GitHub Action: deploy-argocd

Deploy on Kubernetes with ArgoCD

Introduction

Deploy on Kubernetes with Helm/HelmFile and ArgoCD.

Usage

Deploy environment

  name: Pull Request
  on:
    pull_request:
      branches: [ 'main' ]
      types: [opened, synchronize, reopened]

  jobs:
    deploy:
      runs-on: ubuntu-latest
      environment:
        name: preview
        url: ${{ steps.deploy.outputs.webapp-url }}  
      steps:
        
        - name: Configure AWS Credentials
          uses: aws-actions/configure-aws-[email protected]
          with:
            aws-region: us-west-2
            role-to-assume: arn:aws:iam::111111111111:role/preview
            role-session-name: deploy
      
        - name: Deploy
          uses: cloudposse/github-action-deploy-argocd@main
          id: deploy
          with:
            cluster: https://github.com/cloudposse/argocd-deploy-non-prod-test/blob/main/plat/ue2-sandbox/apps
            toolchain: helmfile
            environment: preview
            namespace: preview
            application: test-app
            github-pat: ${{ secrets.GITHUB_AUTH_PAT }}
            repository: ${{ github.repository }}
            ref: ${{ github.event.pull_request.head.ref  }}
            image: nginx
            image-tag: latest
            operation: deploy
            debug: false
            synchronously: true
            deployment-id: ${{ github.run_id }}-${{ github.run_attempt }}

Destroy environment

  name: Pull Request
  on:
    pull_request:
      branches: [ 'main' ]
      types: [closed]

  jobs:
    destroy:
      runs-on: ubuntu-latest
      steps:
        - name: Configure AWS Credentials
          uses: aws-actions/configure-aws-[email protected]
          with:
            aws-region: us-west-2
            role-to-assume: arn:aws:iam::111111111111:role/preview
            role-session-name: destroy          
      
        - name: Destroy
          uses: cloudposse/github-action-deploy-helmfile@main
          id: destroy
          with:
            cluster: https://github.com/cloudposse/argocd-deploy-non-prod-test/blob/main/plat/ue2-sandbox/apps
            toolchain: helmfile
            environment: preview
            namespace: preview
            application: test-app
            github-pat: ${{ secrets.GITHUB_AUTH_PAT }}
            repository: ${{ github.repository }}
            ref: ${{ github.event.pull_request.head.ref }}  
            image: "<none>"
            image-tag: "<none>"
            operation: destroy
            debug: false

Deduping ArgoCD notifications per deploy attempt

ArgoCD's notification oncePer trigger dedupes on whichever field you point it at. Keying it on the application commit means a rollback — replaying a commit ArgoCD has already notified for — is silently suppressed, and the rollback reports no status at all.

Pass deployment-id a value that is unique per deploy attempt rather than per code state, and point oncePer at it instead:

  - name: Deploy
    uses: cloudposse/github-action-deploy-argocd@main
    with:
      # ...
      deployment-id: ${{ github.run_id }}-${{ github.run_attempt }}

The value is written to the generated config.yaml alongside the rest of the deploy metadata:

  app_repository: acme/example-app
  app_commit: 6e6a0e1b0e0c4b2a9f1d3c5e7a9b1d3f5a7c9e1b
  app_hostname: https://example-app.example.com
  name: preview.example-app
  namespace: preview
  manifests: plat/ue2-sandbox/apps/preview/example-app/manifests
  deployment_id: "12345678901-2"

The input is optional. Left at its empty default, the deployment_id key is omitted from config.yaml entirely, so callers that do not set it get byte-identical output.

Inputs

Name	Description	Default	Required
application	Application name	N/A	true
aws-region	AWS region	us-east-1	false
check-retry-count	Check retry count (for synchronously mode)	5	false
check-retry-interval	Check retry interval (in seconds) (for synchronously mode)	10	false
cluster	Cluster name	N/A	true
commit-retry-count	Commit retry count	4	false
commit-retry-interval	Commit retry interval (in seconds)	10	false
commit-status-github-token	Github token to access the app repository. Defaults to github-pat if not set.	N/A	false
commit-timeout	Commit timeout (in seconds)	60	false
debug	Debug mode	false	false
deployment-id	Unique identifier for this deploy attempt (for example, the GitHub run ID joined with the run attempt). When set, it is written to config.yaml as deployment\_id, which lets ArgoCD dedupe notifications per deploy attempt instead of per commit. Left unset, the key is omitted from config.yaml.		false
environment	Helmfile environment	preview	false
github-pat	Github PAT to access argocd configuration repository	N/A	true
gitref-sha	Git SHA (Depricated. Use ref instead)		false
helm-args	Additional helm arguments		false
helm-dependency-build	Run helm dependency build, only for helm toolchain, true or false	false	false
helm-version	Helm version	v3.20.1	false
helmfile-args	Additional helmfile arguments		false
helmfile-version	Helmfile version	v1.4.3	false
image	Docker image	N/A	true
image-tag	Docker image tag	N/A	true
kube-version	Kubernetes version for helm/helmfile rendering (e.g. 1.28). When provided, skips SSM metadata lookup via chamber.		false
namespace	Kubernetes namespace	N/A	true
operation	Operation with helmfiles. (valid options - deploy, destroy)	deploy	true
path	The path where lives the helmfile or helm chart.	N/A	true
ref	Git ref	N/A	true
release_label_name	The name of the label used to describe the helm release	release	false
repository	Application GitHub repository full name	N/A	true
ssm-path	SSM path to read environment secrets		false
synchronously	Wait until ArgoCD successfully apply the changes	false	false
toolchain	Toolchain ('helm', 'helmfile')	helmfile	false
values_file	Helm values file, this can be a single file or a comma separated list of files		false

Outputs

Name	Description
sha	Git commit SHA into argocd repo
webapp-url	Web Application url