Using Branch Deployments with GitHub Actions#

This guide is applicable to Dagster Cloud.

In this guide, we'll walk you through setting up Branch Deployments with GitHub Actions.

Using this approach to branch deployments may be a good fit if:

You use GitHub for version control
You want Dagster to fully automate Branch Deployments

If you don't use GitHub for version control or want full control over your setup, check out the Branch deployments with the dagster-cloud CLI guide.

Prerequisites#

To complete the steps in this guide, you'll need:

Organization Admin permissions in Dagster Cloud
The ability to run a new agent in your infrastructure. This isn't required if you're using Serverless deployment.
The ability to configure GitHub Actions for your repository. This isn't required if you used the Dagster Cloud GitHub app to connect your repository as a code location.

Step 1: Generate a Dagster Cloud agent token#

In this step, you'll generate a token for the Dagster Cloud agent. The Dagster Cloud agent will use this to authenticate to the agent API.

Sign in to your Dagster Cloud instance.
Click the user menu (your icon) > Cloud settings.
In the Cloud settings page, click the Tokens tab.
Click the + Create agent token button.
After the token has been created, click Reveal token.

Keep the token somewhere handy - you'll need it to complete the setup.

Step 2: Create and configure an agent#

If using Serverless deployment, this step isn't required.

While you can use your existing production agent, we recommend creating a dedicated branch deployment agent. This ensures that your production instance isn't negatively impacted by the workload associated with branch deployments.

AMAZON ECS AGENTS

Deploy an ECS agent to serve your branch deployments. Follow the ECS agent setup guide, making sure to set the Enable Branch Deployments parameter if using the CloudFormation template. If you are running an existing agent, follow the upgrade guide to ensure your template is up-to-date. Then, turn on the Enable Branch Deployments parameter.
Create a private Amazon Elastic Registry (ECR) repository. Refer to the AWS ECR documentation for instructions.
After the repository has been created, navigate back to the list of ECR repositories.
In the list, locate the repository and its URI:
Create an IAM user. This user must:
- Have push access to the ECR repository, and
- Have programmatic access to AWS using an access key
After the user is created, save the Access key ID and Secret access key values shown on the confirmation page:

DOCKER AGENTS

Set up a new Docker agent. Refer to the Docker agent setup guide for instructions.

After the agent is set up, modify the dagster.yaml file as follows:

Set the dagster_cloud_api.branch_deployments field to true
Remove any deployment field(s)

For example:


# dagster.yaml

instance_class:
  module: dagster_cloud.instance
  class: DagsterCloudAgentInstance

dagster_cloud_api:
  agent_token: <YOUR_AGENT_TOKEN>
  branch_deployments: true ## true enables branch deployments

user_code_launcher:
  module: dagster_cloud.workspace.docker
  class: DockerUserCodeLauncher
  config:
    networks:
      - dagster_cloud_agent
    server_ttl:
      enabled: true
      ttl_seconds: 7200 #2 hours

KUBERNETES AGENTS

Set up a new Kubernetes agent. Refer to the Kubernetes agent setup guide for instructions.

After the agent is set up, modify your Helm values file to include the following:


dagsterCloud:
  branchDeployments: true
---
workspace:
  serverTTL:
    enabled: true
    ttlSeconds: 7200

Step 3: Add GitHub workflow files to your repository#

If you used the GitHub app to add the repository as a code location, this step isn't required. Skip to the next step.

In this step, you'll add the required GitHub workflow files to your GitHub repository. The files can be found in our Hybrid quickstart repository or Serverless quickstart repository, depending on the agent you are using.

Copy the following files to your repository (the linked files are shown in the Hybrid repo, there are equivalents in the Serverless repo).

In the next step, you'll modify these files to work with your Dagster Cloud setup.

Step 4: Configure the GitHub repository#

In this section, you'll:

Add the agent registry to dagster_cloud.yaml
Configure GitHub Action secrets
Update GitHub Workflow files
Verify Action runs

Step 4.1: Add the agent registry to dagster_cloud.yaml#

If you're using Serverless deployment, this step isn't required. Skip to the next step.

In the dagster_cloud.yaml file, replace build.registry with the registry used by the agent you created in Step 2.

For example:


# dagster_cloud.yaml

locations:
  - location_name: example_location
    code_source:
      python_file: repo.py
    build:
      directory: ./example_location
      registry: 764506304434.dkr.ecr.us-east-1.amazonaws.com/branch-deployment-agent

Step 4.2: Configure GitHub Action secrets#

If you used the GitHub app to add the repository as a code location, this step isn't required.

Want to use secrets in your Dagster code? Check out the Dagster Cloud environment variables and secrets guide for more info.

In the repository, click the Settings tab.
In the Security section of the sidebar, click Secrets > Actions.
Click New repository secret.
In the Name field, enter the name of the secret. For example, API_TOKEN
In the Value field, paste the value of the secret.
Click Add secret.

For Hybrid deployments, repeat steps 3-6 for each of the secrets required for your registry type:

Select the tab for your registry type to view instructions.

Step 4.3: Update GitHub Workflow files#

If you're using Serverless deployment, this step isn't required. Skip to the next step.

In this step, you'll update the GitHub Workflow files in the repository to set up Docker registry access.

In the .github/workflows/deploy.yml and .github/workflows/branch_deployments.yml files, uncomment the step associated with your registry. For example, for an Amazon ECR registry, you'd uncomment the following portion of the workflow files:


steps:
  - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v1
    with:
      aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
      aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      aws-region: ${{ secrets.AWS_REGION }}