アプリケーションテンプレートでのCI/CDのセットアップ¶

version: '3'
dotenv:
  - .env
includes:
  react:
    taskfile: ./frontend_react/react_src/Taskfile.yaml
    dir: ./frontend_react/react_src/
tasks:
...
  python-lint:
    desc: 🧹 Lint Python code
    cmds:
        - ruff format .
        - ruff check . --fix
        - mypy --pretty .
  python-lint-check:
    desc: 🧹 Lint Python code with fixes
    cmds:
        - ruff format --check .
        - ruff check .
        - mypy --pretty .
  lint:
    deps:
      - react:lint
      - python-lint
    desc: 🧹 Lint all code
  lint-check:
    deps:
      - react:lint-check
      - python-lint-check
    desc: 🧹 Lint all code 

image: cimg/python:3.11-node

before_script:
  - pip install go-task-bin
  - task install
  - source .venv/bin/activate

lint:
  stage: check
  script:
    - task lint-check
  only:
    - merge_requests 

test:
  stage: check
  script:
    - task test
  only:
    - merge_requests 

variables:
  DATAROBOT_ENDPOINT: https://app.datarobot.com/api/v2
  FRONTEND_TYPE: react
  # The following variables are set on the GitLab CI/CD settings page:
  # DATAROBOT_API_TOKEN: "$DATAROBOT_API_TOKEN"
  # PULUMI_CONFIG_PASSPHRASE: "$PULUMI_CONFIG_PASSPHRASE"
  # OPENAI_API_VERSION: "$OPENAI_API_VERSION"
  # OPENAI_API_BASE: "$OPENAI_API_BASE"
  # OPENAI_API_DEPLOYMENT_ID: "$OPENAI_API_DEPLOYMENT_ID"
  # OPENAI_API_KEY: "$OPENAI_API_KEY"
  # # Used for the Pulumi DIY backend bucket: https://www.pulumi.com/docs/iac/concepts/state-and-backends/#azure-blob-storage
  # AZURE_STORAGE_ACCOUNT: "$AZURE_STORAGE_ACCOUNT"
  # AZURE_STORAGE_KEY: "$AZURE_STORAGE_KEY"
  # GITLAB_API_TOKEN: "$GITLAB_API_TOKEN" 

review_app:
  stage: review
  script:
  # Installs a "MR review app" for the branch being merged into main
    - curl -fsSL https://get.pulumi.com | sh
    - export PATH="~/.pulumi/bin:$PATH"
    - pulumi login --cloud-url "azblob://dr-ai-apps-pulumi"
    - pulumi stack select --create gitlab-mr-$CI_MERGE_REQUEST_IID
    - pulumi up --yes --stack gitlab-mr-$CI_MERGE_REQUEST_IID
    - echo "Deploying review app for branch gitlab-mr-$CI_MERGE_REQUEST_IID"
    - STACK_OUTPUT="<br><br>$(pulumi stack output --shell)"
    - STACK_OUTPUT="${STACK_OUTPUT//$'\n'/<br>}"
    - |
      curl --header "PRIVATE-TOKEN: $GITLAB_API_TOKEN" \
         --data "body=Review Deployment: $STACK_OUTPUT" \
         "$CI_API_V4_URL/projects/$CI_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes"
  only:
    - merge_requests
  when: manual 

destroy_review_app:
  stage: cleanup
  script:
    - curl -fsSL https://get.pulumi.com | sh
    - export PATH="~/.pulumi/bin:$PATH"
    - pulumi login --cloud-url "azblob://dr-ai-apps-pulumi"
    - pulumi destroy --yes --stack gitlab-mr-$CI_MERGE_REQUEST_IID
    - pulumi stack rm gitlab-mr-$CI_MERGE_REQUEST_IID --yes
    - echo "Destroyed review app stack for MR gitlab-mr-$CI_MERGE_REQUEST_IID"
  only:
    - merge_requests
    - main
  when: manual
  needs:
    - job: review_app
      optional: true 

deploy_ci:
  stage: deploy
  script:
    - curl -fsSL https://get.pulumi.com | sh
    - export PATH="~/.pulumi/bin:$PATH"
    - pulumi login --cloud-url "azblob://dr-ai-apps-pulumi"
    - pulumi stack select ci
    - pulumi up --yes --stack ci
    - echo "Deployed CI stack"
  only:
    - main
  when: on_success 

