mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
ci: remove legacy cross-compile deploy workflow
This commit is contained in:
@@ -1,232 +0,0 @@
|
||||
name: Build & Deploy MPC Dashboard
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
tags: ['v*']
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
REGISTRY: ghcr.io
|
||||
|
||||
# Runner naming convention: {org}-build-{os}-{arch}
|
||||
# Self-hosted ARC: lux-build-linux-amd64 (DO lux-k8s)
|
||||
# GitHub-hosted: macos-14 (Apple Silicon)
|
||||
# windows-latest (x86_64)
|
||||
# Future: lux-build-linux-arm64 (AWS Graviton or DO arm64)
|
||||
|
||||
jobs:
|
||||
build-api:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Go 1.26
|
||||
uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version: "1.26"
|
||||
cache: false
|
||||
|
||||
- name: Vendor dependencies
|
||||
run: GOWORK=off go mod vendor
|
||||
|
||||
- name: Cross-compile for all architectures
|
||||
run: |
|
||||
GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod=vendor -o mpcd-linux-amd64 ./cmd/mpcd/
|
||||
GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -mod=vendor -o mpcd-linux-arm64 ./cmd/mpcd/
|
||||
echo "Binary sizes:"
|
||||
ls -lh mpcd-linux-amd64 mpcd-linux-arm64
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Log in to GHCR
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: |
|
||||
${{ env.REGISTRY }}/luxfi/mpc-api
|
||||
${{ env.REGISTRY }}/luxfi/mpc
|
||||
tags: |
|
||||
type=ref,event=branch
|
||||
type=semver,pattern={{version}}
|
||||
type=sha,prefix=sha-
|
||||
type=raw,value=latest,enable={{is_default_branch}}
|
||||
|
||||
- name: Build and push API (multi-arch)
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
platforms: linux/amd64,linux/arm64
|
||||
provenance: false
|
||||
sbom: false
|
||||
cache-from: type=gha,scope=api
|
||||
cache-to: type=gha,mode=max,scope=api
|
||||
build-args: |
|
||||
GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
build-dashboard:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Log in to GHCR
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/luxfi/mpc-dashboard
|
||||
tags: |
|
||||
type=ref,event=branch
|
||||
type=semver,pattern={{version}}
|
||||
type=sha,prefix=sha-
|
||||
type=raw,value=latest,enable={{is_default_branch}}
|
||||
|
||||
- name: Build and push Dashboard (multi-arch)
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: ./dashboard
|
||||
file: ./dashboard/Dockerfile
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
platforms: linux/amd64,linux/arm64
|
||||
provenance: false
|
||||
sbom: false
|
||||
cache-from: type=gha,scope=dashboard
|
||||
cache-to: type=gha,mode=max,scope=dashboard
|
||||
build-args: |
|
||||
NEXT_PUBLIC_API_URL=https://mpc-api.lux.network/api/v1
|
||||
NEXT_PUBLIC_IAM_URL=https://lux.id
|
||||
NEXT_PUBLIC_IAM_CLIENT_ID=lux-mpc
|
||||
|
||||
deploy:
|
||||
needs: [build-api, build-dashboard]
|
||||
runs-on: ubuntu-latest
|
||||
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Fetch deploy credentials from KMS
|
||||
id: kms
|
||||
env:
|
||||
KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
|
||||
KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
|
||||
HANZO_API_KEY: ${{ secrets.HANZO_API_KEY }}
|
||||
KMS_ENDPOINT: ${{ vars.KMS_ENDPOINT || 'https://kms.hanzo.ai' }}
|
||||
run: |
|
||||
# Auth: Universal Auth (preferred) or legacy API key
|
||||
if [ -n "${KMS_CLIENT_ID}" ] && [ -n "${KMS_CLIENT_SECRET}" ]; then
|
||||
echo "Attempting Universal Auth login..."
