tpl-deploy-app.yml

---
name: 🔒 Deploy Application
on:
  workflow_call:
    outputs:
      contracts-env-artifact-id:
        value: ${{ inputs.env-type }}-contracts-env
      octant-web-url:
        value: ${{ jobs.wait-for-app.outputs.octant_web_url }}
      octant-backend-url:
        value: ${{ jobs.wait-for-app.outputs.octant_backend_url }}
      anvil-rpc-url:
        value: ${{ jobs.deploy-contracts.outputs.anvil_rpc_url }}
    inputs:
      branch-head-ref:
        required: true
        type: string
      env-type:
        required: true
        type: string
      image-tag:
        required: true
        type: string
      pull-request-id:
        required: false
        type: string
      env-id:
        required: true
        type: string
      deployment-id:
        required: true
        type: string
      workflow-id:
        required: true
        type: string
      deploy-contracts:
        required: false
        default: false
        type: boolean
      chain-id:
        required: true
        type: number
      chain-name:
        required: true
        type: string
      network-name:
        required: true
        type: string
      snapshotter-enabled:
        required: false
        default: false
        type: boolean
      multisigger-enabled:
        required: false
        default: true
        type: boolean
      scheduler-enabled:
        required: false
        default: false
        type: boolean
      glm-claim-enabled:
        required: false
        default: false
        type: boolean
      vault-confirm-withdrawals-enabled:
        required: false
        default: false
        type: boolean
      backend-server-pgsql:
        required: false
        default: true
        type: boolean
      forward-first-epoch:
        required: false
        default: false
        type: boolean
      skip-local-subgraph-update:
        required: false
        default: true
        type: boolean
      octant-env:
        required: false
        default: production
        type: string
      anvil-block-time:
        required: false
        default: 0
        type: number
      decision-window:
        required: false
        default: 1209600
        type: number
      epoch-duration:
        required: false
        default: 7776000
        type: number
      web-client-replicas:
        required: false
        default: 1
        type: number
      coin-prices-server-replicas:
        required: false
        default: 2
        type: number
      backend-server-replicas:
        required: false
        default: 3
        type: number
      multideployer-enabled:
        required: false
        default: false
        type: boolean
      subgraph-deploy:
        required: false
        default: true
        type: boolean
      graph-healtchecker-enabled:
        required: false
        default: true
        type: boolean
      ipfs-gateways:
        required: false
        default: 'https://turquoise-accused-gayal-88.mypinata.cloud/ipfs/,https://octant.infura-ipfs.io/ipfs/'
        type: string

