Deploying a live Datasette demo when the tests pass#

I’ve implemented this pattern a bunch of times now - here’s the version I’ve settled on for my datasette-auth0 plugin repository.

For publishing to Cloud Run, it needs two GitHub Actions secrets to be configured: GCP_SA_EMAIL and GCP_SA_KEY.

See below for publishing to Vercel.

In .github/workflows/test.yml:

1
name: Test
2

3
on: [push]
4

5
jobs:
6
  test:
7
    runs-on: ubuntu-latest
8
    strategy:
9
      matrix:
10
        python-version: ["3.7", "3.8", "3.9", "3.10", "3.11"]
11
    steps:
12
    - uses: actions/checkout@v3
13
    - name: Set up Python ${{ matrix.python-version }}
14
      uses: actions/setup-python@v4
15
      with:
16
        python-version: ${{ matrix.python-version }}
17
    - uses: actions/cache@v3
18
      name: Configure pip caching
19
      with:
20
        path: ~/.cache/pip
21
        key: ${{ runner.os }}-pip-${{ hashFiles('**/setup.py') }}
22
        restore-keys: |
23
          ${{ runner.os }}-pip-
24
    - name: Install dependencies
25
      run: |
26
        pip install -e '.[test]'
27
    - name: Run tests
28
      run: |
29
        pytest
30
  deploy_demo:
31
    runs-on: ubuntu-latest
32
    needs: [test]
33
    if: github.ref == 'refs/heads/main'
34
    steps:
35
    - uses: actions/checkout@v3
36
    - name: Set up Python 3.11
37
      uses: actions/setup-python@v4
38
      with:
39
        python-version: "3.11"
40
        cache: pip
41
        cache-dependency-path: "**/setup.py"
42
    - name: Install datasette
43
      run: pip install datasette
44
    - name: Set up Cloud Run
45
      uses: google-github-actions/setup-gcloud@v0
46
      with:
47
        version: '275.0.0'
48
        service_account_email: ${{ secrets.GCP_SA_EMAIL }}
49
        service_account_key: ${{ secrets.GCP_SA_KEY }}
50
    - name: Deploy demo to Cloud Run
51
      env:
52
        CLIENT_SECRET: ${{ secrets.AUTH0_CLIENT_SECRET }}
53
      run: |-
54
        gcloud config set run/region us-central1
55
        gcloud config set project datasette-222320
56
        wget https://latest.datasette.io/fixtures.db
57
        datasette publish cloudrun fixtures.db \
58
        --install https://github.com/simonw/datasette-auth0/archive/$GITHUB_SHA.zip \
59
        --plugin-secret datasette-auth0 domain "datasette.us.auth0.com" \
60
        --plugin-secret datasette-auth0 client_id "n9eaHS0ckIsujoyZNZ1wVgcPevjAcAXn" \
61
        --plugin-secret datasette-auth0 client_secret "$CLIENT_SECRET" \
62
        --about "datasette-auth0" \
63
        --about_url "https://datasette.io/plugins/datasette-auth0" \
64
        --service datasette-auth0-demo

The first job called test runs the Python tests in the repo. The second deploy_demo block is where things get interesting.

1
  deploy_demo:
2
    runs-on: ubuntu-latest
3
    needs: [test]
4
    if: github.ref == 'refs/heads/main'

The needs: [test] bit ensures this only runs if the tests pass first.

if: github.ref == 'refs/heads/main' causes the deploy to only run on pushes to the main branch.

The most interesting bit of the deploy command is this bit:

1
datasette publish cloudrun fixtures.db \
2
--install https://github.com/simonw/datasette-auth0/archive/$GITHUB_SHA.zip \
3
...

$GITHUB_SHA is the commit hash that triggered the wokrflow. The --install line there constructs a URL to the zip archive of that version from the GitHub repository - so that exact version will be treated as a plugin and installed as part of deploying the Datasette demo instance.

Deploying to Vercel#

This example deploys to Vercel instead. The key difference is this:

1
    - name: Install datasette
2
      run: pip install datasette datasette-publish-vercel
3
    - name: Deploy demo to Vercel
4
      env:
5
        VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
6
      run: |-
7
        wget https://latest.datasette.io/fixtures.db
8
        datasette publish vercel fixtures.db \
9
          --project datasette-hashed-urls \
10
          --install https://github.com/simonw/datasette-hashed-urls/archive/$GITHUB_SHA.zip \
11
          --token $VERCEL_TOKEN \
12
          --scope datasette

The --token $VERCEL_TOKEN passes a token created in the Vercel dashboard. I needed --scope datasette here because I was deploying to a Vercel team of that name - if deploying to your personal account you can leave this off.