1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

# Build the container image with Nix and hand it to Railway.
#
# The flake is the build: `nix build .#image` (flake.nix, dockerTools
# streamLayeredImage) produces the same image locally and in CI. Railway has no
# GitLab repo integration, so it cannot watch this repo directly; instead CI
# pushes the image to this project's own container registry and then points the
# Railway service at the new tag.

stages:
  - build
  - deploy

variables:
  IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  IMAGE_LATEST: $CI_REGISTRY_IMAGE:latest
  RAILWAY_SERVICE_ID: 60dd4db8-32c7-434f-8b46-c3274dc76ba5
  RAILWAY_ENVIRONMENT_ID: 03c2a9fa-6cdf-4bb9-b924-4181d5a3445b
  RAILWAY_API: https://backboard.railway.com/graphql/v2

build_image:
  stage: build
  image: nixos/nix:latest
  variables:
    NIX_CONFIG: "experimental-features = nix-command flakes"
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  script:
    # streamLayeredImage's output *is* a script that streams the tarball.
    - |
      nix build .#image --print-out-paths --no-link -L > store-path
      "$(cat store-path)" > glean-image.tar
    # skopeo pushes the docker-archive straight to the registry: no docker
    # daemon, so this works on a plain shared runner. --insecure-policy skips
    # the signature trust policy, which the nix image does not ship.
    - |
      nix shell nixpkgs#skopeo -c skopeo --insecure-policy copy \
        --dest-creds "gitlab-ci-token:$CI_JOB_TOKEN" \
        docker-archive:glean-image.tar \
        "docker://$IMAGE"
    - |
      nix shell nixpkgs#skopeo -c skopeo --insecure-policy copy \
        --dest-creds "gitlab-ci-token:$CI_JOB_TOKEN" \
        "docker://$IMAGE" "docker://$IMAGE_LATEST"

deploy_railway:
  stage: deploy
  image: alpine:latest
  needs: [build_image]
  # Without the token the pipeline still builds and publishes the image; only
  # the rollout is skipped, rather than failing the whole pipeline.
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $RAILWAY_TOKEN
  before_script:
    - apk add --no-cache curl jq
  script:
    - |
      call() {
        curl -sS -X POST "$RAILWAY_API" \
          -H "Content-Type: application/json" \
          -H "Project-Access-Token: $RAILWAY_TOKEN" \
          --data "$1" | tee response.json
        if jq -e '.errors' response.json >/dev/null; then
          echo "Railway API returned errors" >&2
          exit 1
        fi
      }
    # Point the service at the tag this pipeline just published.
    - |
      call "$(jq -nc \
        --arg s "$RAILWAY_SERVICE_ID" --arg e "$RAILWAY_ENVIRONMENT_ID" --arg i "$IMAGE" \
        '{query:"mutation($s:String!,$e:String!,$in:ServiceInstanceUpdateInput!){serviceInstanceUpdate(serviceId:$s,environmentId:$e,input:$in)}",
          variables:{s:$s,e:$e,in:{source:{image:$i}}}}')"
    # Roll it out.
    - |
      call "$(jq -nc \
        --arg s "$RAILWAY_SERVICE_ID" --arg e "$RAILWAY_ENVIRONMENT_ID" \
        '{query:"mutation($s:String!,$e:String!){serviceInstanceDeploy(serviceId:$s,environmentId:$e)}",
          variables:{s:$s,e:$e}}')"
    - echo "Deployed $IMAGE"