ed31bed5c8
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / build-and-deploy (push) Has been cancelled
CD Pipeline / post-deploy-checks (push) Has been cancelled
CD Pipeline / tests (push) Has been cancelled
72 lines
2.8 KiB
YAML
72 lines
2.8 KiB
YAML
# =============================================================================
|
|
# Deploy Prometheus Alert Rules (獨立 workflow)
|
|
# 2026-04-05 Claude Code (ADR-039 I3): 從 cd.yaml 分離
|
|
# 觸發條件: ops/monitoring/alerts-unified.yml / slo-rules.yml 有變更 或 workflow_dispatch
|
|
# 說明: 告警規則部署不依賴應用構建，獨立觸發以加快響應速度
|
|
# =============================================================================
|
|
|
|
name: Deploy Alert Rules
|
|
|
|
on:
|
|
# 2026-06-28 Codex: 110 runner 壓力事故期間，告警規則部署改為受控手動觸發。
|
|
# push path filtering 不得在 runner 搬遷 / 硬限流前重開。
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
SRE_GROUP_CHAT_ID: "-1003711974679"
|
|
|
|
jobs:
|
|
deploy-alerts:
|
|
name: "Deploy Prometheus Alert Rules"
|
|
runs-on: awoooi-non110-ubuntu
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Validate alerts YAML
|
|
# 2026-04-08 Claude Sonnet 4.6: pip install pyyaml 確保 runner 有此依賴
|
|
run: |
|
|
pip3 install -q pyyaml 2>/dev/null || pip install -q pyyaml
|
|
python3 -c "import yaml; yaml.safe_load(open('ops/monitoring/alerts-unified.yml')); print('YAML OK')"
|
|
python3 -c "import yaml; yaml.safe_load(open('ops/monitoring/slo-rules.yml')); print('SLO YAML OK')"
|
|
|
|
- name: Setup SSH key
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
umask 077
|
|
source_key="${AWOOOI_DEPLOY_SSH_KEY_PATH:-${HOME}/.ssh/deploy_key}"
|
|
if [ ! -r "${source_key}" ]; then
|
|
echo "deploy ssh key file missing: ${source_key}" >&2
|
|
exit 1
|
|
fi
|
|
cp "${source_key}" ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
ssh-keyscan 192.168.0.110 >> ~/.ssh/known_hosts
|
|
|
|
- name: Deploy alerts to Prometheus
|
|
run: bash scripts/ops/deploy-alerts.sh
|
|
|
|
- name: Notify deploy result
|
|
if: always()
|
|
env:
|
|
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
|
|
run: |
|
|
STATUS="${{ job.status }}"
|
|
EMOJI="✅"
|
|
[ "$STATUS" != "success" ] && EMOJI="❌"
|
|
SHORT_SHA="${{ github.sha }}"
|
|
SHORT_SHA="${SHORT_SHA:0:7}"
|
|
MSG="${EMOJI} Prometheus 告警規則部署 ${STATUS} (${SHORT_SHA})"
|
|
CICD_STATUS="success"
|
|
[ "$STATUS" != "success" ] && CICD_STATUS="failed"
|
|
if AWOOI_CICD_STATUS="${CICD_STATUS}" \
|
|
AWOOI_CICD_STAGE=deploy-alerts \
|
|
AWOOI_CICD_JOB_NAME="Prometheus 告警規則部署" \
|
|
AWOOI_CICD_COMMIT_SHA="${{ github.sha }}" \
|
|
AWOOI_CICD_SUMMARY="${MSG}" \
|
|
scripts/ci/notify-awoooi-cicd.sh; then
|
|
echo "Alert rule deploy notification mirrored through AWOOI API"
|
|
else
|
|
echo "AWOOI API notify failed; direct Telegram fallback disabled to preserve AwoooP receipt chain"
|
|
fi
|