Skip to content

Commit 4cc5dd3

Browse files
nuzilnuzil
committed
1.1.0
### Added - New primary workflow `.github/workflows/deploy.yaml` that materializes branch-specific mesh secrets, computes CLI flags automatically, and waits for mesh provisioning with retry logic. - Reusable Newman regression workflow `.github/workflows/tests.yaml` plus a dependent `tests` job so deployments can trigger API smoke tests per branch. ### Changed - Deployment job now emits `secrets.yaml` at runtime from encrypted GitHub secrets (`MESH_SECRETS_STAGE` / `MESH_SECRETS_PROD`) to keep sensitive resolver credentials out of the repository. - Mesh commands (`aio api-mesh:create` / `update`) automatically include `--env .env` and `--secrets secrets.yaml` when those files exist, reducing manual flag drift. - Mesh provisioning phase now polls `aio api-mesh:status` with clearer logging and early-failure handling if the mesh never reaches a healthy state.
1 parent 9d7f319 commit 4cc5dd3

4 files changed

Lines changed: 136 additions & 8 deletions

File tree

.github/workflows/deployMesh.yaml renamed to .github/workflows/deploy.yaml

Lines changed: 69 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,23 @@ jobs:
3535
echo "TECHNICALACCID=${{ secrets.TECHNICALACCID_STAGE }}" >> "$GITHUB_ENV"
3636
echo "TECHNICALACCEMAIL=${{ secrets.TECHNICALACCEMAIL_STAGE }}" >> "$GITHUB_ENV"
3737
echo "WORKSPACEID=${{ secrets.WORKSPACEID_STAGE }}" >> "$GITHUB_ENV"
38+
{
39+
printf '%s\n' 'MESH_SECRETS<<__MESH_SECRETS__'
40+
printf '%s\n' "${{ secrets.MESH_SECRETS_STAGE }}"
41+
printf '%s\n' '__MESH_SECRETS__'
42+
} >> "$GITHUB_ENV"
3843
elif [ "$BRANCH_NAME" = "production" ]; then
3944
echo "TARGET_ENV=production" >> "$GITHUB_ENV"
4045
echo "CLIENTID=${{ secrets.CLIENTID_PROD }}" >> "$GITHUB_ENV"
4146
echo "CLIENTSECRET=${{ secrets.CLIENTSECRET_PROD }}" >> "$GITHUB_ENV"
4247
echo "TECHNICALACCID=${{ secrets.TECHNICALACCID_PROD }}" >> "$GITHUB_ENV"
4348
echo "TECHNICALACCEMAIL=${{ secrets.TECHNICALACCEMAIL_PROD }}" >> "$GITHUB_ENV"
4449
echo "WORKSPACEID=${{ secrets.WORKSPACEID_PROD }}" >> "$GITHUB_ENV"
50+
{
51+
printf '%s\n' 'MESH_SECRETS<<__MESH_SECRETS__'
52+
printf '%s\n' "${{ secrets.MESH_SECRETS_PROD }}"
53+
printf '%s\n' '__MESH_SECRETS__'
54+
} >> "$GITHUB_ENV"
4555
else
4656
echo "Unsupported branch '$BRANCH_NAME'. Only staging and production are allowed." >&2
4757
exit 1
@@ -60,6 +70,17 @@ jobs:
6070
echo "Please set all required secrets: CLIENTID, CLIENTSECRET, TECHNICALACCID, TECHNICALACCEMAIL, IMSORGID, ORGID, PROJECTID, WORKSPACEID"
6171
exit 1
6272
fi
73+
if [ -n "${MESH_SECRETS:-}" ]; then
74+
echo "Mesh secrets detected in environment"
75+
else
76+
