From 2d81b8a46dbb5de917bdd15768925bf9fc7f90ba Mon Sep 17 00:00:00 2001 From: Alexanderamiri Date: Sat, 24 Oct 2026 15:20:12 +0200 Subject: [PATCH] ci: deploy with the javaBin platform pipeline deploy.yml calls javaBin/platform's javabin.yml: mvn verify against a postgres:17 service (the same database setup as docker/postgres), then on master terraform apply, docker build and ECS rollout. The new Dockerfile builds the jar and runs it with plain java -jar: ECS injects configuration as env vars, so the image has no SOPS, no AWS CLI and no encrypted env file. The SOPS image moves to Dockerfile.cdk and the CDK stack points at it, so the old stack can still be redeployed until the cutover is done. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/deploy.yml | 36 +++++++++++++++++++++++ Dockerfile | 56 +++++++++++++++--------------------- Dockerfile.cdk | 44 ++++++++++++++++++++++++++++ cdk/lib/moresleep-stack.ts | 2 +- run-local.sh | 4 +-- 5 files changed, 106 insertions(+), 36 deletions(-) create mode 100644 .github/workflows/deploy.yml create mode 100644 Dockerfile.cdk diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 0000000..b8a1dcb --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,36 @@ +# Build, test and deploy moresleep with the javaBin platform pipeline. +# +# Pull requests: build + test, regenerate terraform/ from app.yaml, plan, and +# post the plan with an AI risk review as a PR comment. Nothing is applied. +# Pushes to master (and manual runs): the same, then apply the reviewed plan, +# build the Docker image, push it to ECR and roll out the ECS service. +# +# How it works: docs/platform.md. Pipeline reference: +# https://github.com/javaBin/platform/blob/main/docs/reusable-workflows.md +name: Deploy + +on: + push: + branches: [master] + pull_request: + workflow_dispatch: + +permissions: + id-token: write # AWS access via GitHub OIDC (no AWS secrets in the repo) + contents: write # the expand step commits regenerated terraform/ to the branch + pull-requests: write # plan + review comment on PRs + +concurrency: + group: deploy-${{ github.ref }} + cancel-in-progress: false + +jobs: + javabin: + uses: javaBin/platform/.github/workflows/javabin.yml@main + with: + java_version: "21" + # The tests need a real PostgreSQL, the same as docker/postgres sets up. + test_postgres_image: postgres:17 + test_postgres_db: moresleepunit + test_postgres_user: localdevuser + test_postgres_password: localdevuser # throwaway CI database, not a secret diff --git a/Dockerfile b/Dockerfile index 2aef973..4a4833e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,41 +1,31 @@ -# Build: docker build -t moresleep-app:latest . -# Run: docker run --name moresleep-container -p 5000:5000 moresleep-app:latest -# Check localhost:5000 and you should get a homepage -# Stage 1: Build the application +# Platform image: built and pushed to ECR by the javaBin platform pipeline +# (.github/workflows/deploy.yml), run on ECS Fargate. +# +# Configuration comes from environment variables that ECS injects (app.yaml +# `environment:` and `resources.secrets`), so the image holds no secrets and +# needs no SOPS or AWS CLI. The container runs as uid 1000 with a read-only +# root filesystem and a writable /tmp. +# +# Local run: +# docker build -t moresleep . +# docker run --rm -p 8082:8082 -e DBHOST=host.docker.internal moresleep + +# Stage 1: build the jar (tests run in the pipeline's build-jvm job before this) FROM maven:3.9.11-eclipse-temurin-21 AS build WORKDIR /app COPY pom.xml . +RUN mvn --batch-mode --quiet dependency:go-offline COPY src ./src -RUN mvn clean package -Dmaven.test.skip=true +RUN mvn --batch-mode package -Dmaven.test.skip=true -# Stage 2: Create the final runtime image -FROM eclipse-temurin:21-jre-jammy AS final - -# Install SOPS -RUN curl -L -o /usr/local/bin/sops https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.linux.amd64 && \ - chmod +x /usr/local/bin/sops - - # Install unzip and curl -RUN apt-get update && \ - apt-get install -y curl unzip && \ - rm -rf /var/lib/apt/lists/* - - # Install AWS CLI v2 -RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip" && \ - unzip /tmp/awscliv2.zip -d /tmp && \ - /tmp/aws/install && \ - rm -rf /tmp/aws /tmp/awscliv2.zip - -# Set environment variables -ENV DO_FLYWAY_MIGRATION=false +# Stage 2: runtime +FROM eclipse-temurin:21-jre-jammy +# Production settings (port 5000, DO_FLYWAY_MIGRATION=false, ...) come from +# app.yaml. The image keeps the code defaults, so it also works as the local +# dev image (port 8082, migrations on), like the previous :edge image. ENV RUN_FROM_JAR=true - WORKDIR /app COPY --from=build /app/target/moresleep-0.0.1-jar-with-dependencies.jar app.jar -COPY ./conf/.enc.env /app/.enc.env - -# Remove AWS profile from SOPS config to use container's AWS credentials -RUN sed -i 's/sops_kms__list_0__map_aws_profile=javabin/sops_kms__list_0__map_aws_profile=/' /app/.enc.env - -EXPOSE 5000 -ENTRYPOINT ["sops", "exec-env", ".enc.env", "java -jar app.jar"] \ No newline at end of file +USER 1000 +EXPOSE 5000 8082 +ENTRYPOINT ["java", "-XX:MaxRAMPercentage=75", "-jar", "app.jar"] diff --git a/Dockerfile.cdk b/Dockerfile.cdk new file mode 100644 index 0000000..557717d --- /dev/null +++ b/Dockerfile.cdk @@ -0,0 +1,44 @@ +# Image for the OLD CDK stack (moresleepstack / cluster moresleep-test). +# Kept only as the rollback path until the platform cutover is done; the +# platform pipeline builds ./Dockerfile instead. Removed in the cleanup PR. +# Build: docker build -f Dockerfile.cdk -t moresleep-app:latest . +# Run: docker run --name moresleep-container -p 5000:5000 moresleep-app:latest +# Check localhost:5000 and you should get a homepage +# Stage 1: Build the application +FROM maven:3.9.11-eclipse-temurin-21 AS build +WORKDIR /app +COPY pom.xml . +COPY src ./src +RUN mvn clean package -Dmaven.test.skip=true + +# Stage 2: Create the final runtime image +FROM eclipse-temurin:21-jre-jammy AS final + +# Install SOPS +RUN curl -L -o /usr/local/bin/sops https://github.com/getsops/sops/releases/download/v3.10.2/sops-v3.10.2.linux.amd64 && \ + chmod +x /usr/local/bin/sops + + # Install unzip and curl +RUN apt-get update && \ + apt-get install -y curl unzip && \ + rm -rf /var/lib/apt/lists/* + + # Install AWS CLI v2 +RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip" && \ + unzip /tmp/awscliv2.zip -d /tmp && \ + /tmp/aws/install && \ + rm -rf /tmp/aws /tmp/awscliv2.zip + +# Set environment variables +ENV DO_FLYWAY_MIGRATION=false +ENV RUN_FROM_JAR=true + +WORKDIR /app +COPY --from=build /app/target/moresleep-0.0.1-jar-with-dependencies.jar app.jar +COPY ./conf/.enc.env /app/.enc.env + +# Remove AWS profile from SOPS config to use container's AWS credentials +RUN sed -i 's/sops_kms__list_0__map_aws_profile=javabin/sops_kms__list_0__map_aws_profile=/' /app/.enc.env + +EXPOSE 5000 +ENTRYPOINT ["sops", "exec-env", ".enc.env", "java -jar app.jar"] \ No newline at end of file diff --git a/cdk/lib/moresleep-stack.ts b/cdk/lib/moresleep-stack.ts index d6e0df1..3a8320c 100644 --- a/cdk/lib/moresleep-stack.ts +++ b/cdk/lib/moresleep-stack.ts @@ -43,7 +43,7 @@ export class MoresleepStack extends cdk.Stack { console.log('Current working directory:', process.cwd()); taskDefinition.addContainer('web', { - image: ecs.ContainerImage.fromAsset('../', { file: 'Dockerfile' }), + image: ecs.ContainerImage.fromAsset('../', { file: 'Dockerfile.cdk' }), // SOPS image; ./Dockerfile is the platform image portMappings: [{ containerPort: port }], logging: new ecs.AwsLogDriver({ streamPrefix: 'web' }), diff --git a/run-local.sh b/run-local.sh index fd6a99c..2a37912 100755 --- a/run-local.sh +++ b/run-local.sh @@ -6,8 +6,8 @@ PATH_PREFIX="$1" echo "Setting PATH_PREFIX to: '$PATH_PREFIX'" -# Build the Docker image -docker build -t moresleep-app:latest . +# Build the SOPS image used by the old CDK stack (decrypts conf/.enc.env with your AWS profile) +docker build -f Dockerfile.cdk -t moresleep-app:latest . # Run the container with AWS credentials mounted docker run --rm -it \