ci: deploy develop to bitween-dev and releases to production

.github/workflows/bitween-api-cicd-gateway.yml

@@ -3,9 +3,11 @@ run-name: Run-${{ github.ref_name }}-${{ github.run_number }}
 
 # Two pipelines that publish nothing under the same name:
 #   releases/r10.0-develop  the simplify9/bitween-develop image and the bitween-develop chart,
-#                           deployed to playground. No NuGet packages, the CLI as a pre-release.
+#                           deployed to bitween-dev on the dev cluster (app-dev.bitween.io). No NuGet
+#                           packages, the CLI as a pre-release.
 #   releases/r10.0          the simplify9/bitween image and the bitween chart clients install
-#                           (ChartMuseum + GHCR), the NuGet packages, the CLI and the SDKs. Never deployed.
+#                           (ChartMuseum + GHCR), the NuGet packages, the CLI and the SDKs, deployed
+#                           to bitween on the production cluster (app.bitween.io).
 # Run workflow by hand on either branch to rerun that branch's pipeline.
 on:
   push:
@@ -34,7 +36,7 @@ permissions:
 
 jobs:
   build-publish-deploy:
-    # Develop: build, publish bitween-develop, deploy to playground.
+    # Develop: build, publish bitween-develop, deploy to bitween-dev.
     if: ${{ github.ref_name == 'releases/r10.0-develop' }}
     uses: simplify9/.github/.github/workflows/reusable-service-cicd.yml@main
     with:
@@ -67,14 +69,15 @@ jobs:
         SW.Bitween.UnitTests/SW.Bitween.UnitTests.csproj
         SW.Bitween.IntegrationTests/SW.Bitween.IntegrationTests.csproj
 
-      # Deploy to playground via Gateway API
+      # Deploy to bitween-dev via Gateway API
       deploy: true
       # Pull the chart from GHCR OCI
       deploy-chart-source: 'github-oci'
-      deploy-namespace: 'playground'
-      # Upgrade the existing release in place: with nameOverride=bitween (helm-set-values) every
-      # resource name and selector is what the bitween chart rendered. A new bitween-develop
-      # release would run beside the old one, and the older HTTPRoute keeps app-dev.bitween.io.
+      deploy-namespace: 'bitween-dev'
+      # Release bitween with nameOverride=bitween (helm-set-values), so every resource name and
+      # selector is what the bitween chart renders in production. Gateway API gives a hostname to
+      # its oldest HTTPRoute: any other release serving app-dev.bitween.io on this cluster keeps
+      # the host until it is uninstalled.
       deploy-release-name: 'bitween'
       routing-mode: 'gateway-api'
       gateway-hostnames: 'app-dev.bitween.io'
@@ -129,7 +132,7 @@ jobs:
       helm-set-secret-values: 'global.token.key=${{ secrets.TokenKey }},db=${{ secrets.dbConnection }},global.bus.rabbitUrl=${{ secrets.rabbitUrl }},global.cloudFiles.secretAccessKey=${{ secrets.SecretAccessKey }},global.cloudFiles.accessKeyId=${{ secrets.AccessKeyId }},global.cloudFiles.serviceUrl=${{ secrets.ServiceUrl }},global.cloudFiles.bucketName=${{ secrets.BucketName }},environmentVariables.Bitween__RabbitMqManagementUrl=${{ secrets.RabbitMqManagementUrl }},environmentVariables.Bitween__RabbitMqManagementPassword=${{ secrets.RabbitMqManagementPassword }},environmentVariables.Bitween__RabbitMqManagementUsername=${{ secrets.RabbitMqManagementUsername }}'
 
   publish-release:
-    # Release: build and publish for clients, never deploy. releases/r10.0 is the
+    # Release: build and publish for clients, deploy production. releases/r10.0 is the
     # repository's default branch, so the reusable workflow treats it as a release: a clean
     # 10.0.<patch> git tag, and the critical Dependabot gate runs first.
     if: ${{ github.ref_name == 'releases/r10.0' }}
@@ -164,8 +167,29 @@ jobs:
       test-projects: |
         SW.Bitween.UnitTests/SW.Bitween.UnitTests.csproj
         SW.Bitween.IntegrationTests/SW.Bitween.IntegrationTests.csproj
-      # deploy is left at its default, false: the deploy job never runs, so no kubeconfig
-      # or app secrets are passed.
+      # Deploy to bitween on the production cluster. Off until the repository variable
+      # BITWEEN_PROD_DEPLOY is 'true': first the PROD_* secrets below must exist,
+      # S9PROD_KUBECONFIG_V2 must be shared with this repository, and app.bitween.io must
+      # point at the production gateway. Without them a deploy installs a release with no
+      # database, or fails waiting for its certificate.
+      deploy: ${{ vars.BITWEEN_PROD_DEPLOY == 'true' }}
+      deploy-chart-source: 'github-oci'
+      deploy-namespace: 'bitween'
+      deploy-environment: 'production'
+      routing-mode: 'gateway-api'
+      gateway-hostnames: 'app.bitween.io'
+      gateway-paths: '/,/api,/swagger'
+      # The production cluster's gateway. The default, s9-dev-edge, does not exist there, and
+      # the deploy would create a second public-gateway in it instead of failing.
+      gateway-parent-namespace: 's9-prod-edge'
+      # Every line is handed to helm --set as it stands, so no comments inside.
+      helm-set-values: |
+        global.environment=Production
+        replicaCount=2
+        resources.requests.cpu=25m
+        resources.requests.memory=704Mi
+        resources.limits.memory=1408Mi
+        environmentVariables.Bitween__BusProvidersEnabled=true
     secrets:
       registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
       registry-password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -175,6 +199,13 @@ jobs:
       nuget-api-key: ${{ secrets.SWNUGETKEY }}
       dependabot-alerts-token: ${{ secrets.DEPENDABOT_ALERTS_TOKEN }}
 
