Skip to content

Commit 0b236ef

Browse files
nuzilnuzil
committed
Init Commit
1 parent 5901b6c commit 0b236ef

3 files changed

Lines changed: 256 additions & 2 deletions

File tree

‎.github/workflows/deployMesh.yaml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: Deploy Mesh
2+
3+
# Controls when the workflow will run
4+
on:
5+
# Triggers the workflow on push events for staging and production branches
6+
push:
7+
branches: ["production", "staging"]
8+
# Allows you to run this workflow manually from the Actions tab
9+
workflow_dispatch:
10+
11+
# A workflow run is made up of one or more jobs that can run sequentially or in parallel
12+
jobs:
13+
deploy:
14+
name: Deploy API Mesh
15+
runs-on: ${{ matrix.os }}
16+
strategy:
17+
max-parallel: 1
18+
matrix:
19+
node-version: ["20"]
20+
os: [ubuntu-latest]
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@v4
24+
- name: Use Node.js ${{ matrix.node-version }}
25+
uses: actions/setup-node@v4
26+
with:
27+
node-version: ${{ matrix.node-version }}
28+
- name: Map branch-specific secrets
29+
run: |
30+
BRANCH_NAME="${GITHUB_REF_NAME:-${GITHUB_REF##*/}}"
31+
if [ "$BRANCH_NAME" = "staging" ]; then
32+
echo "TARGET_ENV=staging" >> "$GITHUB_ENV"
33+
echo "CLIENTID=${{ secrets.CLIENTID_STAGE }}" >> "$GITHUB_ENV"
34+
echo "CLIENTSECRET=${{ secrets.CLIENTSECRET_STAGE }}" >> "$GITHUB_ENV"
35+
echo "TECHNICALACCID=${{ secrets.TECHNICALACCID_STAGE }}" >> "$GITHUB_ENV"
36+
echo "TECHNICALACCEMAIL=${{ secrets.TECHNICALACCEMAIL_STAGE }}" >> "$GITHUB_ENV"
37+
echo "WORKSPACEID=${{ secrets.WORKSPACEID_STAGE }}" >> "$GITHUB_ENV"
38+
elif [ "$BRANCH_NAME" = "production" ]; then
39+
echo "TARGET_ENV=production" >> "$GITHUB_ENV"
40+
echo "CLIENTID=${{ secrets.CLIENTID_PROD }}" >> "$GITHUB_ENV"
41+
echo "CLIENTSECRET=${{ secrets.CLIENTSECRET_PROD }}" >> "$GITHUB_ENV"
42+
echo "TECHNICALACCID=${{ secrets.TECHNICALACCID_PROD }}" >> "$GITHUB_ENV"
43+
echo "TECHNICALACCEMAIL=${{ secrets.TECHNICALACCEMAIL_PROD }}" >> "$GITHUB_ENV"
44+
echo "WORKSPACEID=${{ secrets.WORKSPACEID_PROD }}" >> "$GITHUB_ENV"
45+
else
46+
echo "Unsupported branch '$BRANCH_NAME'. Only staging and production are allowed." >&2
47+
exit 1
48+
fi
49+
- name: Validate Secrets
50+
run: |
51+
if
52+
[ -z "${CLIENTID}" ] ||
53+
[ -z "${CLIENTSECRET}" ] ||
54+
[ -z "${TECHNICALACCID}" ] ||
55+
[ -z "${TECHNICALACCEMAIL}" ] ||
56+
[ -z "${{ secrets.IMSORGID }}" ] ||
57+
[ -z "${{ secrets.ORGID }}" ] ||
58+
[ -z "${{ secrets.PROJECTID }}" ] ||
59+
[ -z "${WORKSPACEID}" ]; then
60+
echo "Please set all required secrets: CLIENTID, CLIENTSECRET, TECHNICALACCID, TECHNICALACCEMAIL, IMSORGID, ORGID, PROJECTID, WORKSPACEID"
61+
exit 1
62+
fi
63+
- name: Setup CLI
64+
uses: adobe/aio-cli-setup-action@1.3.0
65+
with:
66+
os: ${{ matrix.os }}
67+
version: 11.x.x
68+
- name: api-mesh-plugin install
69+
run: aio plugins:install @adobe/aio-cli-plugin-api-mesh
70+
- name: Auth
71+
uses: adobe/aio-apps-action@4.0.0
72+
with:
73+
os: ${{ matrix.os }}
74+
command: oauth_sts
75+
CLIENTID: ${{ env.CLIENTID }}
76+
CLIENTSECRET: ${{ env.CLIENTSECRET }}
77+
TECHNICALACCOUNTID: ${{ env.TECHNICALACCID }}
78+
TECHNICALACCOUNTEMAIL: ${{ env.TECHNICALACCEMAIL }}
79+
IMSORGID: ${{ secrets.IMSORGID }}
80+
SCOPES: AdobeID, openid, read_organizations, additional_info.projectedProductContext, additional_info.roles, adobeio_api, read_client_secret, manage_client_secrets
81+
- name: Set CLI ENV
82+
run: aio config set cli.env prod
83+
- name: Select org
84+
run: aio console:org:select ${{ secrets.ORGID }}
85+
- name: Select project
86+
run: aio console:project:select ${{ secrets.PROJECTID }}
87+
- name: Select workspace
88+
run: aio console:workspace:select ${{ env.WORKSPACEID }}
89+
- name: Print AIO CLI Config
90+
run: aio config list
91+
- name: Get Mesh
92+
id: get_mesh
93+
continue-on-error: true
94+
run: |
95+
output=$(aio api-mesh:get 2>&1)
96+
# Escape the output and replace newlines with %0A
97+
escaped_output=$(echo "$output" | tr -d '\r' | tr '\n' ' ')
98+
echo "mesh_output=$escaped_output" >> $GITHUB_OUTPUT
99+
echo "$output"
100+
- name: Debug Get Mesh Output
101+
continue-on-error: true
102+
run: echo "Get Mesh Output - ${{ steps.get_mesh.outputs.mesh_output }}"
103+
- name: Create Mesh
104+
if: ${{ contains(steps.get_mesh.outputs.mesh_output, 'No mesh found') }}
105+
run: aio api-mesh:create -c mesh.json --env .env
106+
- name: Update Mesh
107+
if: ${{ !contains(steps.get_mesh.outputs.mesh_output, 'No mesh found') }}
108+
run: aio api-mesh:update -c mesh.json --env .env
109+
- name: Wait for 30 seconds
110+
run: sleep 30
111+
- name: Describe Mesh
112+
run: aio api-mesh:describe
113+
- name: Get Mesh Status
114+
run: aio api-mesh:status

