Enable GitHub OAuth for Uffizzi Previews. (#1157)

* Enable GitHub OAuth for Uffizzi Previews.

* empty

* more specific build conditions

* Increase memory resources for `windmill` container.

.github/uffizzi/docker-compose.uffizzi.yml

@@ -14,13 +14,13 @@ services:
 
   windmill:
     image: '${WINDMILL_IMAGE}'
-    privileged: false
-    restart: unless-stopped
     ports:
       - 8000:8000
+    entrypoint: ['/bin/sh', '-c']
+    command: 'echo ${OAUTH_JSON_BASE64} | base64 --decode > /usr/src/app/oauth.json && ./windmill'
     environment:
       - DATABASE_URL=postgres://postgres:changeme@localhost/windmill?sslmode=disable
-      - BASE_URL=http://localhost
+      - BASE_URL=${EXPECTED_URL}
       - BASE_INTERNAL_URL=http://localhost:8000
       - RUST_LOG=info
       - NUM_WORKERS=3
@@ -28,12 +28,16 @@ services:
       - DENO_PATH=/usr/bin/deno
       - PYTHON_PATH=/usr/local/bin/python3
       - METRICS_ADDR=false
+      - OAUTH_JSON_BASE64=${OAUTH_JSON_BASE64}
     volumes:
       - worker_dependency_cache:/tmp/windmill/cache
+    deploy:
+      resources:
+        limits:
+          memory: 250M
 
   lsp:
     image: '${LSP_IMAGE}'
-    restart: unless-stopped
     ports:
       - 3001:3001
 

.github/workflows/uffizzi-build.yml

@@ -4,6 +4,8 @@ on:
     types: [opened,synchronize,reopened,closed]
     paths:
       - "backend/**"
+      - ".github/uffizzi/**"
+      - ".github/workflows/**"
   workflow_dispatch:
       
 jobs:

.github/workflows/uffizzi-preview.yml

@@ -47,22 +47,35 @@ jobs:
           echo 'EVENT_JSON<<EOF' >> $GITHUB_ENV
           cat event.json >> $GITHUB_ENV
           echo 'EOF' >> $GITHUB_ENV
+      - name: Read PR Number From Event Object
+        id: pr
+        run: echo "PR_NUMBER=${{ fromJSON(env.EVENT_JSON).number }}" >> $GITHUB_ENV
+      - name: Predict Deployment URL
+        id: url
+        # Replace dots in the repo name with the plus sign
+        run: |
+          REPO=$(echo ${{ github.repository }} | sed 's/\./+/g')
+          echo "EXPECTED_URL=https://app.uffizzi.com/github.com/$REPO/pull/$PR_NUMBER" >> $GITHUB_ENV
+
+      - name: Re-Render Compose File
+        run: |
+          OAUTH_JSON_BASE64=${{ secrets.OAUTH_JSON_BASE64 }}
+          export OAUTH_JSON_BASE64
+          envsubst '${OAUTH_JSON_BASE64} ${EXPECTED_URL}' < docker-compose.rendered.yml > docker-compose.uffizzi.yml
+          # cat docker-compose.uffizzi.yml
+
       - name: Hash Rendered Compose File
         id: hash
         # If the previous workflow was triggered by a PR close event, we will not have a compose file artifact.
         if: ${{ fromJSON(env.EVENT_JSON).action != 'closed' }}
-        run: echo "COMPOSE_FILE_HASH=$(md5sum docker-compose.rendered.yml | awk '{ print $1 }')" >> $GITHUB_ENV
+        run: echo "COMPOSE_FILE_HASH=$(md5sum docker-compose.uffizzi.yml | awk '{ print $1 }')" >> $GITHUB_ENV
       - name: Cache Rendered Compose File
         if: ${{ fromJSON(env.EVENT_JSON).action != 'closed' }}
         uses: actions/cache@v3
         with:
-          path: docker-compose.rendered.yml
+          path: docker-compose.uffizzi.yml
           key: ${{ env.COMPOSE_FILE_HASH }}
 
-      - name: Read PR Number From Event Object
-        id: pr
-        run: echo "PR_NUMBER=${{ fromJSON(env.EVENT_JSON).number }}" >> $GITHUB_ENV
-
       - name: DEBUG - Print Job Outputs
         if: ${{ runner.debug }}
         run: |
@@ -80,7 +93,7 @@ jobs:
       # If this workflow was triggered by a PR close event, cache-key will be an empty string
       # and this reusable workflow will delete the preview deployment.
       compose-file-cache-key: ${{ needs.cache-compose-file.outputs.compose-file-cache-key }}
-      compose-file-cache-path: docker-compose.rendered.yml
+      compose-file-cache-path: docker-compose.uffizzi.yml
       server: https://app.uffizzi.com
       pr-number: ${{ needs.cache-compose-file.outputs.pr-number }}
     permissions: