Bruno Domingues
090456e11f
reusable-deploy-dataops.yml encadeia release-tarball -> dataops-module-release.yml, que pede pull-requests:read; GitHub valida a interseção de permissions em todo o workflow_call encadeado, independente do if: que gate o job. Removido por engano em 586a5b9, achando que só existia por causa do trigger pull_request antigo. [skip ci]
35 lines
990 B
YAML
35 lines
990 B
YAML
name: Deploy DataOps Worker
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
chart_ref:
|
|
description: >
|
|
sientia-helm-chart branch to bump GITHUB_BRANCH on AND deploy — the literal
|
|
deploy target. Validated via git ls-remote; a branch that does not exist in
|
|
sientia-helm-chart is a hard error, not a silent fallback to main.
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: write
|
|
id-token: write
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
deploy:
|
|
name: Deploy
|
|
uses: Aignosi/github_workflow_templates/.github/workflows/reusable-deploy-dataops.yml@main
|
|
with:
|
|
branch_name: ${{ github.ref_name }}
|
|
chart_ref: ${{ inputs.chart_ref }}
|
|
project_name: 'orchestrator'
|
|
chart_name: 'orchestrator-worker'
|
|
env_list_path: '[".env"]'
|
|
update_version_in: '["pyproject"]'
|
|
create_tarball: ${{ github.event_name == 'pull_request' }}
|
|
mirror: true
|
|
bump_chart: true
|
|
deploy: true
|
|
secrets: inherit
|