‎.gitignore‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Dependencies
2+
node_modules
3+
4+
# Temporary files
5+
.wrangler
6+
.mesh
7+
tenantFiles
8+
tempfiles
9+
mesh-artifact
10+
meshes
11+
12+
# Template files from @adobe/aio-cli-plugin-api-mesh
13+
wrangler.toml

‎README.md‎

Lines changed: 129 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,129 @@
1-
# com-acc-api-mesh-ci-cd
2-
Its an Public repository for Adobe Api Mesh CI/CD flows
1+
# Adobe API Mesh CI/CD Template
2+
3+
This repository is a lightweight starting point for teams that want a repeatable GitHub Actions pipeline for provisioning and updating Adobe API Mesh configurations. Fork it, drop in your mesh definition files, wire up the required Adobe Developer Console credentials, and you will have a push-button deployment path for staging and production meshes.
4+
5+
---
6+
7+
## What You Get
8+
9+
- **Workflow automation** – `.github/workflows/deployMesh.yaml` handles checkout, authentication via the Adobe I/O CLI, mesh creation (or update), and post-deploy validation.
10+
- **Environment awareness** – pushes to `staging` or `production` automatically pull the corresponding credential set and workspace identifiers.
11+
- **Manual control** – trigger the workflow with `workflow_dispatch` whenever you need an ad-hoc deployment.
12+
- **Extensibility** – add new environments, steps, linters, or notifications by extending the single workflow file.
13+
14+
Repository layout (expected):
15+
16+
```
17+
.
18+
├── .github/workflows/deployMesh.yaml # Main CI/CD pipeline
19+
├── mesh.json # API Mesh definition (commit your own)
20+
├── .env # Optional runtime variables used by mesh.json
21+
└── README.md # This documentation
22+
```
23+
24+
> Tip: keep secrets out of `mesh.json` and `.env`. Use GitHub Encrypted Secrets wherever possible.
25+
26+
---
27+
28+
## Prerequisites
29+
30+
1. **Adobe Developer Console access** with permissions to the target organization, project, and workspaces that host your meshes.
31+
2. **Mesh definition files** (`mesh.json` plus any schema/resolver files) committed to the repository.
32+
3. **GitHub repository admin rights** to configure Actions secrets and branch protection rules.
33+
4. **Node.js 20.x** compatibility for any local development or custom steps (the workflow pins Node 20 via the matrix but can be adjusted).
34+
5. **Adobe I/O CLI knowledge** (`aio`) in case you want to run the same commands locally for troubleshooting.
35+
36+
---
37+
38+
## Required GitHub Secrets
39+
40+
Configure the following secrets under **Settings → Secrets and variables → Actions** in your fork. Stage/prod secrets allow the workflow to decide which credentials to use based on the branch being deployed.
41+
42+
| Secret Name | When Used | Description |
43+
| --- | --- | --- |
44+
| `CLIENTID_STAGE`, `CLIENTSECRET_STAGE`, `TECHNICALACCID_STAGE`, `TECHNICALACCEMAIL_STAGE`, `WORKSPACEID_STAGE` | Pushes to `staging` | OAuth client + technical account bound to your staging workspace. |
45+
| `CLIENTID_PROD`, `CLIENTSECRET_PROD`, `TECHNICALACCID_PROD`, `TECHNICALACCEMAIL_PROD`, `WORKSPACEID_PROD` | Pushes to `production` | Production equivalents of the above credentials. |
46+
| `IMSORGID` | Both | Adobe organization ID hosting the project. |
47+
| `ORGID` | Both | Console organization identifier consumed by `aio console:org:select`. |
48+
| `PROJECTID` | Both | Console project identifier used by `aio console:project:select`. |
49+
50+
Add any extra secrets referenced by your mesh (for custom resolvers, HTTP headers, etc.) and load them via environment variables or additional steps in the workflow.
51+
52+
---
53+
54+
## Quick Start
55+
56+
1. **Fork this repo** or use it as a template inside your organization.
57+
2. **Add your mesh files**:
58+
- Place the primary mesh definition in `mesh.json`.
59+
- Commit any supporting schemas/resolvers alongside it.
60+