env:
  ENV_TYPE: ${{ inputs.env-type }}
  IMAGE_TAG: "${{ inputs.image-tag }}"
  CI_MERGE_REQUEST_IID: "${{ inputs.pull-request-id }}"
  CI_PIPELINE_ID: "${{ inputs.workflow-id }}"
  # ----------------------------------------------------------------------------
  # BACKEND
  CHAIN_ID: ${{ inputs.chain-id }}
  CHAIN_NAME: ${{ inputs.chain-name }}
  OCTANT_BACKEND_SECRET_KEY: some-random-key
  SNAPSHOTTER_ENABLED: ${{ inputs.snapshotter-enabled }}
  MULTISIGGER_ENABLED: ${{ inputs.multisigger-enabled }}
  SCHEDULER_ENABLED: ${{ inputs.scheduler-enabled }}
  GLM_CLAIM_ENABLED: ${{ inputs.glm-claim-enabled }}
  VAULT_CONFIRM_WITHDRAWALS_ENABLED: ${{ inputs.vault-confirm-withdrawals-enabled }}
  BACKEND_SERVER_PGSQL: ${{ inputs.backend-server-pgsql }}
  WEB_CLIENT_REPLICAS: ${{ inputs.web-client-replicas }}
  COIN_PRICES_SERVER_REPLICAS: ${{ inputs.coin-prices-server-replicas }}
  BACKEND_SERVER_REPLICAS: ${{ inputs.backend-server-replicas }}
  OCTANT_ENV: ${{ inputs.octant-env }}
  GLM_SENDER_NONCE: ${{ vars.GLM_SENDER_NONCE }}
  MAINNET_PROPOSAL_CIDS: "QmSQEFD35gKxdPEmngNt1CWe3kSwiiGqBn1Z3FZvWb8mvK,Qmds9N5y2vkMuPTD6M4EBxNXnf3bjTDmzWBGnCkQGsMMGe,QmSXcT18anMXKACTueom8GXw8zrxTBbHGB71atitf6gZ9V,QmXomSdCCwt4FtBp3pidqSz3PtaiV2EyQikU6zRGWeCAsf"
  # ----------------------------------------------------------------------------
  # CONTRACTS / ANVIL / SUBGRAPH / SYNPRESS
  NETWORK: ${{ inputs.chain-name }}
  NETWORK_NAME: ${{ inputs.network-name }}
  NETWORK_ID: ${{ inputs.chain-id }}
  FORWARD_FIRST_EPOCH: ${{ inputs.forward-first-epoch }}
  DECISION_WINDOW: ${{ inputs.decision-window }}
  EPOCH_DURATION: ${{ inputs.epoch-duration }}
  SKIP_LOCAL_SUBGRAPH_UPDATE: ${{ inputs.skip-local-subgraph-update }}
  ANVIL_BLOCK_TIME: ${{ inputs.anvil-block-time }}
  SECRET_WORDS: test test test test test test test test test test test junk
  PROPOSALS_ADDRESSES: 0x09A38B6187a2c44B6ba71c277c50764B5878b824,0x5597cD8d55D2Db56b10FF4F8fe69C8922BF6C537,0x3250c2CEE20FA34D1c4F68eAA87E53512e95A62a,0x0B7246eF74Ca7b37Fdc3D15be4f0b49876622F95,0x15c941a44a343B8c46a28F2BB9aFc7a54E255A4f,0xe7d4Ac3c77cF3683E0d15C15eaba7CDB8c092D98,0xa83a92297B3d80A70cC396bf74424971A9890704,0x7380A42137D16a0E7684578d8b3d32e1fbD021B5,0x53390590476dC98860316e4B46Bb9842AF55efc4,0x576edCed7475D8F64a5e2D5227c93Ca57d7f5d20,0x809C9f8dd8CA93A41c3adca4972Fa234C28F7714,0x4C6fd545fc18C6538eC304Ae549717CA58f0D6eb,0xfFbD35255008F86322051F2313D4b343540e0e00,0x9be7267002CAD0b8501f7322d50612CB13788Bcf,0x7Dd488f03E0A043b550E82D3C2685aA83B96407C,0x2DCDF80f439843D7E0aD1fEF9E7a439B7917eAc9,0xd1B8dB70Ded72dB850713b2ce7e1A4FfAfAD95d1,0x08e40e1C0681D072a54Fc5868752c02bb3996FFA,0x0cbF31Ef6545EE30f47651D1A991Bf0aeB03DF29,0x02Cb3C150BEdca124d0aE8CcCb72fefbe705c953,0x9531C059098e3d194fF87FebB587aB07B30B1306,0xBCA48834b3653ec795411EB0FCBE4038F8527d62,0xa095Ee27B11FCAac8e1be84891ab62C74F08C854,0xF41a98D4F2E52aa1ccB48F0b6539e955707b8F7a,0x87fEEd6162CB7dFe6B62F64366742349bF4D1B05,0x1337E2624ffEC537087c6774e9A18031CFEAf0a9,0x00080706a7D99CBC163D52dcF435205B1aD940D1,0x992A3a242D6471d24783b4C2C6AF3EC7df871761,0xFC1436689F68079Fc17A931666b7947789229ed8,0xfcBf17200C64E860F6639aa12B525015d115F863
  PROPOSALS_CID: QmdtFLK3sB7EwQTNaqtmBnZqnN2pYZcu6GmUSTrpvb9wcq
  MULTISIG_ADDRESS: "${{ vars.MULTISIG_ADDRESS }}"
  TESTNET_DEPLOYER_PRIVATE_KEY: "${{ secrets.TESTNET_DEPLOYER_PRIVATE_KEY }}"
  TESTNET_MULTISIG_PRIVATE_KEY: "${{ secrets.TESTNET_MULTISIG_PRIVATE_KEY }}"
  TESTNET_RPC_URL: "${{ secrets.TESTNET_RPC_URL }}"
  ETHERSCAN_API_KEY: "${{ secrets.ETHERSCAN_API_KEY }}"
  VITE_ALCHEMY_ID: "${{ secrets.VITE_ALCHEMY_ID }}"
  IPFS_GATEWAYS: "${{ inputs.ipfs-gateways }}"
  MULTIDEPLOYER_ENABLED: ${{ inputs.multideployer-enabled }}
  SUBGRAPH_DEPLOY: ${{ inputs.subgraph-deploy }}
  GRAPH_HEALTCHECKER_ENABLED: ${{ inputs.graph-healtchecker-enabled }}
  # ----------------------------------------------------------------------------
  # CI/CD
  GCP_DOCKER_IMAGES_REGISTRY_SERVICE_ACCOUNT: "${{ secrets.GCP_DOCKER_IMAGES_REGISTRY_SERVICE_ACCOUNT }}"
  KANIKO_CACHE_CONFIG: "${{ secrets.KANIKO_CACHE_CONFIG }}"
  KANIKO_CACHE_REPO: "${{ secrets.KANIKO_CACHE_REPO }}"
  HOUSEKEEPER_GITHUB_SIGNING_KEY: "${{ secrets.HOUSEKEEPER_GITHUB_SIGNING_KEY }}"
  HOUSEKEEPER_GITHUB_SIGNING_KEY_ID: "${{ secrets.HOUSEKEEPER_GITHUB_SIGNING_KEY_ID }}"
  ARGOCD_URL: "${{ secrets.ARGOCD_URL }}"
  ARGOCD_ACCESS_TOKEN: "${{ secrets.ARGOCD_ACCESS_TOKEN }}"
  GITLAB_PAT_OCTANT_K8S_DEVOPS_REPOSITORY_WRITE: "${{ secrets.GITLAB_PAT_OCTANT_K8S_DEVOPS_REPOSITORY_WRITE }}"