+      # Production cluster kubeconfig (V2, Gateway API)
+      kubeconfig-gateway: ${{ secrets.S9PROD_KUBECONFIG_V2 }}
+
+      # Production's own configuration, the same settings as the develop job's above. PROD_TOKENKEY
+      # is its own random string (openssl rand -base64 48), never the develop key.
+      helm-set-secret-values: 'global.token.key=${{ secrets.PROD_TOKENKEY }},db=${{ secrets.PROD_DBCONNECTION }},global.bus.rabbitUrl=${{ secrets.PROD_RABBITURL }},global.cloudFiles.secretAccessKey=${{ secrets.PROD_SECRETACCESSKEY }},global.cloudFiles.accessKeyId=${{ secrets.PROD_ACCESSKEYID }},global.cloudFiles.serviceUrl=${{ secrets.PROD_SERVICEURL }},global.cloudFiles.bucketName=${{ secrets.PROD_BUCKETNAME }},environmentVariables.Bitween__RabbitMqManagementUrl=${{ secrets.PROD_RABBITMQMANAGEMENTURL }},environmentVariables.Bitween__RabbitMqManagementPassword=${{ secrets.PROD_RABBITMQMANAGEMENTPASSWORD }},environmentVariables.Bitween__RabbitMqManagementUsername=${{ secrets.PROD_RABBITMQMANAGEMENTUSERNAME }}'
+
   # The bitween CLI and the SDKs carry the version the run above computed, so nothing is tagged by
   # hand. A develop build releases the CLI as a pre-release, cli-v<x.y.z>-dev.<run>; the release
   # from releases/r10.0 releases it as the latest, cli-v<x.y.z>, and publishes the SDKs. Each runs

docs/deployment.md

@@ -122,8 +122,8 @@ Run several replicas behind a load balancer for throughput and availability, and
 
 | Pipeline | Trigger | What it does |
 |---|---|---|
-| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys the playground environment. Publishes no NuGet packages. |
-| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, and tags the repository. Nothing is deployed. |
+| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0-develop`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween-develop` image to Docker Hub, publishes the production chart (`charts/default`) as `bitween-develop` to `charts.sf9.io` and GHCR, tags the repository, and deploys to the `bitween-dev` namespace on the dev cluster (`app-dev.bitween.io`). Publishes no NuGet packages. |
+| `.github/workflows/bitween-api-cicd-gateway.yml` | Push to `releases/r10.0`, or manual on it | Runs unit and integration tests, pushes the `simplify9/bitween` image to Docker Hub, publishes the `bitween` chart clients install to `charts.sf9.io` and GHCR (`oci://ghcr.io/simplify9/charts/bitween`), pushes `SimplyWorks.Bitween.Sdk` and `SimplyWorks.Bitween.Adapters` to NuGet, tags the repository, and deploys to the `bitween` namespace on the production cluster (`app.bitween.io`). The deploy runs only while the `BITWEEN_PROD_DEPLOY` repository variable is `true`. |
 | `.github/workflows/cli-release.yml` | Called by the CI/CD workflow, never run by hand or by a tag: after the release from `releases/r10.0`, and after each develop build | Publishes the [bitween CLI](cli.md) at the version that run computed, as self-contained single-file binaries for `linux-x64`, `linux-arm64`, `linux-musl-x64`, `linux-musl-arm64`, `osx-x64`, `osx-arm64` and `win-x64`, with a `SHA256SUMS` file. From the release it is `cli-v<version>`, the latest release; from develop, the pre-release `cli-v<version>-dev.<run>`. `scripts/install-cli.sh` installs the latest release, a pre-release only when named. |
 | `.github/workflows/sdk-release.yml` | Called by the CI/CD workflow after the release from `releases/r10.0` | Publishes the adapter contract packages at Bitween's version: `simplyworks-bitween` to PyPI and `@simplyworks/bitween` to npm, each tested first against SW-Serverless's SDK. Uses the `PYPI_API_TOKEN` and `NPM_TOKEN` secrets; a version already published is left alone. |
 | `.github/workflows/dotnet-pr-checks.yml` | Pull requests to `releases/**` | Builds the solution and runs the .NET unit tests |