Merge pull request #27 from aodn/5320_refactored_ci_cd

5320 refactored ci cd

.github/environment/central.env

@@ -0,0 +1,6 @@
+AWS_REGION=ap-southeast-2
+AWS_ROLE_ARN=arn:aws:iam::851725428481:role/AodnGitHubActionsRole
+CODEARTIFACT_DOMAIN=central-aodn-org-au
+CODEARTIFACT_REPO=maven-aodn-store
+ECR_REGISTRY=851725428481.dkr.ecr.ap-southeast-2.amazonaws.com
+ECR_REPOSITORY=geonetwork4

.github/environment/edge.env

@@ -0,0 +1,2 @@
+AWS_REGION=ap-southeast-2
+AWS_ROLE_ARN=arn:aws:iam::704910415367:role/AodnGitHubActionsRole

.github/environment/production.env

@@ -1,5 +1,2 @@
 AWS_REGION=ap-southeast-2
-CODEARTIFACT_DOMAIN=gamma-aodn-org-au
-CODEARTIFACT_REPO=maven-aodn-store
-ECR_REGISTRY=450356697252.dkr.ecr.ap-southeast-2.amazonaws.com
-ECR_REPOSITORY=geonetwork4
+AWS_ROLE_ARN=arn:aws:iam::211125304466:role/AodnGitHubActionsRole

.github/environment/staging.env

@@ -1,5 +1,2 @@
 AWS_REGION=ap-southeast-2
-CODEARTIFACT_DOMAIN=gamma-aodn-org-au
-CODEARTIFACT_REPO=maven-aodn-store
-ECR_REGISTRY=450356697252.dkr.ecr.ap-southeast-2.amazonaws.com
-ECR_REPOSITORY=geonetwork4
+AWS_ROLE_ARN=arn:aws:iam::905418367757:role/AodnGitHubActionsRole

.github/workflows/build-staging.yml → .github/workflows/build_deploy_edge.yml

@@ -1,4 +1,4 @@
-name: Build Staging
+name: Build/Deploy Edge
 
 on:
   push:
@@ -12,14 +12,12 @@ permissions:
   id-token: write
   contents: read
 
-env:
-  app_name: geonetwork4
-  environment_name: staging
-
 jobs:
   build_push:
     runs-on: ubuntu-latest
-    environment: staging
+    environment: central
+    outputs:
+      digest: ${{ steps.build_and_push.outputs.digest }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -45,7 +43,7 @@ jobs:
         with:
           audience: sts.amazonaws.com
           aws-region: ${{ vars.AWS_REGION }}
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
 
       - name: Build with Maven
         run: mvn -B verify --file pom.xml
@@ -67,43 +65,11 @@ jobs:
             ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }}:${{ github.sha }}
             ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }}:latest
 
-      - name: Push Image Digest to SSM
-        run: |
-          aws ssm put-parameter \
-            --name "/apps/${{ env.app_name }}/${{ env.environment_name }}/image_digest" \
-            --type "String" \
-            --value "$digest" \
-            --overwrite
-        env:
-          digest: ${{ steps.build_and_push.outputs.digest }}
-
-  trigger_deploy:
-    runs-on: ubuntu-latest
+  trigger_edge_deploy:
     needs: [build_push]
-    steps:
-      - name: Generate App Token
-        uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ vars.DEPLOY_APP_ID }}
-          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: "appdeploy"
-
-      - name: Trigger Deploy Workflow
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          retries: 3
-          retry-exempt-status-codes: 204
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: 'aodn',
-              repo: 'appdeploy',
-              workflow_id: 'deploy.yml',
-              ref: 'main',
-              inputs: {
-                app_name: '${{ env.app_name }}',
-                environment: '${{ env.environment_name }}'
-              }
-            })
+    uses: ./.github/workflows/trigger_deploy.yml
+    with:
+      app_name: geonetwork4
+      environment: edge
+      digest: ${{ needs.build_push.outputs.digest }}
+    secrets: inherit

