chore: deploy once through Compose
This commit is contained in:
@@ -1,150 +1,60 @@
|
||||
name: Test and deploy
|
||||
name: Build and deploy
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
branches: [main]
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
verify:
|
||||
name: Verify production build
|
||||
if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
|
||||
build:
|
||||
name: Production build and types
|
||||
if: gitea.event_name == 'workflow_dispatch' || (gitea.event_name == 'pull_request' && gitea.event.pull_request.head.repo.full_name == gitea.repository)
|
||||
runs-on: portfolio-ci
|
||||
timeout-minutes: 15
|
||||
env:
|
||||
BUILDER_NAME: portfolio-builder
|
||||
VERIFY_IMAGE: portfolio-verify:${{ gitea.sha }}
|
||||
RUNTIME_IMAGE: amiirkhl-portfolio:${{ gitea.sha }}
|
||||
NPM_REGISTRY: https://package-mirror.liara.ir/repository/npm/
|
||||
PORTFOLIO_IMAGE: portfolio-check:${{ gitea.sha }}
|
||||
NPM_REGISTRY: ${{ vars.NPM_REGISTRY }}
|
||||
steps:
|
||||
- name: Check out repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Prepare persistent BuildKit builder
|
||||
shell: bash
|
||||
run: |
|
||||
set -Eeuo pipefail
|
||||
if ! docker buildx inspect "$BUILDER_NAME" >/dev/null 2>&1; then
|
||||
docker buildx create \
|
||||
--name "$BUILDER_NAME" \
|
||||
--driver docker-container \
|
||||
--buildkitd-config .gitea/buildkitd.toml
|
||||
fi
|
||||
docker buildx use "$BUILDER_NAME"
|
||||
docker buildx inspect --bootstrap
|
||||
|
||||
- name: Verify application once
|
||||
shell: bash
|
||||
run: |
|
||||
set -Eeuo pipefail
|
||||
docker buildx build \
|
||||
--builder "$BUILDER_NAME" \
|
||||
--target verification \
|
||||
--build-arg "NPM_REGISTRY=$NPM_REGISTRY" \
|
||||
--tag "$VERIFY_IMAGE" \
|
||||
--load \
|
||||
--progress plain \
|
||||
.
|
||||
|
||||
- name: Audit dependencies
|
||||
shell: bash
|
||||
run: |
|
||||
set -Eeuo pipefail
|
||||
docker run --rm "$VERIFY_IMAGE" \
|
||||
npm audit \
|
||||
--registry="$NPM_REGISTRY" \
|
||||
--audit-level=high
|
||||
|
||||
- name: Create immutable runtime image
|
||||
shell: bash
|
||||
run: |
|
||||
set -Eeuo pipefail
|
||||
docker buildx build \
|
||||
--builder "$BUILDER_NAME" \
|
||||
--target runtime \
|
||||
--build-arg "NPM_REGISTRY=$NPM_REGISTRY" \
|
||||
--tag "$RUNTIME_IMAGE" \
|
||||
--load \
|
||||
--progress plain \
|
||||
.
