CI: redeploy ok-dspace on pushes to clarin-v7#175
Draft
kosarko wants to merge 3 commits into
Draft
Conversation
…branch
Sends a repository_dispatch to ufal/dspace-k8s once the images this environment
consumes have actually been pushed. That repository pins the tag to git and an
in-cluster reconciler applies it, so this job records a version and nothing
more - no deployment step and no cluster credential exists here, or anywhere in
GitHub.
Runs only for pushes to the default branch of the canonical repository, so a
pull request builds images but never triggers a deploy.
The token is a fine-grained PAT scoped to ufal/dspace-k8s with Contents: write,
which is what POST /repos/{owner}/{repo}/dispatches requires. A workflow's own
GITHUB_TOKEN cannot act on another repository, so this credential is
unavoidable; it is held as an organisation secret shared with this repository.
There was a problem hiding this comment.
Pull request overview
This PR updates the Docker image workflow to notify ufal/dspace-k8s (via repository_dispatch) after the ufal/dspace-angular dist image has been pushed on pushes to clarin-v7, enabling ok-dspace’s cluster-side reconciler to pick up and apply the new version.
Changes:
- Replaces the old commented-out deploy stub with a real
deploy-ok-dspacejob. - Gates the notification job to only run on pushes to
clarin-v7inufal/dspace-angularand only afterdspace-angular-distcompletes. - Triggers
ufal/dspace-k8sviapeter-evans/repository-dispatch@v4with a payload containing the frontend component and commit SHA.
The section header said "Redeploy" and the step was called "Trigger deployment", but this job only sends a repository_dispatch - the deploying happens in ufal/dspace-k8s and, ultimately, in the cluster. Renamed both so the workflow logs say what ran. Also names `clarin-v7` explicitly instead of "the default branch", since that is the literal value the guard matches and the two could drift apart.
Comment on lines
+83
to
+85
| needs: [dspace-angular-dist] | ||
| runs-on: ubuntu-latest | ||
| steps: |
Member
Author
There was a problem hiding this comment.
Agreed, fixed in 94eb17a. permissions: {} added to the job — it authenticates with the PAT and never touches GITHUB_TOKEN, so inheriting packages: write was pure blast radius.
Applied the same change to the equivalent job in ufal/clarin-dspace#1393 for consistency, though there the inherited set is only contents: read.
The job authenticates with a fine-grained PAT and never uses GITHUB_TOKEN, but
inherited the workflow-level permissions anyway - including `packages: write` in
dspace-angular, which it has no use for. `permissions: {}` limits what a
compromised third-party action could reach from this job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the commented-out
deploy:stub with adeploy-ok-dspacejob that notifiesufal/dspace-k8sonce the image this test environment consumeshas been pushed. Target environment: https://ok-dspace.dyn.cloud.e-infra.cz.
The old stub targeted the dataquest docker-compose instances (
dev-5/dev-8) we no longer haveaccess to, which is why it was commented out rather than maintained.
This job records a version; it does not deploy. It sends a
repository_dispatch;dspace-k8spins the tag to git and a reconciler inside the cluster applies it. No deployment step and no cluster
credential exists in this repository — or anywhere in GitHub.
needs: [dspace-angular-dist], notdspace-angular— the latter builds the-devsuffixedimage, while the overlay runs the unsuffixed dist image. Easy to get backwards.
clarin-v7inufal/dspace-angular, so a pull request builds theimage but never triggers a deploy, and forks never fire it.
secrets.OK_DSPACE_DEPLOY_TOKENis a fine-grained PAT scoped toufal/dspace-k8swithContents: write, which is what
POST /repos/{owner}/{repo}/dispatchesrequires. It is alreadyconfigured as an organisation secret.
Worth knowing: the deploy verification on the other side reads this application's commit from
/static/VERSION_D, whichscripts/sourceversion.pygenerates at image build time — so that scriptstaying wired up in
docker.ymlis now load-bearing for confirming a deploy actually landed.Depends on ufal/dspace-k8s#39, which defines the
deploy-ok-dspacedispatch type. This PR isinert until that merges.