.github/workflows/pre-commit.yml

@@ -2,8 +2,6 @@ name: Run Pre-commit Checks
 
 on:
   pull_request:
-    branches:
-      - master
 
 permissions:
   id-token: write

.github/workflows/build-production.yml → .github/workflows/release.yml

@@ -1,4 +1,4 @@
-name: Build Production
+name: Release
 
 on:
   push:
@@ -9,16 +9,12 @@ permissions:
   id-token: write
   contents: read
 
-env:
-  app_name: geonetwork4
-  environment_name: production
-
 jobs:
   build_push:
     runs-on: ubuntu-latest
-    environment: production
+    environment: central
     outputs:
-      image_digest: ${{ steps.build_and_push.outputs.digest }}
+      digest: ${{ steps.build_and_push.outputs.digest }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -44,7 +40,7 @@ jobs:
         with:
           audience: sts.amazonaws.com
           aws-region: ${{ vars.AWS_REGION }}
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
 
       - name: Get CodeArtifact Repository Authentication Token
         run: |
@@ -87,43 +83,36 @@ jobs:
           push: true
           tags: ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }}:${{ github.ref_name }}
 
-      - name: Push Image Digest to SSM
-        run: |
-          aws ssm put-parameter \
-            --name "/apps/${{ env.app_name }}/${{ env.environment_name }}/image_digest" \
-            --type "String" \
-            --value "$digest" \
-            --overwrite
-        env:
-          digest: ${{ steps.build_and_push.outputs.digest }}
-
-  trigger_deploy:
-    runs-on: ubuntu-latest
-    needs: [build_push]
-    steps:
       - name: Generate App Token
         uses: actions/create-github-app-token@v1
         id: app-token
         with:
           app-id: ${{ vars.DEPLOY_APP_ID }}
           private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-          repositories: "appdeploy"
 
-      - name: Trigger Deploy Workflow
-        uses: actions/github-script@v7
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          retries: 3
-          retry-exempt-status-codes: 204
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: 'aodn',
-              repo: 'appdeploy',
-              workflow_id: 'deploy.yml',
-              ref: 'main',
-              inputs: {
-                app_name: '${{ env.app_name }}',
-                environment: '${{ env.environment_name }}'
-              }
-            })
+      - name: Upload Docker Metadata to Release
+        run: |
+          json='${{ steps.build_and_push.outputs.metadata }}'
+          echo "$json" > metadata.json
+          gh release upload ${{ github.ref_name }} metadata.json
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+  trigger_staging_deploy:
+    needs: [build_push]
+    uses: ./.github/workflows/trigger_deploy.yml
+    with:
+      app_name: geonetwork4
+      environment: staging
+      digest: ${{ needs.build_push.outputs.digest }}
+    secrets: inherit
+
+  trigger_production_deploy:
+    needs: [build_push, trigger_staging_deploy]
+    uses: ./.github/workflows/trigger_deploy.yml
+    with:
+      app_name: geonetwork4
+      environment: production
+      digest: ${{ needs.build_push.outputs.digest }}
+    secrets: inherit

.github/workflows/test.yml

@@ -2,9 +2,6 @@ name: Test
 
 on:
   pull_request:
-    branches:
-      - master
-      - main
     paths-ignore:
       - '**/*.md'
       - '.github/environment/**'

.github/workflows/trigger_deploy.yml

@@ -0,0 +1,86 @@
+name: Trigger Deploy
+
+on:
+  workflow_dispatch:
+    inputs:
+      app_name:
+        required: true
+        description: The short-name of the app corresponding to the folder in appdeploy.
+        type: string
+      environment:
+        required: true
+        description: The environment to use for the deploy job.
+        type: choice
+        options:
+          - edge
+          - staging
+          - production
+      digest:
+        required: false
+        description: The image digest to pass to the deploy job.
+        type: string
+  workflow_call:
+    inputs:
+      app_name:
+        required: true
+        type: string
+      digest:
+        required: false
+        type: string
+      environment:
+        required: true
+        type: string
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  trigger_deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          audience: sts.amazonaws.com
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+
+      - name: Push Image Digest to SSM
+        if: ${{ inputs.digest != '' }}
+        run: |
+          aws ssm put-parameter \
+            --name "/apps/${{ inputs.app_name }}/${{ inputs.environment }}/image_digest" \
+            --type "String" \
+            --value "$digest" \
+            --overwrite
+        env:
+          digest: ${{ inputs.digest }}
+
+      - name: Generate App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.DEPLOY_APP_ID }}
+          private-key: ${{ secrets.DEPLOY_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "appdeploy"
+
+      - name: Trigger Deploy Workflow
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          retries: 3
+          retry-exempt-status-codes: 204
+          script: |
+            github.rest.actions.createWorkflowDispatch({
+              owner: 'aodn',
+              repo: 'appdeploy',
+              workflow_id: 'deploy.yml',
+              ref: 'main',
+              inputs: {
+                app_name: '${{ inputs.app_name }}',
+                environment: '${{ inputs.environment }}'
+              }
+            })

