continuous_deployment.yml

name: Continuous Deployment
on:
  push:
    branches:
    - 'main'

concurrency:
  group: cd-${{ github.ref }}
  cancel-in-progress: true


env:
  # These values are viewable in the Sara K8s CI entry of 1password
  # If updating secrets please also update the 1password entries
  GCLOUD_ZONE_ID: ${{ secrets.GCLOUD_ZONE_ID }}
  GCLOUD_CLUSTER_NAME: ${{ secrets.GCLOUD_CLUSTER_NAME }}
  GCLOUD_PROJECT_ID: ${{ secrets.GCLOUD_PROJECT_ID }}
  RASA_X_IMAGE_NAME: ${{ secrets.RASA_X_IMAGE_NAME }}
  ACTION_SERVER_IMAGE_NAME: ${{ secrets.ACTION_SERVER_IMAGE_NAME }}
  RASA_X_DOMAIN: ${{ secrets.RASA_X_DOMAIN }}
  RASA_X_DATABASE_PASSWORD: ${{ secrets.RASA_X_DATABASE_PASSWORD }}
  RASA_X_PASSWORD: ${{ secrets.RASA_X_PASSWORD }}
  RASA_X_PVC: ${{ secrets.RASA_X_PVC }}
  POSTGRES_PVC: ${{ secrets.POSTGRES_PVC }}
  RABBITMQ_PASSWORD: ${{ secrets.RABBITMQ_PASSWORD }}
  RABBITMQ_ERLANGCOOKIE: ${{ secrets.RABBITMQ_ERLANGCOOKIE }}
  REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
  RASA_TOKEN: ${{ secrets.RASA_TOKEN }}
  RASA_X_TOKEN: ${{ secrets.RASA_X_TOKEN }}
  JWT_SECRET: ${{ secrets.JWT_SECRET }}
  PASSWORDSALT: ${{ secrets.PASSWORDSALT }}
  STATIC_IP: ${{ secrets.STATIC_IP }}
  INGRESS_CERTIFICATE: ${{ secrets.INGRESS_CERTIFICATE }}
  STORAGE_BUCKET_URL: ${{ secrets.STORAGE_BUCKET_URL }}
  ACTION_SERVER_SECRET_NAME: ${{ secrets.ACTION_SERVER_SECRET_NAME }}

  NAMESPACE: "sara"
  RASA_X_USERNAME: "ci_user"
  RELEASE_NAME: "rasa-x"
  # NB! The rasa/rasa-x versions should be in sync with:
  # * rasa version in requirements.txt
  # * rasa-sdk base image version in Dockerfile
  RASA_X_VERSION: "1.0.1"
  RASA_VERSION: "2.8.21"
  # Due to the issue with openssl library for Google Cloud SDK (gcloud)
  # (https://github.com/GoogleCloudPlatform/github-actions/issues/128)
  # we use 297.0.01 version
  GCLOUD_VERSION: "297.0.1"

jobs:
  check_changed_files:
    # check change_filters.yml for filter details
    name: Check for file changes
    runs-on: ubuntu-20.04
    outputs:
      nlu: ${{ steps.changed-files.outputs.nlu }}
      core: ${{ steps.changed-files.outputs.core }}
      training: ${{ steps.changed-files.outputs.training }}
      actions: ${{ steps.changed-files.outputs.actions }}
      deployment: ${{ steps.changed-files.outputs.deployment }}

    steps:
      - uses: actions/checkout@v2
      - uses: RasaHQ/pr-changed-files-filter@c4f7116a04b8a4596313469429e2ad235f59d9c4
        id: changed-files
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          filters: .github/change_filters.yml
          base: ${{ github.ref }}


  build-push-action-server:
    name: Build Action Server Docker Image
    needs:
    - check_changed_files
    runs-on: ubuntu-latest
    if: ${{ needs.check_changed_files.outputs.actions == 'true' }}

    steps:
      - name: Checkout git repository 🕝
        uses: actions/checkout@v2

      - uses: google-github-actions/setup-gcloud@daadedc81d5f9d3c06d2c92f49202a3cc2b919ba
        name: Authenticate with gcloud 🎫
        with:
          version: "${{ env.GCLOUD_VERSION }}"
          service_account_key: ${{ secrets.GCLOUD_AUTH }}

      - name: Configure Docker to use Google Cloud Platform ☁️
        run: |
          gcloud auth configure-docker

      - name: Pull Latest Image
        run: |
          docker pull gcr.io/replicated-test/rasa-demo:latest || true

      - name: Set Build ID from run ID and number
        run: echo "BUILD_NUMBER=$GITHUB_RUN_NUMBER-$GITHUB_RUN_ID" >> $GITHUB_ENV

      - name: Build Image
        run: |
          docker build -t gcr.io/replicated-test/rasa-demo:run$BUILD_NUMBER -t gcr.io/replicated-test/rasa-demo:latest --cache-from gcr.io/replicated-test/rasa-demo:latest .

      - name: Push PR Image to Google Cloud Container Registry
        run: |
          docker push gcr.io/replicated-test/rasa-demo:latest
          docker push gcr.io/replicated-test/rasa-demo:run$BUILD_NUMBER


  deploy_to_k8s_cluster:
    name: Rasa Enterprise K8s deployment
    runs-on: ubuntu-20.04
    needs:
    - check_changed_files
    - build-push-action-server
    if: ${{ needs.check_changed_files.outputs.deployment == 'true' }}

    steps:
    - name: Cancel Previous Runs
      uses: styfle/cancel-workflow-action@0.8.0
      with:
        access_token: ${{ github.token }}
    - name: Checkout git repository 🕝
      uses: actions/checkout@v2

    - name: Install Helm and helmfile ⛑
      run: |
        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
        chmod 700 get_helm.sh
        ./get_helm.sh

        sudo curl -fsSL https://github.com/roboll/helmfile/releases/download/v0.141.0/helmfile_linux_amd64 --output /usr/local/bin/helmfile
        sudo chmod +x /usr/local/bin/helmfile

    - name: Authenticate with gcloud 🎫
      uses: google-github-actions/setup-gcloud@daadedc81d5f9d3c06d2c92f49202a3cc2b919ba
      with:
        version: "${{ env.GCLOUD_VERSION }}"
        service_account_email: ${{ secrets.SARA_GKE_SERVICE_ACCOUNT_NAME }}
        service_account_key: ${{ secrets.SARA_GKE_SERVICE_ACCOUNT_KEY }}

    - name: Authenticate docker and configure cluster credentials 🎫
      run: |
        # Set up docker to authenticate via gcloud command-line tool.
        gcloud --quiet auth configure-docker
        gcloud container clusters get-credentials "$GCLOUD_CLUSTER_NAME" --project ${GCLOUD_PROJECT_ID} --zone "$GCLOUD_ZONE_ID"

    - name: Prepare namespace
      run: |
        kubectl config set-context --current --namespace="${NAMESPACE}"

    - name: Set action server tag to existing
      # If the action server image was updated, the tag should be updated to run${{ env.BUILD_NUMBER }},
      # otherwise it should be kept as the exisitng tag
      if: ${{ needs.check_changed_files.outputs.actions == 'false' }}
      run: |
        tag=`helm get values --output json $RELEASE_NAME | jq .app.tag`
        echo $tag
        echo "ACTION_SERVER_TAG='${tag}'" >> $GITHUB_ENV

    - name: Update action server tag if actions changed
      # If the action server image was updated, the tag should be updated to run${{ env.BUILD_NUMBER }},
      # otherwise it should be kept as the exisitng tag
      if: ${{ needs.check_changed_files.outputs.actions == 'true' }}
      run: |
        tag=run$GITHUB_RUN_NUMBER-$GITHUB_RUN_ID
        echo $tag
        echo "ACTION_SERVER_TAG='$tag'" >> $GITHUB_ENV

    - name: Deploy Rasa X chart ☸️
      run: >-
        cd ${{ github.workspace }}/.github/deployments &&
        helmfile repos && helmfile sync

    - name: Wait for deployment to be ready ⏰
      timeout-minutes: 15
      run: |
        kubectl wait \
          --for=condition=available \
          --timeout=600s \
          -l "app.kubernetes.io/component=rasa-x" deployment

        # Wait for DB migration to be done
        until [[ $(curl -s "https://${{ env.RASA_X_DOMAIN }}/api/health" | tee /tmp/output_status.txt | jq -r .database_migration.status) -eq "completed" ]]
        do
          cat /tmp/output_status.txt || true
          sleep 5
        done
        # Wait for deployment to be ready
        until [[ $(curl -s https://${{ env.RASA_X_DOMAIN }}/api/health | tee /tmp/output_health.txt | jq -r .production.status) -eq 200 ]]
        do
          cat /tmp/output_health.txt || true
          sleep 5
        done

    - name: Install rasactl
      run: |
        brew tap rasahq/rasactl
        brew install rasactl

    - name: Add deployment to rasactl
      run: |
        # Delete secret 'rasactl' that added by previous runner
        kubectl -n ${NAMESPACE} delete secret rasactl || true
        # Delete label 'rasactl=true' to prevent the error 'secrets "rasactl" not found'
        kubectl label namespace sara rasactl- || true

        rasactl add ${NAMESPACE} --rasa-x-release-name ${RELEASE_NAME} --verbose --debug || true
        rasactl status

    - name: Download model from storage bucket
      run: |
        RASA_VERSION_SHORT=${RASA_VERSION::3}
        echo "Greping model that trained on rasa ${RASA_VERSION_SHORT}.x ..."
        # Fetch the latest model based on when it created and which MAJOR rasa version is trained on
        MODEL_URL=$(gsutil ls -l ${{ secrets.STORAGE_BUCKET_URL }}/rasa_demo_models/ | grep "tar.gz" | grep "rasa$RASA_VERSION_SHORT" | sort -k2 | tail -n1 | awk '{print $3}')
        # Get the model local path, get rid of bucket rul
        MODEL_PATH=$(basename $MODEL_URL)
        # Download the model from bucket
        gsutil -m cp ${MODEL_URL} ${MODEL_PATH}

        echo "MODEL_PATH=${MODEL_PATH}" >> $GITHUB_ENV
        echo "MODEL_NAME=$(basename $MODEL_PATH .tar.gz)" >> $GITHUB_ENV

    - name: Upload model to Rasa X and tag model to production
      working-directory: ${{ github.workspace }}
      env:
        RASACTL_RASA_X_URL: https://${{ env.RASA_X_DOMAIN }}
        RASACTL_AUTH_USER: ${{ env.RASA_X_USERNAME }}
        RASACTL_AUTH_PASSWORD: ${{ env.RASA_X_PASSWORD }}
        # Disable http2client. Current Rasa X (2.6) endpoint doesn’t support http2.
        GODEBUG: http2client=0
      timeout-minutes: 10
      run: |
        # Upload model
        rasactl model upload ${MODEL_PATH}
        # Tag model as production
        rasactl model tag ${MODEL_NAME} production