feat: purge Helm and restore modern OpenShift template for Java (#491)

Author: DerekRoberts

.github/workflows/.deploy.yml

@@ -1,180 +1,126 @@
-name: .Deploys
+name: .Deploy
 
 on:
   workflow_call:
     inputs:
-      atomic:
-        description: Atomic deployment?  That means fail all or nothing
-        default: false
-        required: false
-        type: boolean
-      directory:
-        description: Chart directory
-        default: "charts/app"
-        required: false
-        type: string
       environment:
-        description: Environment name; omit for PRs
-        required: false
+        description: GitHub/OpenShift environment
+        default: ""
         type: string
-      oc_server:
-        default: https://api.silver.devops.gov.bc.ca:6443
-        description: OpenShift server
-        required: false
-        type: string
-      params:
-        description: Extra parameters to pass to helm upgrade
-        required: false
+      target:
+        description: Deployment target; usually PR number, test or prod
+        default: ${{ github.event.number }}
         type: string
       tag:
-        description: Specify a tag to deploy; defaults to PR number
-        required: false
+        description: Container tag
+        default: ${{ github.event.number }}
         type: string
       triggers:
-        description: Paths used to trigger a deployment; e.g. ('./backend/' './frontend/)
-        required: false
-        type: string
-      db_user:
-        description: The database user
-        required: false
-        default: "app"
+        description: Triggers for deployment
+        default: ""
         type: string
-      debug:
-        description: Debug mode
-        default: false
-        required: false
-        type: boolean
-
-      ### Usually a bad idea / not recommended
-      timeout-minutes:
-        description: "Timeout minutes"
-        default: 30
-        required: false
-        type: number
-      values:
-        description: "Values file"
-        default: "values.yaml"
-        required: false
-        type: string
-    outputs:
-      tag:
-        description: "Which tag was used for deployment?"
-        value: ${{ jobs.deploy.outputs.tag }}
-      triggered:
-        description: "Has a deployment has been triggered?"
-        value: ${{ jobs.deploy.outputs.triggered }}
 
     secrets:
+      db_password:
+        description: Database password (required except on pull_request)
+        required: false
       oc_namespace:
         description: OpenShift namespace
         required: true
       oc_token:
         description: OpenShift token
         required: true
+    outputs:
+      triggered:
+        description: Has deployment been triggered?
+        value: ${{ jobs.init.outputs.triggered }}
 
 permissions: {}
 
 jobs:
-  deploy:
-    name: Stack
+  init:
+    name: Deploy (init)
     environment: ${{ inputs.environment }}
-    runs-on: ubuntu-24.04
     outputs:
-      tag: ${{ inputs.tag || steps.pr.outputs.pr }}
       triggered: ${{ steps.deploy.outputs.triggered }}
-    timeout-minutes: ${{ inputs.timeout-minutes }}
+    runs-on: ubuntu-24.04
     steps:
-      - uses: bcgov/actions-openshift/crunchy@75454b2b33edf37135f6f167775c77a3414207f6 # v0.3.0
-        name: Deploy Crunchy
-        id: deploy_crunchy
-        with:
-          oc_namespace: ${{ secrets.oc_namespace }}
-          oc_token: ${{ secrets.oc_token }}
-          environment: ${{ inputs.environment }}
-          values_file: charts/crunchy/values.yml
-          triggers: ${{ inputs.triggers }}
-      # Variables
-      - if: inputs.tag  == ''
-        id: pr
-        uses: bcgov/action-get-pr@3931962bf13b3f4702d0013ec7c836f752ff1a3b # v0.3.0
-
-      - id: vars
+      - name: Database password
+        id: db
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          DB_PASSWORD: ${{ secrets.db_password }}
         run: |
-          # Vars: tag and release
-
-          # Tag defaults to PR number, but can be overridden by inputs.tag
-          tag=${{ inputs.tag || steps.pr.outputs.pr }}
-
-          # Release name includes run numbers to ensure uniqueness
-          release=${{ github.event.repository.name }}-${{ inputs.environment || steps.pr.outputs.pr || inputs.tag }}
-
-          # version, to support helm packaging for non-pr based releases (workflow_dispatch). default to 1.0.0+github run number
-          version=1.0.0+${{ github.run_number }}
-
-            # Summary
-          echo "tag=${tag}"
-          echo "release=${release}"
-          echo "version=${version}"
-
-          # Output
-          echo "tag=${tag}" >> $GITHUB_OUTPUT
-          echo "release=${release}" >> $GITHUB_OUTPUT
-          echo "version=${version}" >> $GITHUB_OUTPUT
-
-      - name: Stop pre-existing deployments on PRs (status = pending-upgrade)
-        if: github.event_name == 'pull_request'
-        uses: bcgov/actions-openshift/oc-runner@75454b2b33edf37135f6f167775c77a3414207f6 # v0.3.0
+          if [ "${EVENT_NAME}" = "pull_request" ]; then
+            password="$(openssl rand -hex 16)"
+            if [ -z "${password}" ]; then
+              echo "::error::openssl failed to generate a PR database password"
+              exit 1
+            fi
+          else
+            if [ -z "${DB_PASSWORD}" ]; then
+              echo "::error::db_password GitHub secret is required for ${EVENT_NAME} deploys"
+              exit 1
+            fi
+            password="${DB_PASSWORD}"
+          fi
+          echo "::add-mask::${password}"
+          echo "password=${password}" >> "${GITHUB_OUTPUT}"
+      - uses: bcgov/actions-openshift/deployer@75454b2b33edf37135f6f167775c77a3414207f6 # v0.3.0
+        id: deploy
         with:
+          file: common/openshift.init.yml
           oc_namespace: ${{ secrets.oc_namespace }}
-          oc_token: ${{ secrets.oc_token }}
           oc_server: ${{ vars.oc_server }}
+          oc_token: ${{ secrets.oc_token }}
+          # Secret + NetworkPolicies: create if missing. Postgres ignores
+          # POSTGRES_PASSWORD after first boot; restamping the Secret desyncs Flyway.
+          # New NetworkPolicy names still apply; existing NP specs do not update.
+          overwrite: false
+          parameters: -p DB_PASSWORD="${{ steps.db.outputs.password }}"
+            -p ZONE="${{ inputs.target }}"
+            -p NAME="${{ github.event.repository.name }}"
           triggers: ${{ inputs.triggers }}
-          commands: |
-            # Interrupt any previous deployments (PR only)
-            PREVIOUS=$(helm status ${{ steps.vars.outputs.release }} -o json | jq .info.status || true)
-            if [[ ${PREVIOUS} =~ pending ]]; then
-              echo "Rollback triggered"
-              helm rollback ${{ steps.vars.outputs.release }} || \
-                helm uninstall ${{ steps.vars.outputs.release }}
-            fi
+          debug: true
 
-      - uses: actions/checkout@v6
-      - name: Debug Values File
-        if: inputs.debug
-        run: ls -l charts/crunchy/values.yml
-      - name: Helm Deploy
+  deploy:
+    name: Deploy (${{ matrix.name }})
+    environment: ${{ inputs.environment }}
+    needs: [init]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      matrix:
+        name: [database, backend-java, backend-py]
+        include:
+          - name: database
+            file: common/openshift.database.yml
+            overwrite: false
+            parameters: -p DB_PVC_SIZE="256Mi"
+          - name: backend-java
+            file: backend-java/openshift.deploy.yml
+            overwrite: true
+            parameters: -p IMAGE_TAG="${{ inputs.tag }}"
+              -p COMPONENT="backend-java"
+          - name: backend-py
+            file: backend-py/openshift.deploy.yml
+            overwrite: true
+            parameters: -p IMAGE_TAG="${{ inputs.tag }}"
+              -p COMPONENT="backend-py"
+              -p MIGRATIONS="migrations-py"
+    outputs:
+      triggered: ${{ steps.deploy.outputs.triggered }}
+    steps:
+      - uses: bcgov/actions-openshift/deployer@75454b2b33edf37135f6f167775c77a3414207f6 # v0.3.0
         id: deploy
-        uses: bcgov/actions-openshift/oc-runner@75454b2b33edf37135f6f167775c77a3414207f6 # v0.3.0
         with:
+          file: ${{ matrix.file }}
           oc_namespace: ${{ secrets.oc_namespace }}
-          oc_token: ${{ secrets.oc_token }}
           oc_server: ${{ vars.oc_server }}
+          oc_token: ${{ secrets.oc_token }}
+          overwrite: ${{ matrix.overwrite }}
+          debug: true
+          parameters: -p ZONE="${{ inputs.target }}"
+            -p NAME="${{ github.event.repository.name }}"
+            ${{ matrix.parameters }}
           triggers: ${{ inputs.triggers }}
-          ref: ${{ github.ref }}
-          commands: |
-            # Deploy
-
-            # If directory provided, cd to it
-            [ -z "${{ inputs.directory }}" ]|| cd ${{ inputs.directory }}
-
-            # Helm package
-            sed -i 's/^name:.*/name: ${{ github.event.repository.name }}/' Chart.yaml
-            helm package -u . --app-version="tag-${{ steps.vars.outputs.tag }}_run-${{ github.run_number }}" --version=${{ steps.pr.outputs.pr || steps.vars.outputs.version }}
-            # print the values.yaml file to see the values being used
-            # Helm upgrade/rollout
-            helm upgrade \
-              --set-string global.repository=${{ github.repository }} \
-              --set-string global.tag="${{ steps.vars.outputs.tag }}" \
-              --set-string global.config.databaseUser="${{ inputs.db_user }}" \
-              --set-string global.databaseAlias="${{ steps.deploy_crunchy.outputs.release }}-crunchy" \
-              ${{ inputs.params }} \
-              --install --wait ${{ inputs.atomic && '--atomic' || '' }} ${{ steps.vars.outputs.release }} \
-              --timeout ${{ inputs.timeout-minutes }}m \
-              --values ${{ inputs.values }} \
-              ./${{ github.event.repository.name }}-${{ steps.pr.outputs.pr || steps.vars.outputs.version }}.tgz
-
-            # Helm release history
-            helm history ${{ steps.vars.outputs.release }}
-
-            # Completed pod cleanup
-            oc delete po --field-selector=status.phase==Succeeded || true

.github/workflows/merge.yml

@@ -11,14 +11,16 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Image tag set to deploy; e.g. PR number or prod"
+        description: "Image tag to deploy; e.g. PR number or prod"
         type: string
         default: "prod"
 
 concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
+
 permissions: {}
+
 jobs:
   vars:
     name: Set Variables
@@ -32,24 +34,27 @@ jobs:
       - name: PR Number
         id: pr
         uses: bcgov/action-get-pr@3931962bf13b3f4702d0013ec7c836f752ff1a3b # v0.3.0
+
   deploy-test:
     name: Deploy (TEST)
     permissions:
       contents: read # Required for repository access
+    needs: [vars]
     uses: ./.github/workflows/.deploy.yml
     secrets:
+      db_password: ${{ secrets.db_password }}
       oc_namespace: ${{ secrets.OC_NAMESPACE }}
       oc_token: ${{ secrets.OC_TOKEN }}
     with:
       environment: test
-      db_user: appproxy
-      tag: ${{ inputs.tag }}
+      target: test
+      tag: ${{ inputs.tag || needs.vars.outputs.pr }}
 
   integration-tests:
-    needs: [deploy-test]
     name: Integration Tests for APIs
+    needs: [deploy-test]
     permissions:
-      contents: read # Required for checkout
+      contents: read
     defaults:
       run:
         working-directory: integration-tests
@@ -59,33 +64,20 @@ jobs:
         name: [quarkus, fastapi]
         include:
           - name: quarkus
-            baseUrl: https://quickstart-openshift-backends-test-backend-java.apps.silver.devops.gov.bc.ca
+            baseUrl: https://${{ github.event.repository.name }}-test-backend-java.apps.silver.devops.gov.bc.ca
           - name: fastapi
-            baseUrl: https://quickstart-openshift-backends-test-backend-py.apps.silver.devops.gov.bc.ca
+            baseUrl: https://${{ github.event.repository.name }}-test-backend-py.apps.silver.devops.gov.bc.ca
     steps:
       - uses: actions/checkout@v6
-        name: Checkout
-      - name: Cache node modules
-        id: cache-npm
-        uses: actions/cache@v5
-        env:
-          cache-name: cache-node-modules
+      - uses: actions/setup-node@v5
         with:
-          # npm cache files are stored in `~/.npm` on Linux/macOS
-          path: ~/.npm
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-build-${{ env.cache-name }}-
-            ${{ runner.os }}-build-
-            ${{ runner.os }}-
-      - if: ${{ steps.cache-npm.outputs.cache-hit != 'true' }}
-        name: List the state of node modules
-        continue-on-error: true
-        run: npm list
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: integration-tests/package-lock.json
       - name: Install dependencies
         run: npm ci
       - name: Run integration tests
-        run: BASE_URL=${{ matrix.baseUrl }} API_NAME=${{ matrix.name }}  node src/main.js
+        run: BASE_URL=${{ matrix.baseUrl }} API_NAME=${{ matrix.name }} node src/main.js
 
   deploy-prod:
     name: Deploy (prod)
@@ -94,17 +86,13 @@ jobs:
     needs: [integration-tests, vars]
     uses: ./.github/workflows/.deploy.yml
     secrets:
+      db_password: ${{ secrets.db_password }}
       oc_namespace: ${{ secrets.OC_NAMESPACE }}
       oc_token: ${{ secrets.OC_TOKEN }}
     with:
       environment: prod
-      db_user: appproxy
-      params: --set global.autoscaling=true
-        --set backend-py.pdb.enabled=true
-        --set backend-java.pdb.enabled=true
-        --set backend-py.deploymentStrategy=RollingUpdate
-        --set backend-java.deploymentStrategy=RollingUpdate
-      tag: ${{ inputs.tag }}
+      target: prod
+      tag: ${{ inputs.tag || needs.vars.outputs.pr }}
 
   promote:
     name: Promote Images
@@ -114,7 +102,7 @@ jobs:
       packages: write
     strategy:
       matrix:
-        package: [backend-py, backend-java, migrations-py]
+        package: [backend-java, backend-py, migrations-py]
     timeout-minutes: 1
     steps:
       - uses: shrink/actions-docker-registry-tag@e6aaef25c595b6e0edd18bf4c7dbfea3abd43299 # v5