From bc58550b7f5c0bc384b2f0d7df1dbe97baa2968a Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Mon, 12 Oct 2026 15:35:53 +0300 Subject: [PATCH] ci: deploy develop to bitween-dev and releases to production --- .../workflows/bitween-api-cicd-gateway.yml | 53 +++++++++++++++---- docs/deployment.md | 4 +- 2 files changed, 44 insertions(+), 13 deletions(-) diff --git a/.github/workflows/bitween-api-cicd-gateway.yml b/.github/workflows/bitween-api-cicd-gateway.yml index 7e078f4b..bc8c4a83 100644 --- a/.github/workflows/bitween-api-cicd-gateway.yml +++ b/.github/workflows/bitween-api-cicd-gateway.yml @@ -3,9 +3,11 @@ run-name: Run-${{ github.ref_name }}-${{ github.run_number }} # Two pipelines that publish nothing under the same name: # releases/r10.0-develop the simplify9/bitween-develop image and the bitween-develop chart, -# deployed to playground. No NuGet packages, the CLI as a pre-release. +# deployed to bitween-dev on the dev cluster (app-dev.bitween.io). No NuGet +# packages, the CLI as a pre-release. # releases/r10.0 the simplify9/bitween image and the bitween chart clients install -# (ChartMuseum + GHCR), the NuGet packages, the CLI and the SDKs. Never deployed. +# (ChartMuseum + GHCR), the NuGet packages, the CLI and the SDKs, deployed +# to bitween on the production cluster (app.bitween.io). # Run workflow by hand on either branch to rerun that branch's pipeline. on: push: @@ -34,7 +36,7 @@ permissions: jobs: build-publish-deploy: - # Develop: build, publish bitween-develop, deploy to playground. + # Develop: build, publish bitween-develop, deploy to bitween-dev. if: ${{ github.ref_name == 'releases/r10.0-develop' }} uses: simplify9/.github/.github/workflows/reusable-service-cicd.yml@main with: @@ -67,14 +69,15 @@ jobs: SW.Bitween.UnitTests/SW.Bitween.UnitTests.csproj SW.Bitween.IntegrationTests/SW.Bitween.IntegrationTests.csproj - # Deploy to playground via Gateway API + # Deploy to bitween-dev via Gateway API deploy: true # Pull the chart from GHCR OCI deploy-chart-source: 'github-oci' - deploy-namespace: 'playground' - # Upgrade the existing release in place: with nameOverride=bitween (helm-set-values) every - # resource name and selector is what the bitween chart rendered. A new bitween-develop - # release would run beside the old one, and the older HTTPRoute keeps app-dev.bitween.io. + deploy-namespace: 'bitween-dev' + # Release bitween with nameOverride=bitween (helm-set-values), so every resource name and + # selector is what the bitween chart renders in production. Gateway API gives a hostname to + # its oldest HTTPRoute: any other release serving app-dev.bitween.io on this cluster keeps + # the host until it is uninstalled. deploy-release-name: 'bitween' routing-mode: 'gateway-api' gateway-hostnames: 'app-dev.bitween.io' @@ -129,7 +132,7 @@ jobs: helm-set-secret-values: 'global.token.key=${{ secrets.TokenKey }},db=${{ secrets.dbConnection }},global.bus.rabbitUrl=${{ secrets.rabbitUrl }},global.cloudFiles.secretAccessKey=${{ secrets.SecretAccessKey }},global.cloudFiles.accessKeyId=${{ secrets.AccessKeyId }},global.cloudFiles.serviceUrl=${{ secrets.ServiceUrl }},global.cloudFiles.bucketName=${{ secrets.BucketName }},environmentVariables.Bitween__RabbitMqManagementUrl=${{ secrets.RabbitMqManagementUrl }},environmentVariables.Bitween__RabbitMqManagementPassword=${{ secrets.RabbitMqManagementPassword }},environmentVariables.Bitween__RabbitMqManagementUsername=${{ secrets.RabbitMqManagementUsername }}' publish-release: - # Release: build and publish for clients, never deploy. releases/r10.0 is the + # Release: build and publish for clients, deploy production. releases/r10.0 is the # repository's default branch, so the reusable workflow treats it as a release: a clean # 10.0. git tag, and the critical Dependabot gate runs first. if: ${{ github.ref_name == 'releases/r10.0' }} @@ -164,8 +167,29 @@ jobs: test-projects: | SW.Bitween.UnitTests/SW.Bitween.UnitTests.csproj SW.Bitween.IntegrationTests/SW.Bitween.IntegrationTests.csproj - # deploy is left at its default, false: the deploy job never runs, so no kubeconfig - # or app secrets are passed. + # Deploy to bitween on the production cluster. Off until the repository variable + # BITWEEN_PROD_DEPLOY is 'true': first the PROD_* secrets below must exist, + # S9PROD_KUBECONFIG_V2 must be shared with this repository, and app.bitween.io must + # point at the production gateway. Without