MLOps/.gitea/workflows/mlops-pipeline.yml
Alexis Bruneteau 662d1a3b8f Configure DVC credentials explicitly in CI/CD pipeline
DVC needs credentials to be configured via 'dvc remote modify' command
rather than just environment variables. This fixes 403 Forbidden errors
when accessing MinIO/S3 storage.

Changes:
- Added dvc remote modify commands to set access_key_id and secret_access_key
- Applied to both pull and push operations in test and train jobs
- Added .dvc/config.local to .gitignore to prevent credential leaks

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-01 18:45:29 +02:00

127 lines
3.7 KiB
YAML

name: MLOps CI/CD Pipeline
on:
push:
branches: [main, dev]
pull_request:
branches: [main]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup Python
uses: actions/setup-python@v4
with:
python-version: '3.12'
- name: Cache Poetry dependencies
uses: actions/cache@v3
with:
path: |
~/.cache/pypoetry
~/.cache/pip
key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
restore-keys: |
${{ runner.os }}-poetry-
- name: Install Poetry
run: pip install poetry
- name: Install dependencies
run: poetry install --no-interaction --no-root
- name: Setup DVC
run: |
poetry run dvc remote modify minio access_key_id $AWS_ACCESS_KEY_ID
poetry run dvc remote modify minio secret_access_key $AWS_SECRET_ACCESS_KEY
poetry run dvc remote list
poetry run dvc pull || echo "DVC pull failed, continuing..."
env:
AWS_ACCESS_KEY_ID: ${{ secrets.DVC_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.DVC_PASSWORD }}
- name: Start API server
run: |
poetry run uvicorn src.api.main:app --host 0.0.0.0 --port 8000 &
sleep 10
- name: Run unit tests
run: poetry run pytest tests/ --cov=src --cov-report=xml
train:
needs: test
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v3
- name: Setup Python
uses: actions/setup-python@v4
with:
python-version: '3.12'
- name: Cache Poetry dependencies
uses: actions/cache@v3
with:
path: |
~/.cache/pypoetry
~/.cache/pip
key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
restore-keys: |
${{ runner.os }}-poetry-
- name: Install Poetry
run: pip install poetry
- name: Install dependencies
run: poetry install --no-interaction --no-root
- name: Setup DVC
run: |
poetry run dvc remote modify minio access_key_id $AWS_ACCESS_KEY_ID
poetry run dvc remote modify minio secret_access_key $AWS_SECRET_ACCESS_KEY
poetry run dvc remote list
poetry run dvc pull || echo "DVC pull failed, continuing..."
env:
AWS_ACCESS_KEY_ID: ${{ secrets.DVC_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.DVC_PASSWORD }}
- name: Run DVC pipeline
run: poetry run dvc repro
env:
MLFLOW_TRACKING_URI: ${{ secrets.MLFLOW_TRACKING_URI }}
MLFLOW_TRACKING_USERNAME: ${{ secrets.MLFLOW_TRACKING_USERNAME }}
MLFLOW_TRACKING_PASSWORD: ${{ secrets.MLFLOW_TRACKING_PASSWORD }}
- name: Push DVC changes
run: |
poetry run dvc remote modify minio access_key_id $AWS_ACCESS_KEY_ID
poetry run dvc remote modify minio secret_access_key $AWS_SECRET_ACCESS_KEY
poetry run dvc push || echo "DVC push failed, continuing..."
env:
AWS_ACCESS_KEY_ID: ${{ secrets.DVC_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.DVC_PASSWORD }}
deploy:
needs: train
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v3
- name: Build Docker image
run: |
docker build -t csgo-mlops:${{ github.sha }} .
docker tag csgo-mlops:${{ github.sha }} csgo-mlops:latest
- name: Push to registry
run: |
docker push csgo-mlops:${{ github.sha }}
docker push csgo-mlops:latest
- name: Deploy to Kubernetes
run: kubectl apply -f kubernetes/deployment.yml