ID-1301 talk to ecm for nih username (Round 2) #505
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Github action to Build Orch, add/promote semantic tagging and then run tests | |
| name: orch-build-tag-publish-and-run-tests | |
| on: | |
| pull_request: | |
| paths-ignore: ['**.md'] | |
| push: | |
| branches: | |
| - develop | |
| paths-ignore: ['**.md'] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| GCR_REGISTRY: gcr.io/broad-dsp-gcr-public/firecloud-orchestration | |
| # Region-specific Google Docker repository where GOOGLE_PROJECT/REPOSITORY_NAME can be found | |
| GOOGLE_DOCKER_REPOSITORY: us-central1-docker.pkg.dev | |
| RUN_NAME: '${{ github.event.repository.name }}-${{ github.run_id }}-${{ github.run_attempt }}' | |
| jobs: | |
| orch-build-tag-publish-job: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| outputs: | |
| tag: ${{ steps.tag.outputs.tag }} | |
| custom-version-json: ${{ steps.publish-orch.outputs.custom-version-json }} | |
| steps: | |
| - uses: 'actions/checkout@v4' | |
| - name: Bump the tag to a new version | |
| uses: databiosphere/github-actions/actions/[email protected] | |
| id: tag | |
| env: | |
| DEFAULT_BUMP: patch | |
| GITHUB_TOKEN: ${{ secrets.BROADBOT_TOKEN }} | |
| RELEASE_BRANCHES: develop | |
| WITH_V: true | |
| # Persist output tag from bumper to $GITHUB_ENV. | |
| - id: persist-tag | |
| name: Persist tag | |
| run: | | |
| echo "DOCKER_TAG=${{ steps.tag.outputs.tag }}" >> $GITHUB_ENV | |
| - name: Auth to GCP | |
| id: 'auth' | |
| uses: google-github-actions/auth@v2 | |
| with: | |
| token_format: 'id_token' | |
| workload_identity_provider: 'projects/1038484894585/locations/global/workloadIdentityPools/github-wi-pool/providers/github-wi-provider' | |
| service_account: '[email protected]' | |
| id_token_audience: "1038484894585-k8qvf7l876733laev0lm8kenfa2lj6bn.apps.googleusercontent.com" | |
| # Install gcloud, `setup-gcloud` automatically picks up authentication from `auth`. | |
| - name: 'Set up Cloud SDK' | |
| uses: 'google-github-actions/setup-gcloud@v2' | |
| - name: Explicitly auth Docker for Artifact Registry | |
| run: gcloud auth configure-docker $GOOGLE_DOCKER_REPOSITORY --quiet | |
| # Build Orch jar | |
| - name: Build Orch jar | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| ./script/build_jar.sh | |
| # Publish jar to GCR | |
| - id: publish-orch | |
| name: Publish Orch | |
| run: | | |
| cd $GITHUB_WORKSPACE | |
| docker build -t ${{ github.event.repository.full_name }}:${DOCKER_TAG} --pull . | |
| docker tag ${{ github.event.repository.full_name }}:${DOCKER_TAG} ${{ env.GCR_REGISTRY }}:${DOCKER_TAG} | |
| gcloud docker -- push $GCR_REGISTRY:${DOCKER_TAG} | |
| echo 'custom-version-json={\"firecloudorch\":{\"appVersion\":\"${{ env.DOCKER_TAG }}\"}}' >> $GITHUB_OUTPUT | |
| prepare-configs: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| log-results: ${{ steps.prepare-outputs.outputs.log-results }} | |
| test-context: ${{ steps.prepare-outputs.outputs.test-context }} | |
| steps: | |
| - id: prepare-outputs | |
| run: |- | |
| echo 'log-results=true' >> $GITHUB_OUTPUT | |
| if ${{ github.ref_name == 'develop' }}; then | |
| echo 'test-context=dev-merge' >> $GITHUB_OUTPUT | |
| else | |
| echo 'test-context=pr-test' >> $GITHUB_OUTPUT | |
| fi | |
| report-to-sherlock: | |
| # Report new firecloudorch version to Broad DevOps | |
| uses: broadinstitute/sherlock/.github/workflows/client-report-app-version.yaml@main | |
| needs: orch-build-tag-publish-job | |
| with: | |
| new-version: ${{ needs.orch-build-tag-publish-job.outputs.tag }} | |