jobs:
  start-anvil:
    name: Start Anvil
    if: ${{ inputs.deploy-contracts }}
    runs-on:
    - general
    container:
      image: registry.gitlab.com/golemfoundation/devops/container-builder/gitops-builder:2ea6d57c
      credentials:
        username: "doesnt-matter"
        password: "${{ secrets.GITLAB_PAT_CONTAINER_BUILDER_DOCKER_IMAGES_READ }}"
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ inputs.branch-head-ref }}
        fetch-depth: 10

    - name: (debug)
      run: |
        set -ex

        env
        ls -l

        echo ${{ inputs.env-type }}
        echo ${{ inputs.image-tag }}
        echo ${{ inputs.pull-request-id }}
        echo ${{ inputs.workflow-id }}
      shell: bash

    - name: Set up Gitops mutex
      uses: ben-z/gh-action-mutex@v1.0.0-alpha.9
      with:
        branch: gitops-mutex

    - name: Deploy Anvil Argo application
      run: |
        set -ex

        export CI_PROJECT_DIR="${GITHUB_WORKSPACE}"

        source ${CI_PROJECT_DIR}/ci/argocd/resolve_env.sh $ENV_TYPE
        bash ${CI_PROJECT_DIR}/ci/argocd/application.sh create
      shell: bash

  deploy-contracts:
    name: Deploy Contracts
    needs:
    - start-anvil
    if: ${{ inputs.deploy-contracts }}
    runs-on:
    - general
    outputs:
      anvil_rpc_url: ${{ steps.deploy.outputs.LOCAL_RPC_URL }}
    container:
      image: ${{ vars.GCP_DOCKER_IMAGE_REGISTRY }}/contracts-v1:${{ inputs.image-tag }}
      credentials:
        username: "_json_key_base64"
        password: "${{ secrets.GCP_DOCKER_IMAGES_REGISTRY_SERVICE_ACCOUNT }}"
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ inputs.branch-head-ref }}
        fetch-depth: 10