Dockerfile

@@ -25,4 +25,3 @@ COPY ./geonetwork/target/classes/schema_plugins/converter/*.xsl ${GN_DIR}/WEB-IN
 
 # Config override
 COPY ./geonetwork/target/classes/gnconfig/config-overrides.xml ${GN_DIR}/WEB-INF/
-

README.md

@@ -25,9 +25,9 @@ GEONETWORK_DB_PORT=5432
 GEONETWORK_DB_NAME=geonetwork
 ```
 
-Then assume you have installed docker and docker-compose, then you can run ./startEsLocal.sh to run a elastic search 7 for 
-use by the geonetwork. It takes a while to start (3 mins+), so you can check http://localhost:5601 if system 
-started. Once started you can run 
+Then assume you have installed docker and docker-compose, then you can run ./startEsLocal.sh to run a elastic search 7 for
+use by the geonetwork. It takes a while to start (3 mins+), so you can check http://localhost:5601 if system
+started. Once started you can run
 
 ```shell
 # Start geonetwork4

docker-es-compose.yml

@@ -17,7 +17,7 @@ services:
     env_file:
       - .env
     command: >
-      bash -c '        
+      bash -c '
         if [ ! -f config/certs/ca.zip ]; then
           echo "Creating CA";
           bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
@@ -188,4 +188,4 @@ networks:
     ipam:
       config:
         - subnet: 10.5.0.0/16
-          gateway: 10.5.0.1
+          gateway: 10.5.0.1

docker-gn-compose.yml

@@ -34,20 +34,20 @@ services:
       - .env
     environment:
       JAVA_OPTS: >-
-        -Xms256m -Xmx2g 
-        -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8000  
-        -Dgeonetwork.data.dir=/opt/geonetwork/data 
-        -Dgeonetwork.config.dir=/opt/geonetwork/config 
+        -Xms256m -Xmx2g
+        -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8000
+        -Dgeonetwork.data.dir=/opt/geonetwork/data
+        -Dgeonetwork.config.dir=/opt/geonetwork/config
         -Dgeonetwork.resources.dir=/opt/geonetwork/resources
-        -Dgeonetwork.jeeves.configuration.overrides.file=/opt/geonetwork/WEB-INF/config-overrides.xml 
+        -Dgeonetwork.jeeves.configuration.overrides.file=/opt/geonetwork/WEB-INF/config-overrides.xml
         -Dorg.aspectj.tracing.enabled=true
 
-      GN_CONFIG_PROPERTIES: >- 
-        -Des.protocol=${ES_PROTOCOL:-https} 
-        -Des.port=${ES_PORT:-9200} 
-        -Des.host=${ES_HOST:-localhost} 
-        -Des.url=${ES_PROTOCOL:-https}://${ES_HOST:-localhost}:${ES_PORT:-9200} 
-        -Des.username=${ES_USERNAME:-elastic} 
+      GN_CONFIG_PROPERTIES: >-
+        -Des.protocol=${ES_PROTOCOL:-https}
+        -Des.port=${ES_PORT:-9200}
+        -Des.host=${ES_HOST:-localhost}
+        -Des.url=${ES_PROTOCOL:-https}://${ES_HOST:-localhost}:${ES_PORT:-9200}
+        -Des.username=${ES_USERNAME:-elastic}
         -Des.password=${ES_PASSWORD:-open-sesame}
 
       KB_URL: ${KB_URL:-http://localhost:5601}
@@ -66,4 +66,4 @@ services:
       GEONETWORK_ROOTURL: ${GEONETWORK_HOST:-localhost}
       GEONETWORK_PROTOCOL: ${GEONETWORK_PROTOCOL:-http}
 #      GEONETWORK_DB_CONNECTION_PROPERTIES: readOnly=true
-    network_mode: "host"
+    network_mode: "host"

geonetwork-api/src/main/java/au/org/aodn/geonetwork_api/openapi/api/helper/TagsHelper.java

@@ -68,7 +68,7 @@ public List<Status> createTags(List<String> json) {
 
                     Status status = new Status();
                     status.setFileContent(m);
-                    
+
                     ResponseEntity<Integer> response = null;
                     try {
                         response = this.api.putTagWithHttpInfo(metadataCategory);