name: Pulumi Deployment
on:
  pull_request:
    types: [opened, synchronize, reopened]
env:
  PULUMI_STACK_NAME: github-pr-${{ github.event.repository.name }}-${{ github.event.number }}
jobs:
  update:
    name: pulumi-update-stack
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Decrypt Secrets
        run: gpg --quiet --batch --yes --decrypt --passphrase="$LARGE_SECRET_PASSPHRASE" --output .env .env.gpg
        env:
          # https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions
          LARGE_SECRET_PASSPHRASE: ${{  secrets.LARGE_SECRET_PASSPHRASE }}
      - uses: actions/setup-python@v5
        with:
          python-version: 3.12
      - name: Install Pulumi
        run: |
          curl -fsSL https://get.pulumi.com | sh
          echo "$HOME/.pulumi/bin" >> $GITHUB_PATH
      - name: Setup Project Dependencies
        run: |
          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
          uv venv .venv
          source .venv/bin/activate
          uv pip install -r requirements.txt
      - name: Plan Pulumi Update
        id: plan_pulumi_update
        run: |
          source .venv/bin/activate
          export $(grep -v '^#' .env | xargs)
          pulumi stack select --create $PULUMI_STACK_NAME
          pulumi up --yes
          # Store JSON output once and parse it for all values
          PULUMI_OUTPUT=$(pulumi stack output --json)
          APPLICATION_URL=$(echo "$PULUMI_OUTPUT" | jq -r 'to_entries[] | select(.key | startswith("Data Analyst Application")) | .value')
          DEPLOYMENT_URL=$(echo "$PULUMI_OUTPUT" | jq -r 'to_entries[] | select(.key | startswith("Generative Analyst Deployment")) | .value')
          APP_ID=$(echo "$PULUMI_OUTPUT" | jq -r '.DATAROBOT_APPLICATION_ID // empty')
          LLM_ID=$(echo "$PULUMI_OUTPUT" | jq -r '.LLM_DEPLOYMENT_ID // empty')
          echo "application_url=${APPLICATION_URL}" >> $GITHUB_OUTPUT
          echo "deployment_url=${DEPLOYMENT_URL}" >> $GITHUB_OUTPUT
          echo "app_id=${APP_ID}" >> $GITHUB_OUTPUT
          echo "llm_id=${LLM_ID}" >> $GITHUB_OUTPUT
        env:
          PULUMI_ACCESS_TOKEN: ${{  secrets.PULUMI_ACCESS_TOKEN }}
      - name: Comment PR with App URL
        uses: peter-evans/create-or-update-comment@v4
        with:
          token: ${{  secrets.GITHUB_TOKEN }}
          issue-number: ${{  github.event.number }}
          body: |
            # 🚀 Your application is ready!
            ## Application Info
            - **Application URL:** [${{  steps.plan_pulumi_update.outputs.application_url }}](${{  steps.plan_pulumi_update.outputs.application_url }})
            - **Application ID:** `${{  steps.plan_pulumi_update.outputs.app_id }}`
            ## LLM Deployment
            - **Deployment URL:** [${{  steps.plan_pulumi_update.outputs.deployment_url }}](${{  steps.plan_pulumi_update.outputs.deployment_url }})
            - **Deployment ID:** `${{  steps.plan_pulumi_update.outputs.llm_id }}`
            ### Pulumi Stack
            - **Stack Name:** `${{  env.PULUMI_STACK_NAME }}` 

git add .env.gpg
git commit -m "Add new GPG encrypted secret file"
git push 

name: Pulumi Stack Destroy
on:
  workflow_dispatch:
    inputs:
      stack_name:
        description: 'Stack name to destroy (e.g. github-pr-foobar-42)'
        required: true
        type: string

env:
  PULUMI_STACK_NAME: github-pr-${{  github.event.repository.name }}-${{  github.event.number }}
  PULUMI_ACCESS_TOKEN: ${{  secrets.PULUMI_ACCESS_TOKEN }}

jobs:
  destroy:
    name: pulumi-destroy-stack
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: 3.12
      - name: Install Pulumi
        run: |
          curl -fsSL https://get.pulumi.com | sh
          echo "$HOME/.pulumi/bin" >> $GITHUB_PATH
      - name: Setup Project Dependencies
        run: |
          command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
          uv venv .venv
          source .venv/bin/activate
          uv pip install -r requirements.txt
      - name: Destroy Pulumi Stack
        run: |
          source .venv/bin/activate
          pulumi stack select ${{  github.event.inputs.stack_name }}
          pulumi destroy --yes
          pulumi stack rm --yes ${{  github.event.inputs.stack_name }} 

 pulumi stack ls -a 

 NAME                                 LAST UPDATE   RESOURCE COUNT
organization/agent_sre/sredev1       2 months ago  0
organization/talk-to-my-docs/x-dev0  2 days ago    12
dev0                           2 weeks ago   13
ci    6 days ago   13 

pulumi stack select ci