feat: CI build process for grafana

.github/workflows/grafana.yml

@@ -0,0 +1,110 @@
+---
+name: Grafana deployment
+
+env:
+  IMAGE_NAME: grafana
+  PUBLIC_IMAGE_NAME: ghcr.io/ebmdatalab/grafana
+  REGISTRY: ghcr.io
+  SSH_AUTH_SOCK: /tmp/agent.sock
+
+on:
+  push:
+
+jobs:
+  lint-dockerfile:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf  # v3.1.0
+        with:
+          dockerfile: grafana/Dockerfile
+
+  docker-test-and-build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: "opensafely-core/setup-action@v1"
+        with:
+          install-just: true
+
+      - name: Build docker image for both prod and dev
+        run: |
+            just grafana/docker-build 
+
+      - name: Run smoke test on prod
+        run: |
+          # TODO: what is this?
+          # just grafana/docker-run
+
+      - name: Save docker image
+        run: |
+          docker save grafana | gzip > /tmp/grafana.tar.gz
+
+      - name: Upload docker image
+        uses: actions/upload-artifact@v3
+        with:
+            name: grafana-image
+            path: /tmp/grafana.tar.gz
+
+  required-checks:
+    if: always()
+
+    needs:
+    - docker-test-and-build
+    - lint-dockerfile
+
+    runs-on: Ubuntu-latest
+
+    steps:
+    - name: Decide whether the needed jobs succeeded or failed
+      uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
+      with:
+        jobs: ${{ toJSON(needs) }}
+
+  deploy:
+    needs: [required-checks]
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+
+    if: github.ref == 'refs/heads/main'
+
+    concurrency: deploy-production
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: "opensafely-core/setup-action@v1"
+        with:
+          install-just: true
+
+      - name: Download docker image
+        uses: actions/download-artifact@v3
+        with:
+            name: grafana-image
+            path: /tmp/image
+
+      - name: Import docker image
+        run: gunzip -c /tmp/image/grafana.tar.gz | docker load
+
+      - name: Test image we imported from previous job works
+        run: |
+            # TODO: what is this?
+            # SKIP_BUILD=1 just grafana/docker-run
+
+      - name: Publish image
+        run: |
+            echo ${{ secrets.GITHUB_TOKEN }} | docker login "$REGISTRY" -u ${{ github.actor }} --password-stdin
+            docker tag "$IMAGE_NAME" "$PUBLIC_IMAGE_NAME":latest
+            docker push "$PUBLIC_IMAGE_NAME":latest
+
+      - name: Deploy image
+        run: |
+            ssh-agent -a "$SSH_AUTH_SOCK" > /dev/null
+            ssh-add - <<< "${{ secrets.DOKKU3_DEPLOY_SSH_KEY }}"
+            SHA=$(docker inspect --format='{{index .RepoDigests 0}}' "$PUBLIC_IMAGE_NAME":latest)
+            ssh -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" [email protected] git:from-image grafana "$SHA"

grafana/justfile

@@ -0,0 +1,16 @@
+
+docker-build:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    test -z "${SKIP_BUILD:-}" || { echo "SKIP_BUILD set"; exit 0; }
+
+    # ensure env file exists
+    test -f .env || cp dotenv-sample .env
+
+    # set build args for prod builds
+    export BUILD_DATE=$(date -u +'%y-%m-%dT%H:%M:%SZ')
+    export GITREF=$(git rev-parse --short HEAD)
+
+    # build the thing
+    docker build grafana