98 lines
3.5 KiB
YAML
98 lines
3.5 KiB
YAML
name: gcp-readiness
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
concurrency:
|
|
group: gcp-readiness-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
PROJECT_ID: teleo-501523
|
|
WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/living-ip-github
|
|
ARTIFACT_SERVICE_ACCOUNT: sa-artifact-builder@teleo-501523.iam.gserviceaccount.com
|
|
|
|
jobs:
|
|
readiness:
|
|
name: Read-only GCP readiness probe
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- id: auth
|
|
uses: google-github-actions/auth@v2
|
|
with:
|
|
workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
|
|
service_account: ${{ env.ARTIFACT_SERVICE_ACCOUNT }}
|
|
|
|
- uses: google-github-actions/setup-gcloud@v2
|
|
|
|
- name: Capture gcloud identity
|
|
shell: bash
|
|
run: |
|
|
set +e
|
|
mkdir -p .gcp-readiness
|
|
{
|
|
echo "project=${PROJECT_ID}"
|
|
echo "service_account=${ARTIFACT_SERVICE_ACCOUNT}"
|
|
echo "workflow_ref=${GITHUB_REF}"
|
|
echo "revision=${GITHUB_SHA}"
|
|
} > .gcp-readiness/context.txt
|
|
gcloud auth list --format=json > .gcp-readiness/gcloud-auth-list.json 2> .gcp-readiness/gcloud-auth-list.stderr
|
|
echo "$?" > .gcp-readiness/gcloud-auth-list.exitcode
|
|
gcloud config list --format=json > .gcp-readiness/gcloud-config-list.json 2> .gcp-readiness/gcloud-config-list.stderr
|
|
echo "$?" > .gcp-readiness/gcloud-config-list.exitcode
|
|
|
|
- name: Run readiness checker
|
|
shell: bash
|
|
run: |
|
|
set +e
|
|
python3 ops/check_gcp_infra_readiness.py \
|
|
> .gcp-readiness/gcp-infra-readiness.json \
|
|
2> .gcp-readiness/gcp-infra-readiness.stderr
|
|
echo "$?" > .gcp-readiness/gcp-infra-readiness.exitcode
|
|
python3 - <<'PY'
|
|
import json
|
|
from pathlib import Path
|
|
|
|
base = Path(".gcp-readiness")
|
|
report = {
|
|
"artifact": "github_wif_gcp_readiness_probe",
|
|
"checker_exitcode": (base / "gcp-infra-readiness.exitcode").read_text().strip(),
|
|
"stderr_tail": (base / "gcp-infra-readiness.stderr").read_text()[-2000:],
|
|
}
|
|
try:
|
|
payload = json.loads((base / "gcp-infra-readiness.json").read_text() or "{}")
|
|
except json.JSONDecodeError as exc:
|
|
report["json_parse_error"] = str(exc)
|
|
payload = {}
|
|
if payload:
|
|
report["pass_count"] = payload.get("pass_count")
|
|
report["blocked_count"] = payload.get("blocked_count")
|
|
report["fail_count"] = payload.get("fail_count")
|
|
report["checks"] = [
|
|
{
|
|
"name": check.get("name"),
|
|
"status": check.get("status"),
|
|
"required_tier": check.get("required_tier"),
|
|
"current_tier": check.get("current_tier"),
|
|
"detail": (check.get("detail") or "")[:500],
|
|
}
|
|
for check in payload.get("checks", [])
|
|
]
|
|
(base / "gcp-readiness-summary.json").write_text(json.dumps(report, indent=2, sort_keys=True) + "\n")
|
|
print(json.dumps(report, indent=2, sort_keys=True))
|
|
PY
|
|
|
|
- name: Upload readiness artifacts
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: gcp-readiness
|
|
path: .gcp-readiness/
|
|
if-no-files-found: error
|