them a deploy installs a release with no + # database, or fails waiting for its certificate. + deploy: ${{ vars.BITWEEN_PROD_DEPLOY == 'true' }} + deploy-chart-source: 'github-oci' + deploy-namespace: 'bitween' + deploy-environment: 'production' + routing-mode: 'gateway-api' + gateway-hostnames: 'app.bitween.io' + gateway-paths: '/,/api,/swagger' + # The production cluster's gateway. The default, s9-dev-edge, does not exist there, and + # the deploy would create a second public-gateway in it instead of failing. + gateway-parent-namespace: 's9-prod-edge' + # Every line is handed to helm --set as it stands, so no comments inside. + helm-set-values: | + global.environment=Production + replicaCount=2 + resources.requests.cpu=25m + resources.requests.memory=704Mi + resources.limits.memory=1408Mi + environmentVariables.Bitween__BusProvidersEnabled=true secrets: registry-username: ${{ secrets.DOCKERHUB_USERNAME }} registry-password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -175,6 +199,13 @@ jobs: nuget-api-key: ${{ secrets.SWNUGETKEY }} dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }} + # Production cluster kubeconfig (V2, Gateway API) + kubeconfig-gateway: ${{ secrets.S9PROD_KUBECONFIG_V2 }} + + # Production's own configuration, the same settings as the develop job's above. PROD_TOKENKEY + # is its own random string (openssl rand -base64 48), never the develop key. + helm-set-secret-values: 'global.token.key=${{ secrets.PROD_TOKENKEY }},db=${{ secrets.PROD_DBCONNECTION }},global.bus.rabbitUrl=${{ secrets.PROD_RABBITURL }},global.cloudFiles.secretAccessKey=${{ secrets.PROD_SECRETACCESSKEY }},global.cloudFiles.accessKeyId=${{ secrets.PROD_ACCESSKEYID }},global.cloudFiles.serviceUrl=${{ secrets.PROD_SERVICEURL }},global.cloudFiles.bucketName=${{ secrets.PROD_BUCKETNAME }},environmentVariables.Bitween__RabbitMqManagementUrl=${{ secrets.PROD_RABBITMQMANAGEMENTURL }},environmentVariables.Bitween__RabbitMqManagementPassword=${{ secrets.PROD_RABBITMQMANAGEMENTPASSWORD }},environmentVariables.Bitween__RabbitMqManagementUsername=${{ secrets.PROD_RABBITMQMANAGEMENTUSERNAME }}' + # The bitween CLI and the SDKs carry the version the run above computed, so nothing is tagged by # hand. A develop build releases the CLI as a pre-release, cli-v-dev.; the release # from releases/r10.0 releases it as the latest, cli-v, and publishes the SDKs. Each runs diff --git a/docs/deployment.md b/docs/deployment.md index 25eb8d12..b82ea810 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -122,8 +122,8 @@ Run several replicas behind a load balancer for throughput and availability, and | Pipeline | Trigger | What it does | |---|---|---| -| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys the playground environment. Publishes no NuGet packages. | -| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, and tags the repository. Nothing is deployed. | +| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys to the `bitween-dev` namespace on the dev cluster (`app-dev.bitween.io`). Publishes no NuGet packages. | +| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, tags the repository, and deploys to the `bitween` namespace on the production cluster (`app.bitween.io`). The deploy runs only while the `BITWEEN_PROD_DEPLOY` repository variable is `true`. | | `.github/workflows/cli-release.yml` | Called by the CI/CD workflow, never run by hand or by a tag: after the release from `releases/r10.0`, and after each develop build | Publishes the [bitween CLI](cli.md) at the version that run computed, as self-contained single-file binaries for `linux-x64`, `linux-arm64`, `linux-musl-x64`, `linux-musl-arm64`, `osx-x64`, `osx-arm64` and `win-x64`, with a `SHA256SUMS` file. From the release it is `cli-v`, the latest release; from develop, the pre-release `cli-v-dev.`. `scripts/install-cli.sh` installs the latest release, a pre-release only when named. | | `.github/workflows/sdk-release.yml` | Called by the CI/CD workflow after the release from `releases/r10.0` | Publishes the adapter contract packages at Bitween's version: `simplyworks-bitween` to PyPI and `@simplyworks/bitween` to npm, each tested first against SW-Serverless's SDK. Uses the `PYPI_API_TOKEN` and `NPM_TOKEN` secrets; a version already published is left alone. | | `.github/workflows/dotnet-pr-checks.yml` | Pull requests to `releases/**` | Builds the solution and runs the .NET unit tests |