86 lines
3.5 KiB
YAML
86 lines
3.5 KiB
YAML
name: Rollback k3s production
|
|
|
|
# One-command escape hatch for medical-chatbot-app (ArgoCD, k3s) — the
|
|
# Application build-practice-images.yml normally advances, and the same one
|
|
# serving realvuxbaro.me since the 2026-08-17 cutover. This workflow does not
|
|
# build anything: it only repoints the Application at an OLDER image tag that
|
|
# a previous build-practice-images.yml run already pushed to GHCR, using the
|
|
# exact same sync_practice_argocd.py logic that workflow uses to move
|
|
# forward — a rollback is just that script pointed backward.
|
|
#
|
|
# Does not touch the Compose EC2 (stopped 2026-08-18, no CI/CD path left —
|
|
# see docs/operations.md).
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
target_sha:
|
|
description: >-
|
|
Commit SHA to roll back to. Must have a successful "Build and sync
|
|
k3s images" run (check: gh run list --workflow=build-practice-images.yml).
|
|
required: true
|
|
|
|
concurrency:
|
|
# Same group as build-practice-images.yml: a rollback and a forward deploy
|
|
# must never race to repoint the same Application at the same time.
|
|
group: practice-images
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
rollback:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Fails fast and clearly on the most likely operator mistake: a typo'd
|
|
# or never-built SHA, rather than that surfacing later as a confusing
|
|
# ArgoCD/pod-level image pull failure.
|
|
- name: Confirm images exist for target_sha
|
|
run: |
|
|
set -eu
|
|
docker buildx imagetools inspect "ghcr.io/baovu2k4/vsf-duocthu-ai-service:${{ inputs.target_sha }}" > /dev/null
|
|
docker buildx imagetools inspect "ghcr.io/baovu2k4/vsf-duocthu-web:${{ inputs.target_sha }}" > /dev/null
|
|
|
|
- name: Point medical-chatbot-app at target_sha
|
|
env:
|
|
ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
|
|
ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
|
|
IMAGE_TAG: ${{ inputs.target_sha }}
|
|
run: python3 .github/scripts/sync_practice_argocd.py
|
|
|
|
# Blocks until the rollout has actually landed, not just until the sync
|
|
# call returned — sync_practice_argocd.py deliberately doesn't wait
|
|
# (see its own comment on the selfHeal race), so a rollback specifically
|
|
# needs this extra confirmation before it can claim success.
|
|
- name: Wait for the Application to be Synced, Healthy, and on target_sha
|
|
env:
|
|
ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
|
|
ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
|
|
EXPECT_TAG: ${{ inputs.target_sha }}
|
|
run: python3 .github/scripts/wait_for_argocd_sync.py
|
|
|
|
- name: Confirm realvuxbaro.me is serving the rolled-back build
|
|
run: |
|
|
for attempt in $(seq 1 18); do
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' \
|
|
"https://realvuxbaro.me/api/history?conversation_id=rollback-smoke-${{ inputs.target_sha }}")
|
|
if [ "$code" = "200" ]; then
|
|
echo "realvuxbaro.me is live on ${{ inputs.target_sha }}"
|
|
exit 0
|
|
fi
|
|
sleep 10
|
|
done
|
|
echo "realvuxbaro.me did not respond healthy within 3 minutes after rollback"
|
|
exit 1
|