jcoakley/dev1
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pipeline fixes to mirror prod AR

Browse Source
This commit is contained in:
Josh 2025-09-12 12:13:38 +00:00
parent 666427a7c9
commit f93b7e4d31
1 changed files with 58 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
.woodpecker.yml
View File

@ -174,8 +174,60 @@ kind: pipeline
type: docker
name: prod-promotion
steps:
- name: promote-tag-and-mirror
image: google/cloud-sdk:latest
entrypoint:
- bash
- -c
- |
set -euo pipefail
[[ "${PROMOTE:-}" == "prod" ]] || { echo "⏭ Skipping (PROMOTE=$PROMOTE)"; exit 0; }
# Dev is the single source of truth for IMG_TAG
IMG_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev)"
SRC="us-central1-docker.pkg.dev/aptivaai-dev/aptiva-repo"
DST="us-central1-docker.pkg.dev/aptivaai-prod/aptiva-repo"
apt-get update -qq
apt-get install -y -qq docker.io
gcloud auth configure-docker us-central1-docker.pkg.dev -q
for svc in server1 server2 server3 nginx; do
docker pull "$SRC/$svc:$IMG_TAG"
docker tag "$SRC/$svc:$IMG_TAG" "$DST/$svc:$IMG_TAG"
docker push "$DST/$svc:$IMG_TAG"
done
# Publish the exact tag to prod SM so deploy & scan read the same value
printf "%s" "${IMG_TAG}" | gcloud secrets versions add IMG_TAG --data-file=- --project="aptivaai-prod" >/dev/null
echo "🏷 Promoted IMG_TAG=${IMG_TAG} → aptivaai-prod & mirrored images"
- name: verify-sync
depends_on: [promote-tag-and-mirror]
image: google/cloud-sdk:latest
entrypoint:
- bash
- -c
- |
set -euo pipefail
[[ "${PROMOTE:-}" == "prod" ]] || { echo "⏭ Skipping (PROMOTE=$PROMOTE)"; exit 0; }
IMG_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev)"
prod_val="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-prod)"
[[ "$IMG_TAG" == "$prod_val" ]] || { echo "❌ Tag mismatch: dev=$IMG_TAG prod=$prod_val"; exit 1; }
echo "✅ Tag parity confirmed: $IMG_TAG"
# Ensure images truly exist in PROD AR
DST="us-central1-docker.pkg.dev/aptivaai-prod/aptiva-repo"
apt-get update -qq && apt-get install -y -qq docker.io
gcloud auth configure-docker us-central1-docker.pkg.dev -q
for svc in server1 server2 server3 nginx; do
docker pull "$DST/$svc:$IMG_TAG" >/dev/null
done
echo "✅ Prod AR has all images at :$IMG_TAG"
steps:
- name: security-scan
depends_on: [verify-sync]
image: google/cloud-sdk:latest
entrypoint:
- bash
@ -223,8 +275,9 @@ steps:
PROD_SSH_TARGET="$(gcloud secrets versions access latest --secret=PROD_SSH_TARGET --project=aptivaai-dev)"
# Use the IMG_TAG stored in PROD (the exact one mirrored there)
IMG_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-prod)"
# single source of truth for deploy as well
IMG_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev)"
echo "🔑 SSH prerequisites installed"
@ -238,6 +291,9 @@ steps:
PROJECT=aptivaai-prod; \
ENV=prod; \
export IMG_TAG='"$IMG_TAG"'; \
# sanity: ensure prod SM matches the single source (dev) before pull
prod_val=$(gcloud secrets versions access latest --secret=IMG_TAG --project=$PROJECT); \
[ "$prod_val" = "$IMG_TAG" ] || { echo "❌ Prod SM IMG_TAG ($prod_val) != dev IMG_TAG ($IMG_TAG)"; exit 1; }; \
\
# Pull all runtime secrets from aptivaai-prod
JWT_SECRET=$(gcloud secrets versions access latest --secret=JWT_SECRET_$ENV --project=$PROJECT); export JWT_SECRET; \