echo "Warning: MESH_SECRETS not provided; secrets.yaml will not be generated" >&2
77+
fi
78+
- name: Materialize mesh secrets file
79+
if: ${{ env.MESH_SECRETS != '' }}
80+
run: |
81+
set -euo pipefail
82+
printf '%s\n' "$MESH_SECRETS" > secrets.yaml
83+
chmod 600 secrets.yaml
6384
- name: Setup CLI
6485
uses: adobe/aio-cli-setup-action@1.3.0
6586
with:
@@ -100,15 +121,59 @@ jobs:
100121
- name: Debug Get Mesh Output
101122
continue-on-error: true
102123
run: echo "Get Mesh Output - ${{ steps.get_mesh.outputs.mesh_output }}"
124+
- name: Compute Mesh Credential Flags
125+
id: mesh_args
126+
run: |
127+
set -euo pipefail
128+
MESH_ARGS="-c mesh.json"
129+
if [ -f ".env" ]; then
130+
MESH_ARGS="$MESH_ARGS --env .env"
131+
fi
132+
if [ -f "secrets.yaml" ]; then
133+
MESH_ARGS="$MESH_ARGS --secrets secrets.yaml"
134+
fi
135+
echo "args=$MESH_ARGS" >> "$GITHUB_OUTPUT"
103136
- name: Create Mesh
104137
if: ${{ contains(steps.get_mesh.outputs.mesh_output, 'No mesh found') }}
105-
run: aio api-mesh:create -c mesh.json --env .env
138+
run: aio api-mesh:create ${{ steps.mesh_args.outputs.args }}
106139
- name: Update Mesh
107140
if: ${{ !contains(steps.get_mesh.outputs.mesh_output, 'No mesh found') }}
108-
run: aio api-mesh:update -c mesh.json --env .env
109-
- name: Wait for 30 seconds
110-
run: sleep 30
141+
run: aio api-mesh:update ${{ steps.mesh_args.outputs.args }}
142+
- name: Wait for Mesh Provisioning
143+
run: |
144+
set -euo pipefail
145+
max_attempts=60
146+
attempt=1
147+
while [ "$attempt" -le "$max_attempts" ]; do
148+
echo "Polling mesh status (attempt $attempt/$max_attempts)..."
149+
status_output=$(aio api-mesh:status 2>&1 || true)
150+
echo "$status_output"
151+
152+
if echo "$status_output" | grep -F "Mesh provisioned successfully." >/dev/null; then
153+
echo "Mesh provisioned successfully."
154+
break
155+
elif echo "$status_output" | grep -Eq "Mesh is currently building|Your mesh is being provisioned.|Currently provisioning your mesh|Wait a few minutes and try again.|Unable to get mesh status"; then
156+
echo "Mesh is currently building. Waiting 10 seconds before next check."
157+
sleep 10
158+
else
159+
echo "Unexpected status output. Treating as failure."
160+
exit 1
161+
fi
162+
163+
attempt=$((attempt + 1))
164+
done
165+
166+
if [ "$attempt" -gt "$max_attempts" ]; then
167+
echo "Mesh provisioning did not finish within the allotted time."
168+
exit 1
169+
fi
111170
- name: Describe Mesh
112171
run: aio api-mesh:describe
113172
- name: Get Mesh Status
114173
run: aio api-mesh:status
174+
175+
tests:
176+
name: Execute Tests
177+
needs: [deploy]
178+
# Use the path to the reusable workflow file
179+
uses: ./.github/workflows/tests.yaml

