sfp-server-mangement-template/.github/workflows/update.yml

name: Update SFP Server

on:
  workflow_dispatch:
    inputs:
      docker_tag:
        description: 'Docker image tag to deploy (leave empty to use IMAGE_TAG variable or "latest")'
        required: false
        default: ''
      skip_drain:
        description: 'Skip waiting for active workflows to complete'
        type: boolean
        default: false
      drain_timeout:
        description: 'Max seconds to wait for active workflows to complete'
        required: false
        default: '3600'
      skip_backup:
        description: 'Skip backup of current configuration before update'
        type: boolean
        default: false

jobs:
  update:
    name: 'Update server'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Validate required variables
        run: |
          MISSING=""
          [ -z "${{ vars.SSH_HOST }}" ] && MISSING="$MISSING SSH_HOST"
          [ -z "${{ vars.TENANT_NAME }}" ] && MISSING="$MISSING TENANT_NAME"
          [ -z "${{ vars.DOCKER_REGISTRY }}" ] && MISSING="$MISSING DOCKER_REGISTRY"
          [ -z "${{ vars.IMAGE_FQDN }}" ] && MISSING="$MISSING IMAGE_FQDN"

          if [ -n "$MISSING" ]; then
            echo "Missing required GitHub Variables:$MISSING"
            echo ""
            echo "Configure these in: Settings > Secrets and variables > Actions > Variables"
            exit 1
          fi

      - name: Resolve image tag
        id: resolve
        run: |
          TAG="${{ inputs.docker_tag }}"
          if [ -z "$TAG" ]; then
            TAG="${{ vars.IMAGE_TAG || 'latest' }}"
          fi
          echo "tag=$TAG" >> $GITHUB_OUTPUT

      - name: Setup SFP CLI and SSH
        id: setup
        uses: ./.github/actions/setup-sfp
        with:
          docker-registry: ${{ vars.DOCKER_REGISTRY }}
          docker-registry-token: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
          image-fqdn: ${{ vars.IMAGE_FQDN }}
          image-tag: ${{ steps.resolve.outputs.tag }}
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
          ssh-host: ${{ vars.SSH_HOST }}

      - name: Update server
        env:
          DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
          DOCKER_REGISTRY_TOKEN: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
          SFP_IMAGE: ${{ steps.setup.outputs.sfp-image }}
        run: |
          TENANT="${{ vars.TENANT_NAME }}"
          SSH_USER="${{ vars.SSH_USER || 'root' }}"
          SSH_HOST="${{ vars.SSH_HOST }}"
          BASE_DIR="${{ vars.BASE_DIR || './sfp-server' }}"
          TAG="${{ steps.resolve.outputs.tag }}"

          echo "Updating SFP Server"
          echo "  Tenant:   $TENANT"
          echo "  Host:     $SSH_HOST"
          echo "  Tag:      $TAG"
          echo "  Image:    $SFP_IMAGE"

          # Build the update command
          UPDATE_CMD="sfp server update"
          UPDATE_CMD="$UPDATE_CMD --tenant \"$TENANT\""
          UPDATE_CMD="$UPDATE_CMD --base-dir \"$BASE_DIR\""
          UPDATE_CMD="$UPDATE_CMD --secrets-provider custom"
          UPDATE_CMD="$UPDATE_CMD --ssh-connection \"$SSH_USER@$SSH_HOST\""
          UPDATE_CMD="$UPDATE_CMD --identity-file /root/.ssh/deploy_key"
          UPDATE_CMD="$UPDATE_CMD --docker-tag \"$TAG\""

          if [ "${{ inputs.skip_drain }}" = "true" ]; then
            UPDATE_CMD="$UPDATE_CMD --skip-drain"
          else
            UPDATE_CMD="$UPDATE_CMD --drain-timeout ${{ inputs.drain_timeout }}"
          fi

          if [ "${{ inputs.skip_backup }}" = "true" ]; then
            UPDATE_CMD="$UPDATE_CMD --skip-backup"
          fi

          # Run sfp CLI from inside the Docker image
          # Copy SSH key into a temp dir with correct permissions
          SSH_DIR=$(mktemp -d)
          cp ~/.ssh/deploy_key "$SSH_DIR/deploy_key"
          cp ~/.ssh/known_hosts "$SSH_DIR/known_hosts"
          chmod 600 "$SSH_DIR/deploy_key"
          chmod 644 "$SSH_DIR/known_hosts"

          docker run --rm \
            --user root \
            -v "$SSH_DIR/deploy_key":/root/.ssh/deploy_key \
            -v "$SSH_DIR/known_hosts":/root/.ssh/known_hosts \
            -e DOCKER_REGISTRY \
            -e DOCKER_REGISTRY_TOKEN \
            "$SFP_IMAGE" \
            bash -c "chmod 600 /root/.ssh/deploy_key && $UPDATE_CMD"

          rm -rf "$SSH_DIR"

      - name: Output update results
        if: always()
        run: |
          TAG="${{ steps.resolve.outputs.tag }}"

          echo "## SFP Server Update" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Setting | Value |" >> $GITHUB_STEP_SUMMARY
          echo "|---------|-------|" >> $GITHUB_STEP_SUMMARY
          echo "| Tenant | ${{ vars.TENANT_NAME }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Host | ${{ vars.SSH_HOST }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Image | ${{ steps.setup.outputs.sfp-image }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Skip Drain | ${{ inputs.skip_drain }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Skip Backup | ${{ inputs.skip_backup }} |" >> $GITHUB_STEP_SUMMARY