|
||||
|
||||
- name: Smoke-test runtime image
|
||||
shell: bash
|
||||
run: bash scripts/smoke-container.sh "$RUNTIME_IMAGE"
|
||||
|
||||
- name: Configure deployment SSH
|
||||
if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
|
||||
shell: bash
|
||||
env:
|
||||
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
||||
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
||||
SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||
run: |
|
||||
set -Eeuo pipefail
|
||||
: "${DEPLOY_HOST:?DEPLOY_HOST secret is required}"
|
||||
: "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS secret is required}"
|
||||
: "${SSH_PRIVATE_KEY:?DEPLOY_SSH_KEY secret is required}"
|
||||
|
||||
install -d -m 700 "$HOME/.ssh"
|
||||
printf '%s\n' "$SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key"
|
||||
chmod 600 "$HOME/.ssh/deploy_key"
|
||||
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
|
||||
chmod 600 "$HOME/.ssh/known_hosts"
|
||||
|
||||
- name: Upload release manifest
|
||||
if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
|
||||
shell: bash
|
||||
env:
|
||||
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
||||
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
||||
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
||||
run: |
|
||||
set -Eeuo pipefail
|
||||
: "${DEPLOY_USER:?DEPLOY_USER secret is required}"
|
||||
DEPLOY_PORT="${DEPLOY_PORT:-22}"
|
||||
scp \
|
||||
-i "$HOME/.ssh/deploy_key" \
|
||||
-o BatchMode=yes \
|
||||
-o StrictHostKeyChecking=yes \
|
||||
-P "$DEPLOY_PORT" \
|
||||
compose.yaml \
|
||||
"$DEPLOY_USER@$DEPLOY_HOST:/tmp/portfolio-${{ gitea.sha }}-compose.yaml"
|
||||
|
||||
- name: Activate verified image
|
||||
if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
|
||||
shell: bash
|
||||
env:
|
||||
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
||||
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
|
||||
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
||||
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
||||
run: |
|
||||
set -Eeuo pipefail
|
||||
: "${DEPLOY_PATH:?DEPLOY_PATH secret is required}"
|
||||
DEPLOY_PORT="${DEPLOY_PORT:-22}"
|
||||
remote_compose="/tmp/portfolio-${{ gitea.sha }}-compose.yaml"
|
||||
printf -v remote_command \
|
||||
'bash -s -- %q %q %q %q %q' \
|
||||
"$DEPLOY_PATH" \
|
||||
"${{ gitea.sha }}" \
|
||||
"$RUNTIME_IMAGE" \
|
||||
"${{ gitea.run_number }}" \
|
||||
"$remote_compose"
|
||||
|
||||
ssh \
|
||||
-i "$HOME/.ssh/deploy_key" \
|
||||
-o BatchMode=yes \
|
||||
-o StrictHostKeyChecking=yes \
|
||||
-p "$DEPLOY_PORT" \
|
||||
"$DEPLOY_USER@$DEPLOY_HOST" \
|
||||
"$remote_command" \
|
||||
< scripts/deploy-release.sh
|
||||
|
||||
- name: Remove temporary verification image
|
||||
- uses: actions/checkout@v4
|
||||
- name: Compile once, including TypeScript validation
|
||||
run: docker compose build
|
||||
- name: Remove check image
|
||||
if: always()
|
||||
run: docker image rm "$PORTFOLIO_IMAGE" >/dev/null 2>&1 || true
|
||||
|
||||
deploy:
|
||||
name: Deploy with Compose
|
||||
if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
|
||||
runs-on: portfolio-ci
|
||||
timeout-minutes: 15
|
||||
env:
|
||||
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
||||
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
||||
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
||||
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
|
||||
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
||||
REVISION: ${{ gitea.sha }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Update checkout and build on the server
|
||||
shell: bash
|
||||
run: docker image rm "$VERIFY_IMAGE" >/dev/null 2>&1 || true
|
||||
run: |
|
||||
set -Eeuo pipefail
|
||||
: "${DEPLOY_HOST:?Missing DEPLOY_HOST}"
|
||||
: "${DEPLOY_USER:?Missing DEPLOY_USER}"
|
||||
: "${DEPLOY_PATH:?Missing DEPLOY_PATH}"
|
||||
: "${DEPLOY_SSH_KEY:?Missing DEPLOY_SSH_KEY}"
|
||||
: "${DEPLOY_KNOWN_HOSTS:?Missing DEPLOY_KNOWN_HOSTS}"
|
||||
ssh_directory="$(mktemp -d)"
|
||||
trap 'rm -rf -- "$ssh_directory"' EXIT
|
||||
printf '%s\n' "$DEPLOY_SSH_KEY" > "$ssh_directory/key"
|
||||
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$ssh_directory/known_hosts"
|
||||
chmod 600 "$ssh_directory/key"
|
||||
printf -v command 'bash -s -- %q %q' "$DEPLOY_PATH" "$REVISION"
|
||||
ssh -i "$ssh_directory/key" -p "${DEPLOY_PORT:-22}" \
|
||||
-o BatchMode=yes -o StrictHostKeyChecking=yes \
|
||||
-o "UserKnownHostsFile=$ssh_directory/known_hosts" \
|
||||
"$DEPLOY_USER@$DEPLOY_HOST" "$command" < scripts/deploy-release.sh
|
||||
|
||||
Reference in New Issue
Block a user