From 61e3de387a21f326951f78cca9cdc997769c588a Mon Sep 17 00:00:00 2001
From: Kosty Maleyev <kosty.maleyev@sentry.io>
Date: Wed, 20 Mar 2024 11:57:40 -0700
Subject: [PATCH] [platform] GitHub Actions workflow to deploy TDA

---
 .github/workflows/deploy_tda.yml | 62 ++++++++++++++++++++++++++++++++
 tda/deploy_tda.sh                |  8 +++--
 2 files changed, 67 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/deploy_tda.yml

diff --git a/.github/workflows/deploy_tda.yml b/.github/workflows/deploy_tda.yml
new file mode 100644
index 00000000..c01ab872
--- /dev/null
+++ b/.github/workflows/deploy_tda.yml
@@ -0,0 +1,62 @@
+name: deploy_tda.yml
+on:
+  workflow_dispatch: 
+
+# Only run 1 workflow at a time. If new one starts abort any that are already running.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  default-job:
+    if: github.repository_owner == 'sentry-demos' # don't run in forks
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    runs-on: ubuntu-22.04
+    
+    steps:
+      - run: echo "Triggered by ${{ github.event_name }} event."
+      - run: echo "Branch is ${{ github.ref }}"
+      
+      - name: Check out this repository code
+        uses: actions/checkout@v3
+        with:
+          path: empower
+          fetch-depth: 0
+
+      - name: Check out `empower-config` to get GCP identity provider and account name
+        uses: actions/checkout@v3
+        with:
+          repository: sentry-demos/empower-config
+          path: empower-config
+          token: ${{ secrets.KOSTY_PERSONAL_ACCESS_TOKEN_FOR_SYNC_DEPLOY_FORK }}
+          # See https://github.com/actions/checkout/issues/347#issuecomment-963586784
+          # and https://chat.openai.com/share/6f45c9e9-8e96-4ac4-adde-a65061a41de4
+
+      - name: Get GCP_ env variables from empower-config/.gcloudrc
+        run: |
+          source empower-config/.gcloudrc 
+          echo "GCP_WORKLOAD_IDENTITY_PROVIDER=$GCP_WORKLOAD_IDENTITY_PROVIDER" >> $GITHUB_OUTPUT
+          echo "GCP_SERVICE_ACCOUNT=$GCP_SERVICE_ACCOUNT" >> $GITHUB_OUTPUT 
+        id: gcloudrc
+      
+      - name: Copy .sauce_credentials from empower-config repo
+        run: cp empower-config/.sauce_credentials empower/tda/
+        
+      - id: 'auth'
+        name: 'Authenticate Google Cloud'
+        uses: 'google-github-actions/auth@v2'
+        with:
+          workload_identity_provider: ${{ steps.gcloudrc.outputs.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ steps.gcloudrc.outputs.GCP_SERVICE_ACCOUNT }}
+
+      - name: 'Set up Google Cloud SDK'
+        uses: 'google-github-actions/setup-gcloud@v2'
+        
+      - name: Run deploy_tda.sh
+        run: gcloud compute config-ssh && ./deploy_tda.sh
+        working-directory: ./empower/tda
+          
+      - run: echo "Job status is ${{ job.status }}."
+      
diff --git a/tda/deploy_tda.sh b/tda/deploy_tda.sh
index 86d7e9af..f492a379 100755
--- a/tda/deploy_tda.sh
+++ b/tda/deploy_tda.sh
@@ -9,7 +9,7 @@ function cleanup {
 trap cleanup EXIT
 
 echo "Checking ssh connection can be established..."
-ssh $HOST exit
+ssh -o StrictHostKeyChecking=accept-new $HOST exit
 if [ $? != "0" ]; then
   echo "[ERROR] Can't ssh into destination host. Please run 'gcloud compute config-ssh; ssh $HOST exit' to fix"
   exit 5 
@@ -30,11 +30,13 @@ fi
 
 echo "Copying code to remote directory..."
 # for whatever reason can't delete or chmod __pycache__ directories
-rsync -rz --delete --force-delete --exclude env/ --exclude __pycache__ * .sauce_credentials $HOST:$DIR/
+rsync -rz --delete --force-delete --exclude env/ --exclude __pycache__ --exclude .pytest_cache * .sauce_credentials $HOST:$DIR/
 ret="$?"
 
+echo "Re-attempting with --delete instead of --force-delete..."
 if [ $ret == 1 ]; then # some versions of rsync don't recognize --force-delete option
-  rsync -rz --delete --force --exclude env/ --exclude __pycache__ * .sauce_credentials $HOST:$DIR/
+  rsync -rz --delete --force --exclude env/ --exclude __pycache__ --exclude .pytest_cache * .sauce_credentials $HOST:$DIR/
+  ret="$?"
 fi
 if [ $ret != 0 ]; then
   echo "[ERROR] Failed to rsync code to remote directory."