97 lines
3.4 KiB
YAML
97 lines
3.4 KiB
YAML
name: Den API Env
|
|
|
|
# Sets a single environment variable on the production den-api service
|
|
# (Render) and triggers a deploy so it takes effect.
|
|
#
|
|
# Do NOT use this for secret values: workflow_dispatch inputs are visible in
|
|
# the run metadata. Secrets should be set in the Render dashboard directly.
|
|
#
|
|
# Required GitHub Actions secrets:
|
|
# RENDER_API_KEY Render API key
|
|
# RENDER_DEN_CONTROL_PLANE_SERVICE_ID Render service id of den-api
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
key:
|
|
description: "Environment variable name (e.g. DEN_PLAN_GATING_ENABLED)"
|
|
type: string
|
|
required: true
|
|
value:
|
|
description: "Environment variable value (non-secret values only)"
|
|
type: string
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: den-api-env
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
set-env:
|
|
name: Set env var and deploy
|
|
if: github.repository == 'different-ai/openwork'
|
|
runs-on: blacksmith-4vcpu-ubuntu-2204
|
|
|
|
env:
|
|
RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
|
|
RENDER_SERVICE_ID: ${{ secrets.RENDER_DEN_CONTROL_PLANE_SERVICE_ID }}
|
|
|
|
steps:
|
|
- name: Verify Render secrets are configured
|
|
run: |
|
|
set -euo pipefail
|
|
missing=""
|
|
[ -z "$RENDER_API_KEY" ] && missing="$missing RENDER_API_KEY"
|
|
[ -z "$RENDER_SERVICE_ID" ] && missing="$missing RENDER_DEN_CONTROL_PLANE_SERVICE_ID"
|
|
if [ -n "$missing" ]; then
|
|
echo "::error::Missing GitHub Actions secrets:$missing."
|
|
exit 1
|
|
fi
|
|
echo "Render secrets present."
|
|
|
|
- name: Update environment variable
|
|
run: |
|
|
set -euo pipefail
|
|
value="$(jq -n --arg v '${{ inputs.value }}' '{value: $v}')"
|
|
curl -sf -X PUT "https://api.render.com/v1/services/$RENDER_SERVICE_ID/env-vars/${{ inputs.key }}" \
|
|
-H "Authorization: Bearer $RENDER_API_KEY" \
|
|
-H "Content-Type: application/json" \
|
|
-d "$value" >/dev/null
|
|
echo "Updated ${{ inputs.key }} on the den-api service."
|
|
|
|
- name: Trigger deploy and wait
|
|
run: |
|
|
set -euo pipefail
|
|
response="$(curl -s -w '\n%{http_code}' -X POST "https://api.render.com/v1/services/$RENDER_SERVICE_ID/deploys" \
|
|
-H "Authorization: Bearer $RENDER_API_KEY" \
|
|
-H "Content-Type: application/json" -d '{}')"
|
|
http_code="$(printf '%s' "$response" | tail -1)"
|
|
body="$(printf '%s' "$response" | sed '$d')"
|
|
if [ "$http_code" -ge 400 ]; then
|
|
echo "::error::POST /deploys returned HTTP $http_code: $body"
|
|
exit 1
|
|
fi
|
|
deploy_id="$(printf '%s' "$body" | jq -r '.id')"
|
|
echo "Deploy triggered: $deploy_id"
|
|
for _ in $(seq 1 90); do
|
|
status="$(curl -sf "https://api.render.com/v1/services/$RENDER_SERVICE_ID/deploys/$deploy_id" \
|
|
-H "Authorization: Bearer $RENDER_API_KEY" | jq -r '.status')"
|
|
echo "deploy status: $status"
|
|
case "$status" in
|
|
live)
|
|
echo "Deploy is live."
|
|
exit 0
|
|
;;
|
|
build_failed|update_failed|pre_deploy_failed|canceled|deactivated)
|
|
echo "::error::Deploy failed with status: $status"
|
|
exit 1
|
|
;;
|
|
esac
|
|
sleep 10
|
|
done
|
|
echo "::error::Deploy did not go live within 15 minutes."
|
|
exit 1
|