag_version
        uses: mathieudutour/github-tag-action@v6.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          default_bump: major
      - name: Create a GitHub release
        uses: ncipollo/release-action@v1
        with:
          tag: ${{ steps.tag_version.outputs.new_tag }}
          name: Release ${{ steps.tag_version.outputs.new_tag }}
          body: ${{ steps.tag_version.outputs.changelog }}