From b4426400f35e64719093269927f4d60d1bd0012c Mon Sep 17 00:00:00 2001 From: Amirhossein Khalili Date: Thu, 10 Sep 2026 11:04:12 +0330 Subject: [PATCH] ci: align deployment workflow with Gitea Use native Gitea contexts, audit the full dependency tree, and document the runner and branch-protection requirements needed for reliable deployments. --- .gitea/workflows/ci-cd.yml | 19 ++++++++++--------- DEPLOYMENT.md | 12 ++++++++++++ 2 files changed, 22 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml index 8de12e7..4943d5e 100644 --- a/.gitea/workflows/ci-cd.yml +++ b/.gitea/workflows/ci-cd.yml @@ -2,6 +2,8 @@ name: Test and deploy on: pull_request: + branches: + - main push: branches: - main @@ -38,16 +40,16 @@ jobs: run: npm test - name: Audit production dependencies - run: npm audit --omit=dev --audit-level=high + run: npm audit --audit-level=high deploy: name: Deploy production needs: verify - if: github.event_name == 'push' && github.ref == 'refs/heads/main' + if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' runs-on: ubuntu-latest timeout-minutes: 20 - environment: production env: + RELEASE_ID: ${{ gitea.sha }} DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} DEPLOY_USER: ${{ secrets.DEPLOY_USER }} DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }} @@ -67,8 +69,6 @@ jobs: : "${DEPLOY_PATH:?DEPLOY_PATH secret is required}" : "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS secret is required}" : "${SSH_PRIVATE_KEY:?DEPLOY_SSH_KEY secret is required}" - DEPLOY_PORT="${DEPLOY_PORT:-22}" - echo "DEPLOY_PORT=$DEPLOY_PORT" >> "$GITHUB_ENV" install -d -m 700 "$HOME/.ssh" printf '%s\n' "$SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key" @@ -82,14 +82,15 @@ jobs: set -Eeuo pipefail git archive \ --format=tar.gz \ - --output="$RUNNER_TEMP/portfolio-$GITHUB_SHA.tar.gz" \ + --output="$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \ HEAD - name: Upload and activate release shell: bash run: | set -Eeuo pipefail - remote_archive="/tmp/portfolio-$GITHUB_SHA.tar.gz" + DEPLOY_PORT="${DEPLOY_PORT:-22}" + remote_archive="/tmp/portfolio-$RELEASE_ID.tar.gz" ssh_options=( -i "$HOME/.ssh/deploy_key" -o BatchMode=yes @@ -102,12 +103,12 @@ jobs: -o BatchMode=yes \ -o StrictHostKeyChecking=yes \ -P "$DEPLOY_PORT" \ - "$RUNNER_TEMP/portfolio-$GITHUB_SHA.tar.gz" \ + "$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \ "$DEPLOY_USER@$DEPLOY_HOST:$remote_archive" printf -v remote_command \ 'bash -s -- %q %q %q' \ - "$DEPLOY_PATH" "$GITHUB_SHA" "$remote_archive" + "$DEPLOY_PATH" "$RELEASE_ID" "$remote_archive" ssh "${ssh_options[@]}" \ "$DEPLOY_USER@$DEPLOY_HOST" \ diff --git a/DEPLOYMENT.md b/DEPLOYMENT.md index ab114b0..f80f113 100644 --- a/DEPLOYMENT.md +++ b/DEPLOYMENT.md @@ -9,6 +9,18 @@ Releases are stored in `/releases/`. The `current` symlink is changed only after the new container is healthy. If startup fails, the deployment script automatically rebuilds and starts the previous release. +## Gitea Actions setup + +Enable **Repository Actions** in the repository settings and register a trusted +Gitea Runner. The workflow uses the `ubuntu-latest` label; that runner image must +provide Bash, Git, `tar`, OpenSSH (`ssh` and `scp`), and standard GNU utilities. +Node.js 22 is installed by the workflow. + +After the first successful verification run, protect `main` in Gitea and make +the **Verify production build** status check required. This prevents a pull +request from merging when linting, type-checking, tests, the production build, +or the dependency audit fails. + ## Gitea repository secrets Add these secrets under the repository's **Settings > Actions > Secrets**: