[DRAFT] Automated Preprod Deploy workflow (#1845)

* deploy-preprod backend workflow

* python mini project for static assets deploy

* don't write acl headers; we ignore them anyway

* include static assets deploy in github workflow

* update docker syntax; add vars to deploy-preprod workflow

* remove depcheck workflow

.github/workflows/deploy-preprod.yml

@@ -0,0 +1,62 @@
+name: Deploy to Heroku Preprod
+
+on:
+  push:
+    branches:
+      - edge
+
+jobs:
+  deploy-backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Login to Heroku
+        uses: akhileshns/[email protected]
+        with:
+          heroku_api_key: ${{secrets.HEROKU_API_KEY}}
+          heroku_app_name: "polis-preprod"
+          heroku_email: ${{secrets.HEROKU_EMAIL}}
+          branch: "edge"
+
+      - name: Deploy to Heroku
+        run: |
+          git push https://heroku:${{secrets.HEROKU_API_KEY}}@git.heroku.com/polis-preprod.git edge:main
+
+  deploy-static:
+    runs-on: ubuntu-latest
+    needs: deploy-backend
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-west-2
+
+      - name: Build static assets
+        env:
+          EMBED_SERVICE_HOSTNAME: preprod.pol.is
+          ENABLE_TWITTER_WIDGETS: true
+          GA_TRACKING_ID: G-WVP78N35QR
+          SERVICE_URL: https://preprod.pol.is
+        run: |
+          docker compose create --build --force-recreate file-server
+          docker cp file-server:/app/build/build ./build
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install -r deploy/requirements.txt
+
+      - name: Deploy to S3
+        run: |
+          python deploy/deploy-static-assets.py --bucket edge.static-assets.pol.is

client-admin/Dockerfile

@@ -7,12 +7,12 @@ FROM docker.io/node:18-alpine
 
 ARG ENABLE_TWITTER_WIDGETS
 ARG FB_APP_ID
-ENV ENABLE_TWITTER_WIDGETS ${ENABLE_TWITTER_WIDGETS}
-ENV FB_APP_ID ${FB_APP_ID}
+ENV ENABLE_TWITTER_WIDGETS=${ENABLE_TWITTER_WIDGETS}
+ENV FB_APP_ID=${FB_APP_ID}
 
 # Set default NODE_ENV to production unless overridden at build time with --build-arg NODE_ENV=development
 ARG NODE_ENV
-ENV NODE_ENV ${NODE_ENV:-production}
+ENV NODE_ENV=${NODE_ENV:-production}
 
 WORKDIR /app
 

client-admin/webpack.config.js

@@ -98,7 +98,6 @@ module.exports = (env, options) => {
 
             function writeHeadersJsonHtml() {
               const headersData = {
-                'x-amz-acl': 'public-read',
                 'Content-Type': 'text/html; charset=UTF-8',
                 'Cache-Control': 'no-cache'
               }
@@ -107,7 +106,6 @@ module.exports = (env, options) => {
 
             function writeHeadersJsonJs() {
               const headersData = {
-                'x-amz-acl': 'public-read',
                 'Content-Encoding': 'gzip',
                 'Content-Type': 'application/javascript',
                 'Cache-Control':

client-participation/Dockerfile

@@ -8,13 +8,13 @@ FROM docker.io/node:18-alpine
 ARG EMBED_SERVICE_HOSTNAME
 ARG FB_APP_ID
 ARG GA_TRACKING_ID
-ENV EMBED_SERVICE_HOSTNAME ${EMBED_SERVICE_HOSTNAME}
-ENV FB_APP_ID ${FB_APP_ID}
-ENV GA_TRACKING_ID ${GA_TRACKING_ID}
+ENV EMBED_SERVICE_HOSTNAME=${EMBED_SERVICE_HOSTNAME}
+ENV FB_APP_ID=${FB_APP_ID}
+ENV GA_TRACKING_ID=${GA_TRACKING_ID}
 
 # Set default NODE_ENV to production unless overridden at build time with --build-arg NODE_ENV=development
 ARG NODE_ENV
-ENV NODE_ENV ${NODE_ENV:-production}
+ENV NODE_ENV=${NODE_ENV:-production}
 
 WORKDIR /app
 

client-participation/webpack.config.js

@@ -33,7 +33,6 @@ function writeHeadersJsonForOutputFiles(isDev) {
 
   function writeHeadersJsonHtml() {
     const headersData = {
-      'x-amz-acl': 'public-read',
       'Content-Type': 'text/html; charset=UTF-8',
       'Cache-Control': 'no-cache'
     }
@@ -42,7 +41,6 @@ function writeHeadersJsonForOutputFiles(isDev) {
 
   function writeHeadersJsonJs() {
     const headersData = {
-      'x-amz-acl': 'public-read',
       ...(!isDev && { 'Content-Encoding': 'gzip' }),
       'Content-Type': 'application/javascript',
       'Cache-Control':
@@ -54,7 +52,6 @@ function writeHeadersJsonForOutputFiles(isDev) {
 
   function writeHeadersJsonCss() {
     const headersData = {
-      'x-amz-acl': 'public-read',
       ...(!isDev && { 'Content-Encoding': 'gzip' }),
       'Content-Type': 'text/css',
       'Cache-Control':

client-report/Dockerfile

@@ -7,7 +7,7 @@ FROM docker.io/node:18-alpine
 
 # Set default NODE_ENV to production unless overridden at build time with --build-arg NODE_ENV=development
 ARG NODE_ENV
-ENV NODE_ENV ${NODE_ENV:-production}
+ENV NODE_ENV=${NODE_ENV:-production}
 
 WORKDIR /app
 
@@ -23,7 +23,7 @@ COPY . .
 # Or may be passed in at build time with --build-arg GIT_HASH=$(git rev-parse --short HEAD)
 ARG GIT_HASH
 ARG SERVICE_URL
-ENV GIT_HASH ${GIT_HASH:-placeholder}
-ENV SERVICE_URL ${SERVICE_URL}
+ENV GIT_HASH=${GIT_HASH:-placeholder}
+ENV SERVICE_URL=${SERVICE_URL}
 
 CMD npm run build:prod

client-report/writeHeadersJsonTask.js

@@ -13,7 +13,6 @@ module.exports = function writeHeadersJson() {
 
   function writeHeadersJsonCss() {
     const headersData = {
-      'x-amz-acl': 'public-read',
       'Content-Type': 'text/css',
       'Cache-Control':
         'no-transform,public,max-age=31536000,s-maxage=31536000'
@@ -23,7 +22,6 @@ module.exports = function writeHeadersJson() {
 
   function writeHeadersJsonHtml() {
     const headersData = {
-      'x-amz-acl': 'public-read',
       'Content-Type': 'text/html; charset=UTF-8',
       'Cache-Control': 'no-cache'
     }
@@ -32,7 +30,6 @@ module.exports = function writeHeadersJson() {
 
   function writeHeadersJsonJs() {
     const headersData = {
-      'x-amz-acl': 'public-read',
       'Content-Type': 'application/javascript',
       'Cache-Control':
         'no-transform,public,max-age=31536000,s-maxage=31536000'

deploy/.gitignore

@@ -0,0 +1,18 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+.Python
+env/
+.env
+venv/
+.venv
+.pytest_cache/
+.mypy_cache/
+
+# IDE
+.vscode/
+.idea/
+
+# OS
+.DS_Store

deploy/README.md

@@ -0,0 +1,87 @@
+# Polis Deploy
+
+Tools for deploying Polis static assets to S3.
+
+## Prerequisites
+
+- python 3.8+
+- aws cli
+- heroku cli
+
+### Push the backend code to Heroku
+
+```bash
+heroku login
+git push <heroku-remote> edge:main
+```
+
+_Replace `<heroku-remote>` with the appropriate heroku remote, e.g. heroku-preprod_
+
+### Build the Polis static assets
+
+from the root of the project:
+
+```bash
+make ENV_FILE=<env-file> PROD build-web-assets
+```
+
+### AWS CLI
+
+Log into AWS SSO and configure your AWS CLI with the appropriate profile.
+
+#### First time setup (or to refresh credentials)
+
+```bash
+aws configure sso
+```
+
+follow the prompts to configure your profile.
+e.g.
+
+> SSO session name: polis-deploy
+>
+> SSO start URL: [aws-start-url]
+>
+> SSO region: us-east-1
+>
+> SSO registration scopes: [enter for default]
+>
+> CLI default client Region: us-east-1
+>
+> CLI default output format: json
+>
+> CLI profile name: polis-deploy
+
+#### Login with the above profile
+
+```bash
+export AWS_PROFILE=polis-deploy
+
+aws sso login
+
+# Verify that you are logged in
+aws sts get-caller-identity
+```
+
+## Python Setup
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+pip install -r dev-requirements.txt
+```
+
+## Usage
+
+```bash
+python deploy-static-assets.py --bucket <bucket-name>
+```
+
+_Replace `<bucket-name>` with the appropriate bucket name, e.g. edge.static-assets.pol.is_
+
+Or from the root of the project:
+
+```bash
+python deploy/deploy-static-assets.py --bucket <bucket-name>
+```