- (Optional) store non-secret runtime values in `.env` (e.g., `MESH_NAME=my-mesh`). The workflow passes `--env .env` to the CLI so those values are merged during create/update.
61+
3. **Populate GitHub Secrets** with the values listed above.
62+
4. **Adopt the branch convention**:
63+
- Push or merge to `staging` for deploying to staging Adobe workspaces.
64+
- Push or merge to `production` for production deployments.
65+
5. **Run the pipeline**:
66+
- Commit changes and push to the target branch.
67+
- Or open the **Actions** tab, select **Deploy Mesh**, and click **Run workflow** (specify the target branch).
68+
69+
Once the workflow succeeds, your Adobe API Mesh instance will be created (if missing) or updated using the latest `mesh.json` contents, then described and queried for status to confirm a healthy deployment.
70+
71+
---
72+
73+
## Workflow Walkthrough (`deployMesh.yaml`)
74+
75+
1. **Checkout & Node setup** – pulls repository code and provisions Node 20 on `ubuntu-latest`.
76+
2. **Branch-aware env mapping** – resolves GitHub secrets to runtime variables (`TARGET_ENV`, `CLIENTID`, etc.). Only `staging` and `production` are allowed to prevent accidental deployments from other branches.
77+
3. **Secret validation** – fails fast if any required value is missing.
78+
4. **Adobe I/O CLI bootstrap** – installs `aio` plus the API Mesh plugin (`@adobe/aio-cli-plugin-api-mesh`).
79+
5. **Authentication & targeting** – performs `oauth_sts`, selects the right org/project/workspace, and prints the CLI config for traceability.
80+
6. **Mesh lifecycle** – runs `aio api-mesh:get`; if no mesh exists it calls `api-mesh:create`, otherwise `api-mesh:update`, then waits briefly, describes the mesh, and fetches status.
81+
82+
Extend or reorder steps as needed (e.g., run linting/tests before deployment, send Slack notifications after success, etc.).
83+
84+
---
85+
86+
## Customizing the Template
87+
88+
- **Additional environments** – duplicate the branch/secrets mapping block and add new branches like `qa` or `dev` with their own credential sets.
89+
- **Matrix changes** – adjust `matrix.node-version` or `os` if you need different runtimes.
90+
- **Multiple meshes** – add extra steps to iterate over multiple `mesh.json` files or parameterize the mesh name via `.env` values.
91+
- **Observability** – append steps that push deployment metadata to your logging/monitoring stack.
92+
93+
When editing `deployMesh.yaml`, keep the secret-validation step up to date so failures happen quickly.
94+
95+
---
96+
97+
## Local Validation (Optional)
98+
99+
If you mirror the GitHub secrets as local environment variables you can run the same commands for smoke tests:
100+
101+
```bash
102+
npm install -g @adobe/aio-cli
103+
aio plugins:install @adobe/aio-cli-plugin-api-mesh
104+
aio console:org:select <ORGID>
105+
aio console:project:select <PROJECTID>
106+
aio console:workspace:select <WORKSPACEID>
107+
aio api-mesh:update -c mesh.json --env .env
108+
```
109+
110+
This makes it easier to debug mesh misconfigurations before committing.
111+
112+
---
113+
114+
## Troubleshooting
115+
116+
- **Unsupported branch error** – ensure you are pushing to `staging` or `production`, or extend the branch mapping block for additional environments.
117+
- **Secret validation failure** – confirm every secret listed earlier is present; GitHub scope is repository-level by default.
118+
- **CLI auth issues** – verify the OAuth client has `oauth_sts` permissions and the scopes defined in the workflow.
119+
- **Mesh update fails** – inspect the workflow logs around `aio api-mesh:update` for schema/validation errors; run the same command locally with `--verbose` for more detail.
120+
121+
---
122+
123+
## Next Steps
124+
125+
- Protect the `production` branch to require PR reviews before deployment.
126+
- Wire Slack/Teams notifications by adding an extra step after `Get Mesh Status`.
127+
- Version your mesh definitions (e.g., tag releases) so you can roll back quickly if needed.
128+
129+
Happy shipping!

0 commit comments

Comments
 (0)