    - name: Deploy contracts
      id: deploy
      run: |
        set -ex

        export CI_PROJECT_DIR="${GITHUB_WORKSPACE}"
        export EPOCHS_START=$(date +%s)

        source ${CI_PROJECT_DIR}/ci/argocd/resolve_env.sh $ENV_TYPE
        bash ${CI_PROJECT_DIR}/ci/argocd/wait_for_app.sh

        export LOCAL_RPC_URL; LOCAL_RPC_URL=https://$(bash ${CI_PROJECT_DIR}/ci/argocd/get_rpc_url.sh)

        # BUG: For some reason this cache is a problem for this job to pass
        # https://linear.app/golemfoundation/issue/OCT-1382/error-during-ci-contracts-deployment
        rm -r $HOME/.cache/hardhat-nodejs/ || true

        /app/entrypoint.sh $NETWORK ${CI_PROJECT_DIR}/contracts.env

        echo "LOCAL_RPC_URL=$LOCAL_RPC_URL" >> $GITHUB_OUTPUT
      shell: bash
    - uses: actions/upload-artifact@v4
      if: success()
      with:
        name: ${{ env.ENV_TYPE }}-contracts-env
        retention-days: 1
        if-no-files-found: error
        compression-level: 0
        overwrite: true
        path: |-
          contracts.env

  start-application-stack:
    name: Start Application Stack
    needs:
    - deploy-contracts
    runs-on:
    - general
    if: always()
    container:
      image: registry.gitlab.com/golemfoundation/devops/container-builder/gitops-builder:2ea6d57c
      credentials:
        username: "doesnt-matter"
        password: "${{ secrets.GITLAB_PAT_CONTAINER_BUILDER_DOCKER_IMAGES_READ }}"
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ inputs.branch-head-ref }}
        fetch-depth: 10
    - uses: actions/download-artifact@v4
      if: ${{ inputs.deploy-contracts }}
      with:
        name: ${{ env.ENV_TYPE }}-contracts-env
    - name: Set up Gitops mutex
      uses: ben-z/gh-action-mutex@v1.0.0-alpha.9
      with:
        branch: gitops-mutex
    - name: Deploy Complete Argo application
      run: |
        set -ex

        export CI_PROJECT_DIR="${GITHUB_WORKSPACE}"

        if [[ "${{ inputs.deploy-contracts }}" == "true" ]]; then
          export $(grep -v '^#' ${CI_PROJECT_DIR}/contracts.env | xargs)
        else
          # sourcing hardcoded contracts (master, uat, etc)
          export $(grep -v '^#' ${CI_PROJECT_DIR}/ci/argocd/contracts/$ENV_TYPE.env | xargs)
        fi

        source ${CI_PROJECT_DIR}/ci/argocd/resolve_env.sh $ENV_TYPE
        bash ${CI_PROJECT_DIR}/ci/argocd/application.sh update
      shell: bash

  wait-for-app:
    name: Wait for Application Readiness
    needs:
    - start-application-stack
    runs-on:
    - general
    if: always() && (needs.start-application-stack.result == 'success')
    outputs:
      octant_web_url: ${{ steps.app.outputs.OCTANT_WEB_URL }}
      octant_backend_url: ${{ steps.app.outputs.OCTANT_BACKEND_URL }}
    container:
      image: registry.gitlab.com/golemfoundation/devops/container-builder/gitops-builder:2ea6d57c
      credentials:
        username: "doesnt-matter"
        password: "${{ secrets.GITLAB_PAT_CONTAINER_BUILDER_DOCKER_IMAGES_READ }}"
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ inputs.branch-head-ref }}
        fetch-depth: 10
    - name: Wait for application ready
      id: app
      run: |
        set -ex