‎.github/workflows/tests.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Run Tests
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
newman:
8+
name: Run Newman Tests
9+
runs-on: ubuntu-latest
10+
env:
11+
BRANCH_NAME: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.ref_name }}
12+
steps:
13+
- name: Checkout repository
14+
uses: actions/checkout@v4
15+
with:
16+
ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
17+
- name: Run Newman Tests
18+
run: |
19+
set -euo pipefail
20+
COLLECTION_PATH="tests/newman/collection.json"
21+
ENV_PATH="tests/newman/environment_${BRANCH_NAME}.json"
22+
23+
if [ ! -f "$COLLECTION_PATH" ]; then
24+
echo "Skipping Newman tests: collection not found at $COLLECTION_PATH."
25+
exit 0
26+
fi
27+
28+
if [ ! -f "$ENV_PATH" ]; then
29+
echo "Skipping Newman tests: environment file not found for branch $BRANCH_NAME."
30+
exit 0
31+
fi
32+
33+
echo "Running Newman tests for branch $BRANCH_NAME..."
34+
docker run --rm \
35+
-v "$PWD":/etc/newman \
36+
-w /etc/newman \
37+
postman/newman_alpine33 \
38+
run "$COLLECTION_PATH" -e "$ENV_PATH"

‎CHANGELOG.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file. The format loosely follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the repository uses [Semantic Versioning](https://semver.org/).
4+
5+
## [1.1.0] - 2025-11-25
6+
### Added
7+
- New primary workflow `.github/workflows/deploy.yaml` that materializes branch-specific mesh secrets, computes CLI flags automatically, and waits for mesh provisioning with retry logic.
8+
- Reusable Newman regression workflow `.github/workflows/tests.yaml` plus a dependent `tests` job so deployments can trigger API smoke tests per branch.
9+
10+
### Changed
11+
- Deployment job now emits `secrets.yaml` at runtime from encrypted GitHub secrets (`MESH_SECRETS_STAGE` / `MESH_SECRETS_PROD`) to keep sensitive resolver credentials out of the repository.
12+
- Mesh commands (`aio api-mesh:create` / `update`) automatically include `--env .env` and `--secrets secrets.yaml` when those files exist, reducing manual flag drift.
13+
- Mesh provisioning phase now polls `aio api-mesh:status` with clearer logging and early-failure handling if the mesh never reaches a healthy state.
14+
15+
## [1.0.0] - 2025-11-19
16+
### Added
17+
- Initial Adobe API Mesh CI/CD template with a GitHub Actions workflow for staging/production deployments, README-based setup guidance, and secret validation.

‎README.md‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,24 @@ This repository is a lightweight starting point for teams that want a repeatable
66

77
## What You Get
88

9-
- **Workflow automation** – `.github/workflows/deployMesh.yaml` handles checkout, authentication via the Adobe I/O CLI, mesh creation (or update), and post-deploy validation.
9+
- **Workflow automation** – `.github/workflows/deploy.yaml` handles checkout, authentication via the Adobe I/O CLI, mesh creation (or update), and post-deploy validation.
1010
- **Environment awareness** – pushes to `staging` or `production` automatically pull the corresponding credential set and workspace identifiers.
1111
- **Manual control** – trigger the workflow with `workflow_dispatch` whenever you need an ad-hoc deployment.
1212
- **Extensibility** – add new environments, steps, linters, or notifications by extending the single workflow file.
1313

14+
### Key Capabilities
15+
16+
- **Secret materialization** – branch-specific secrets can include encrypted mesh credentials (`MESH_SECRETS_*`) that the workflow writes to `secrets.yaml` on the fly and passes through `--secrets` so sensitive resolvers stay out of Git history.
17+
- **Auto-flag builder** – the workflow inspects the repo for `.env` and `secrets.yaml` and automatically appends the correct `aio api-mesh:*` flags, helping you wire runtime configuration consistently.
18+
- **Provisioning watchdog** – mesh deployments poll `aio api-mesh:status` for up to 10 minutes with friendly logging, failing early if provisioning stalls or ends unexpectedly.
19+
- **Reusable testing workflow** – `.github/workflows/tests.yaml` defines a Newman-based regression suite that runs after deployment (via the `tests` job in `deploy.yaml`) and selects the right Postman environment per branch.
20+
1421
Repository layout (expected):
1522

1623
```
1724
.
18-
├── .github/workflows/deployMesh.yaml # Main CI/CD pipeline
25+
├── .github/workflows/deploy.yaml # Main CI/CD pipeline
26+
├── .github/workflows/tests.yaml # Reusable Newman regression tests
1927
├── mesh.json # API Mesh definition (commit your own)
2028
├── .env # Optional runtime variables used by mesh.json
2129
└── README.md # This documentation
@@ -70,7 +78,7 @@ Once the workflow succeeds, your Adobe API Mesh instance will be created (if mis
7078

7179
---
7280

73-
## Workflow Walkthrough (`deployMesh.yaml`)
81+
## Workflow Walkthrough (`deploy.yaml`)
7482

7583
1. **Checkout & Node setup** – pulls repository code and provisions Node 20 on `ubuntu-latest`.
7684
2. **Branch-aware env mapping** – resolves GitHub secrets to runtime variables (`TARGET_ENV`, `CLIENTID`, etc.). Only `staging` and `production` are allowed to prevent accidental deployments from other branches.
@@ -90,7 +98,7 @@ Extend or reorder steps as needed (e.g., run linting/tests before deployment, se
9098
- **Multiple meshes** – add extra steps to iterate over multiple `mesh.json` files or parameterize the mesh name via `.env` values.
9199
- **Observability** – append steps that push deployment metadata to your logging/monitoring stack.
92100

93-
When editing `deployMesh.yaml`, keep the secret-validation step up to date so failures happen quickly.
101+
When editing `deploy.yaml`, keep the secret-validation step up to date so failures happen quickly.
94102

95103
---
96104

0 commit comments

Comments
 (0)