| chart-name: 'firecloudorch' | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| set-version-in-dev: | |
| # Put new firecloudorch version in Broad dev environment | |
| uses: broadinstitute/sherlock/.github/workflows/client-set-environment-app-version.yaml@main | |
| needs: [orch-build-tag-publish-job, report-to-sherlock] | |
| if: ${{ github.ref_name == 'develop' }} | |
| with: | |
| new-version: ${{ needs.orch-build-tag-publish-job.outputs.tag }} | |
| chart-name: 'firecloudorch' | |
| environment-name: 'dev' | |
| secrets: | |
| sync-git-token: ${{ secrets.BROADBOT_TOKEN }} | |
| permissions: | |
| id-token: 'write' | |
| create-bee-workflow: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| runs-on: ubuntu-latest | |
| needs: [orch-build-tag-publish-job] | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: Echo Orch version | |
| run: | | |
| echo '${{ needs.orch-build-tag-publish-job.outputs.custom-version-json }}' | |
| - name: dispatch to terra-github-workflows | |
| uses: broadinstitute/workflow-dispatch@v4 | |
| with: | |
| workflow: bee-create | |
| run-name: "bee-create-${{ env.RUN_NAME }}" | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN}} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| # Note: There is a hard limit of bee-name not exceeding 32 characters | |
| inputs: '{ | |
| "bee-name": "orch-${{ github.run_id }}-${{ matrix.terra-env }}", | |
| "version-template": "${{ matrix.terra-env }}", | |
| "custom-version-json": "${{ needs.orch-build-tag-publish-job.outputs.custom-version-json }}", | |
| "run-name": "bee-create-${{ env.RUN_NAME }}" | |
| }' | |
| orch-swat-test-job: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| testing-env: [ qa ] # what env resources to use, e.g. SA keys | |
| runs-on: ubuntu-latest | |
| needs: [create-bee-workflow] | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: dispatch to terra-github-workflows | |
| uses: broadinstitute/workflow-dispatch@v4 | |
| with: | |
| workflow: orch-swat-tests | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN}} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| inputs: '{ | |
| "bee-name": "orch-${{ github.run_id }}-${{ matrix.terra-env }}", | |
| "ENV": "${{ matrix.testing-env }}", | |
| "test-context": "${{ needs.prepare-configs.outputs.test-context }}", | |
| "ref": "${{ github.head_ref }}" | |
| }' | |
| # github.head_ref, used above, is only populated for PRs and will be blank when merging to develop. | |
| # This is ok; the orch-swat-tests workflow uses "develop" as a default when receiving a blank value. | |
| destroy-bee-workflow: | |
| strategy: | |
| matrix: | |
| terra-env: [ dev ] # what versions of apps do we use to emulate types of environments | |
| runs-on: ubuntu-latest | |
| needs: [orch-swat-test-job] | |
| if: always() # always run to confirm bee is destroyed | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: dispatch to terra-github-workflows | |
| uses: broadinstitute/workflow-dispatch@v4 | |
| with: | |
| workflow: bee-destroy | |
| run-name: "bee-destroy-${{ env.RUN_NAME }}" | |
| repo: broadinstitute/terra-github-workflows | |
| ref: refs/heads/main | |
| token: ${{ secrets.BROADBOT_TOKEN}} # github token for access to kick off a job in the private repo | |
| # manually recalculate b/c env context is broken https://github.com/actions/runner/issues/480 | |
| inputs: '{ | |
| "bee-name": "orch-${{ github.run_id }}-${{ matrix.terra-env }}", | |
| "run-name": "bee-destroy-${{ env.RUN_NAME }}" | |
| }' | |
| wait-for-completion: false |