|
||||
login_response=$(curl -s -w "\n%{http_code}" "${KMS_ENDPOINT}/api/v1/auth/universal-auth/login" \
|
||||
-H "Content-Type: application/json" \
|
||||
-d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}")
|
||||
login_http_code=$(echo "$login_response" | tail -1)
|
||||
login_body=$(echo "$login_response" | sed '$d')
|
||||
echo "Login HTTP status: ${login_http_code}"
|
||||
if [ "$login_http_code" = "200" ]; then
|
||||
HANZO_API_KEY=$(echo "$login_body" | jq -r '.accessToken')
|
||||
echo "Got access token (length: ${#HANZO_API_KEY})"
|
||||
else
|
||||
echo "Login failed: $(echo "$login_body" | jq -r '.message // .error // "unknown"')"
|
||||
fi
|
||||
else
|
||||
echo "No KMS_CLIENT_ID/SECRET, using HANZO_API_KEY fallback"
|
||||
fi
|
||||
echo "Fetching secrets..."
|
||||
secrets_response=$(curl -s -w "\n%{http_code}" "${KMS_ENDPOINT}/api/v3/secrets/raw?workspaceId=e1359bf4-31b4-4dfa-bb90-323e2c298ad8&secretPath=/deploy&environment=prod" \
|
||||
-H "Authorization: Bearer ${HANZO_API_KEY}")
|
||||
secrets_http_code=$(echo "$secrets_response" | tail -1)
|
||||
secrets_body=$(echo "$secrets_response" | sed '$d')
|
||||
echo "Secrets HTTP status: ${secrets_http_code}"
|
||||
if [ "$secrets_http_code" = "200" ]; then
|
||||
token=$(echo "$secrets_body" | jq -r '.secrets[] | select(.secretKey=="DO_API_TOKEN") | .secretValue // empty')
|
||||
else
|
||||
echo "Secrets fetch failed: $(echo "$secrets_body" | jq -r '.message // .error // "unknown"')"
|
||||
fi
|
||||
if [ -z "${token:-}" ]; then
|
||||
echo "::error::Deploy credentials not found. Set HANZO_API_KEY with KMS access."
|
||||
exit 1
|
||||
fi
|
||||
echo "::add-mask::${token}"
|
||||
echo "token=${token}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Install doctl
|
||||
uses: digitalocean/action-doctl@v2
|
||||
with:
|
||||
token: ${{ steps.kms.outputs.token }}
|
||||
|
||||
- name: Configure kubectl
|
||||
run: |
|
||||
doctl kubernetes cluster kubeconfig save lux-k8s
|
||||
|
||||
- name: Apply namespace and secrets first
|
||||
run: |
|
||||
kubectl apply -f k8s/namespace.yaml
|
||||
kubectl apply -f k8s/secrets.yaml
|
||||
|
||||
- name: Apply infrastructure
|
||||
run: |
|
||||
kubectl apply -f k8s/certificate.yaml
|
||||
kubectl apply -f k8s/postgres.yaml
|
||||
kubectl apply -f k8s/valkey.yaml
|
||||
|
||||
- name: Apply MPC nodes and API
|
||||
run: |
|
||||
kubectl apply -f k8s/api-service.yaml
|
||||
kubectl apply -f k8s/api-deployment.yaml
|
||||
kubectl apply -f k8s/mpc-statefulset.yaml --server-side --force-conflicts || \
|
||||
kubectl apply -f k8s/mpc-statefulset.yaml --force
|
||||
|
||||
- name: Apply dashboard
|
||||
run: |
|
||||
kubectl apply -f k8s/dashboard-service.yaml
|
||||
kubectl apply -f k8s/dashboard-deployment.yaml
|
||||
|
||||
- name: Apply ingress
|
||||
run: |
|
||||
kubectl apply -f k8s/ingressroute.yaml
|
||||
|
||||
- name: Restart deployments to pick up new images
|
||||
run: |
|
||||
kubectl rollout restart statefulset/mpc-node -n lux-mpc
|
||||
kubectl rollout restart deployment/mpc-api -n lux-mpc || true
|
||||
kubectl rollout restart deployment/mpc-dashboard -n lux-mpc
|
||||
|
||||
- name: Wait for rollout
|
||||
run: |
|
||||
kubectl rollout status statefulset/mpc-node -n lux-mpc --timeout=300s
|
||||
kubectl rollout status deployment/mpc-api -n lux-mpc --timeout=180s
|
||||
kubectl rollout status deployment/mpc-dashboard -n lux-mpc --timeout=180s
|
||||
Reference in New Issue
Block a user