        export CI_PROJECT_DIR="${GITHUB_WORKSPACE}"

        source ${CI_PROJECT_DIR}/ci/argocd/resolve_env.sh $ENV_TYPE
        bash ${CI_PROJECT_DIR}/ci/argocd/wait_for_app.sh

        export OCTANT_WEB_URL; OCTANT_WEB_URL=https://$(bash ${CI_PROJECT_DIR}/ci/argocd/get_web_client_url.sh)
        export OCTANT_BACKEND_URL; OCTANT_BACKEND_URL=https://$(bash ${CI_PROJECT_DIR}/ci/argocd/get_backend_url.sh)

        echo "OCTANT_WEB_URL=$OCTANT_WEB_URL" >> $GITHUB_OUTPUT
        echo "OCTANT_BACKEND_URL=$OCTANT_BACKEND_URL" >> $GITHUB_OUTPUT
      shell: bash

  update-contracts-env:
    name: Update persistent contracts
    needs:
    # We need to explicitly set all jobs for `needs.*` array to have all workflow jobs
    - wait-for-app
    if: ${{ success() && inputs.deploy-contracts && (inputs.env-type == 'uat' || inputs.env-type == 'master') }}
    runs-on:
    - general
    container:
      image: registry.gitlab.com/golemfoundation/devops/container-builder/gitops-builder:2ea6d57c
      credentials:
        username: "doesnt-matter"
        password: "${{ secrets.GITLAB_PAT_CONTAINER_BUILDER_DOCKER_IMAGES_READ }}"
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ inputs.branch-head-ref }}
        fetch-depth: 0
        token: ${{ secrets.HOUSEKEEPER_PAT_OCTANT_REPO }}
    - uses: actions/download-artifact@v4
      with:
        name: ${{ env.ENV_TYPE }}-contracts-env
    - name: Commit newly deployed contracts
      run: |
        set -ex
        export CI_PROJECT_DIR="${GITHUB_WORKSPACE}"

        mv ${CI_PROJECT_DIR}/contracts.env ${CI_PROJECT_DIR}/ci/argocd/contracts/${ENV_TYPE}.env

        gpg --import <(echo ${HOUSEKEEPER_GITHUB_SIGNING_KEY} | base64 -d)

        git config --global --add safe.directory ${CI_PROJECT_DIR}
        git config --local user.email "birnam@wildland.io"
        git config --local user.name "Housekeeper Bot"
        git config --local user.signingkey "${HOUSEKEEPER_GITHUB_SIGNING_KEY_ID}"

        git add ${CI_PROJECT_DIR}/ci/argocd/contracts/${ENV_TYPE}.env
        git commit -S -m "[CI/CD] Update ${ENV_TYPE}.env contracts"
      shell: bash
    - name: Push changes
      uses: ad-m/github-push-action@master
      with:
        branch: ${{ inputs.branch-head-ref }}
        github_token: ${{ secrets.HOUSEKEEPER_PAT_OCTANT_REPO }}

  update-deployment:
    name: Set deployment status
    needs:
    # We need to explicitly set all jobs for `needs.*` array to have all workflow jobs
    - start-anvil
    - deploy-contracts
    - start-application-stack
    - wait-for-app
    runs-on:
    - general
    if: always()
    steps:
    - name: Compute workflow status
      id: workflow-status
      run: |
        if [[ "${{ contains(join(needs.*.result, ' '), 'failure') }}" == "true" ]]; then
          STATUS='failure'
        else
          STATUS='success'
        fi

        echo "STATUS=$STATUS" >> $GITHUB_OUTPUT

    - name: Update deployment status
      uses: bobheadxi/deployments@v1
      with:
        step: finish
        auto_inactive: true
        status: ${{ steps.workflow-status.outputs.STATUS }}
        token: ${{ secrets.GH_BOT_TOKEN }}
        env: ${{ inputs.env-id }}
        deployment_id: ${{ inputs.deployment-id }}