diff --git a/.devops/deploy-pipelines.yml b/.devops/deploy-pipelines.yml index 6ae0d6e0..23d0062b 100644 --- a/.devops/deploy-pipelines.yml +++ b/.devops/deploy-pipelines.yml @@ -151,6 +151,7 @@ stages: buildname="$(Build.BuildNumber) ${{ parameters.ENV }}" echo "##vso[build.addbuildtag]${{ parameters.ENV }}" echo "##vso[build.updatebuildnumber]$buildname" + - bash: | echo "##vso[task.setvariable variable=LIGHTBEND_KEY]$(lightbend_key_secret)" diff --git a/.github/workflows/04_release_deploy.yml b/.github/workflows/04_release_deploy.yml index 5d99da9f..e35812eb 100644 --- a/.github/workflows/04_release_deploy.yml +++ b/.github/workflows/04_release_deploy.yml @@ -93,12 +93,13 @@ jobs: steps: - name: Make Release id: release - uses: pagopa/github-actions-template/maven-release@d91a1fd0b913c9830589be5d86cdb71c90813fae # v1.5.4 + uses: pagopa/github-actions-template/sbt-release@change-working-directory # v1.11.1 TODO set version with: semver: ${{ needs.setup.outputs.semver }} github_token: ${{ secrets.BOT_TOKEN_GITHUB }} beta: ${{ inputs.beta }} skip_ci: false + working_directory: "helm-fdr" image: needs: [ setup, release ] @@ -106,13 +107,17 @@ jobs: runs-on: ubuntu-latest if: ${{ inputs.semver != 'skip' }} steps: - # - name: Build and Push - # id: semver - # uses: pagopa/github-actions-template/ghcr-build-push@v1.5.4 - # with: - # branch: ${{ github.ref_name}} - # github_token: ${{ secrets.GITHUB_TOKEN }} - # tag: ${{ needs.release.outputs.version }} + + - name: Checkout Java + uses: actions/checkout@v4 + + - name: Setup Java + uses: actions/setup-java@v4 + with: + distribution: 'temurin' + java-version: '11' + cache: 'sbt' + - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 with: ref: ${{ github.ref_name }} @@ -135,10 +140,16 @@ jobs: type=ref,event=branch type=sha + - name: Create Dockerfile + env: + LIGHTBEND_KEY: ${{ secrets.LIGHTBEND_KEY }} + run: | + ./sbt -v docker:stage + - name: Build and push uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4 with: - context: . + context: ./fdr/target/docker/stage push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} diff --git a/.github/workflows/04h_deploy_with_github_runner.yml b/.github/workflows/04h_deploy_with_github_runner.yml index 8720d37d..d650b9b2 100644 --- a/.github/workflows/04h_deploy_with_github_runner.yml +++ b/.github/workflows/04h_deploy_with_github_runner.yml @@ -41,6 +41,7 @@ jobs: container_app_environment_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_NAME }} resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }} # RG of the runner pat_token: ${{ secrets.BOT_TOKEN_GITHUB }} + self_hosted_runner_image_tag: "latest" deploy: needs: [ create_runner ] @@ -50,7 +51,7 @@ jobs: environment: ${{ inputs.environment }} steps: - name: Deploy - uses: pagopa/github-actions-template/aks-deploy@main + uses: pagopa/github-actions-template/aks-deploy@change-working-directory with: branch: ${{ github.ref_name }} client_id: ${{ secrets.CD_CLIENT_ID }} @@ -61,7 +62,8 @@ jobs: cluster_name: ${{ vars.CLUSTER_NAME }} resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }} app_name: ${{ env.APP_NAME }} - helm_upgrade_options: ${{ inputs.environment == 'dev' && ' --debug --set postgresql.enabled=true --set oracle.enabled=true --set oracledev.enabled=true --set oracleprod.enabled=true' || ' --debug --set postgresql.enabled=true --set oracle.enabled=true' }} + working_directory: 'helm-fdr' + helm_upgrade_options: --debug --set-file pagopafdrnododeipagamenti.configMapFromFile.logback\\.xml=./helm/config/logback.xml --set-file pagopafdrnododeipagamenti.configMapFromFile.config-app\\.conf=./helm/config/config-app.conf cleanup_runner: name: Cleanup Runner @@ -81,45 +83,46 @@ jobs: resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }} runner_name: ${{ needs.create_runner.outputs.runner_name }} pat_token: ${{ secrets.BOT_TOKEN_GITHUB }} + self_hosted_runner_image_tag: "latest" - update_openapi: - needs: [ deploy ] - runs-on: ubuntu-latest - name: Update OpenAPI - if: ${{ inputs.target == inputs.environment }} - environment: ${{ inputs.environment }} - steps: - - name: Checkout - id: checkout - # from https://github.com/actions/checkout/commits/main - uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707 - with: - persist-credentials: false - - - name: Setup Terraform - # from https://github.com/hashicorp/setup-terraform/commits/main - uses: hashicorp/setup-terraform@8feba2b913ea459066180f9cb177f58a881cf146 - with: - terraform_version: "1.3.6" - - - name: Login - id: login - # from https://github.com/Azure/login/commits/master - uses: azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2 - with: - client-id: ${{ secrets.CD_CLIENT_ID }} - tenant-id: ${{ secrets.TENANT_ID }} - subscription-id: ${{ secrets.SUBSCRIPTION_ID }} - - - - name: Terraform Apply - shell: bash - run: | - cd ./infra - export ARM_CLIENT_ID="${{ secrets.CD_CLIENT_ID }}" - export ARM_SUBSCRIPTION_ID=$(az account show --query id --output tsv) - export ARM_TENANT_ID=$(az account show --query tenantId --output tsv) - export ARM_USE_OIDC=true - export ARM_ACCESS_KEY=$(az storage account keys list --resource-group io-infra-rg --account-name pagopainfraterraform${{inputs.environment}} --query '[0].value' -o tsv) - bash ./terraform.sh init weu-${{ inputs.environment }} - bash ./terraform.sh apply weu-${{ inputs.environment }} -auto-approve +# update_openapi: +# needs: [ deploy ] +# runs-on: ubuntu-latest +# name: Update OpenAPI +# if: ${{ inputs.target == inputs.environment }} +# environment: ${{ inputs.environment }} +# steps: +# - name: Checkout +# id: checkout +# # from https://github.com/actions/checkout/commits/main +# uses: actions/checkout@1f9a0c22da41e6ebfa534300ef656657ea2c6707 +# with: +# persist-credentials: false +# +# - name: Setup Terraform +# # from https://github.com/hashicorp/setup-terraform/commits/main +# uses: hashicorp/setup-terraform@8feba2b913ea459066180f9cb177f58a881cf146 +# with: +# terraform_version: "1.3.6" +# +# - name: Login +# id: login +# # from https://github.com/Azure/login/commits/master +# uses: azure/login@92a5484dfaf04ca78a94597f4f19fea633851fa2 +# with: +# client-id: ${{ secrets.CD_CLIENT_ID }} +# tenant-id: ${{ secrets.TENANT_ID }} +# subscription-id: ${{ secrets.SUBSCRIPTION_ID }} +# +# +# - name: Terraform Apply +# shell: bash +# run: | +# cd ./infra +# export ARM_CLIENT_ID="${{ secrets.CD_CLIENT_ID }}" +# export ARM_SUBSCRIPTION_ID=$(az account show --query id --output tsv) +# export ARM_TENANT_ID=$(az account show --query tenantId --output tsv) +# export ARM_USE_OIDC=true +# export ARM_ACCESS_KEY=$(az storage account keys list --resource-group io-infra-rg --account-name pagopainfraterraform${{inputs.environment}} --query '[0].value' -o tsv) +# bash ./terraform.sh init weu-${{ inputs.environment }} +# bash ./terraform.sh apply weu-${{ inputs.environment }} -auto-approve \ No newline at end of file diff --git a/.gitignore b/.gitignore index f1cefec5..84dd48a2 100644 --- a/.gitignore +++ b/.gitignore @@ -26,7 +26,8 @@ lightbend.sbt /helm/nodo/charts/ /helm/nodo-cron/charts/ *__pycache__ +.identity/.terraform/*!/.run/MainTest dev.run.xml .identity/.terraform/* /integration-test/reports/ /integration-test/results/ -**/.venv/ \ No newline at end of file +**/.venv/ diff --git a/.identity/00_data.tf b/.identity/00_data.tf index 6b957cd5..8601f29c 100644 --- a/.identity/00_data.tf +++ b/.identity/00_data.tf @@ -41,13 +41,13 @@ data "azurerm_key_vault_secret" "key_vault_sonar" { key_vault_id = data.azurerm_key_vault.key_vault.id } -data "azurerm_key_vault_secret" "key_vault_bot_token" { - name = "bot-token-github" - key_vault_id = data.azurerm_key_vault.key_vault.id +data "azurerm_key_vault_secret" "key_vault_bot_cd_token" { + name = "pagopa-platform-domain-github-bot-cd-pat" + key_vault_id = data.azurerm_key_vault.domain_key_vault.id } data "azurerm_key_vault_secret" "key_vault_slack_webhook_url" { - name = "slack-webhook-url" + name = "pagopa-pagamenti-deploy-webhook" key_vault_id = data.azurerm_key_vault.domain_key_vault.id } @@ -70,4 +70,9 @@ data "azurerm_key_vault_secret" "integration_test_subscription_key" { count = var.env_short == "p" ? 0 : 1 name = "integration-test-fdr1-subscription-key" key_vault_id = data.azurerm_key_vault.domain_key_vault.id +} + +data "azurerm_key_vault_secret" "key_vault_lightbend_key" { + name = "lightbend-key" + key_vault_id = data.azurerm_key_vault.domain_key_vault.id } \ No newline at end of file diff --git a/.identity/03_github_environment.tf b/.identity/03_github_environment.tf index c202977f..0f72c7f2 100644 --- a/.identity/03_github_environment.tf +++ b/.identity/03_github_environment.tf @@ -62,6 +62,12 @@ resource "github_actions_environment_variable" "github_environment_runner_variab value = each.value } +resource "github_actions_secret" "lightbend_key" { + repository = local.github.repository + secret_name = "LIGHTBEND_KEY" + plaintext_value = data.azurerm_key_vault_secret.key_vault_lightbend_key.value +} + #tfsec:ignore:github-actions-no-plain-text-action-secrets # not real secret resource "github_actions_secret" "secret_sonar_token" { @@ -75,7 +81,7 @@ resource "github_actions_secret" "secret_bot_token" { repository = local.github.repository secret_name = "BOT_TOKEN_GITHUB" - plaintext_value = data.azurerm_key_vault_secret.key_vault_bot_token.value + plaintext_value = data.azurerm_key_vault_secret.key_vault_bot_cd_token.value } #tfsec:ignore:github-actions-no-plain-text-action-secrets # not real secret diff --git a/.run/MainTest dev.run.xml b/.run/MainTest dev.run.xml index 2fc37ced..39a240cb 100644 --- a/.run/MainTest dev.run.xml +++ b/.run/MainTest dev.run.xml @@ -6,7 +6,7 @@