feat(ci): deploy verified releases with rollback
This commit is contained in:
115
.gitea/workflows/ci-cd.yml
Normal file
115
.gitea/workflows/ci-cd.yml
Normal file
@@ -0,0 +1,115 @@
|
|||||||
|
name: Test and deploy
|
||||||
|
|
||||||
|
on:
|
||||||
|
pull_request:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
workflow_dispatch:
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
verify:
|
||||||
|
name: Verify production build
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
timeout-minutes: 15
|
||||||
|
steps:
|
||||||
|
- name: Check out repository
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Set up Node.js
|
||||||
|
uses: actions/setup-node@v4
|
||||||
|
with:
|
||||||
|
node-version: 22
|
||||||
|
cache: npm
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
run: npm ci
|
||||||
|
|
||||||
|
- name: Lint
|
||||||
|
run: npm run lint
|
||||||
|
|
||||||
|
- name: Type-check
|
||||||
|
run: npm run typecheck
|
||||||
|
|
||||||
|
- name: Build static site
|
||||||
|
run: npm run build
|
||||||
|
|
||||||
|
- name: Test static export
|
||||||
|
run: npm test
|
||||||
|
|
||||||
|
- name: Audit production dependencies
|
||||||
|
run: npm audit --omit=dev --audit-level=high
|
||||||
|
|
||||||
|
deploy:
|
||||||
|
name: Deploy production
|
||||||
|
needs: verify
|
||||||
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
timeout-minutes: 20
|
||||||
|
environment: production
|
||||||
|
env:
|
||||||
|
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
||||||
|
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
||||||
|
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
||||||
|
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
|
||||||
|
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
||||||
|
SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||||
|
steps:
|
||||||
|
- name: Check out repository
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Configure SSH
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
set -Eeuo pipefail
|
||||||
|
: "${DEPLOY_HOST:?DEPLOY_HOST secret is required}"
|
||||||
|
: "${DEPLOY_USER:?DEPLOY_USER secret is required}"
|
||||||
|
: "${DEPLOY_PATH:?DEPLOY_PATH secret is required}"
|
||||||
|
: "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS secret is required}"
|
||||||
|
: "${SSH_PRIVATE_KEY:?DEPLOY_SSH_KEY secret is required}"
|
||||||
|
DEPLOY_PORT="${DEPLOY_PORT:-22}"
|
||||||
|
echo "DEPLOY_PORT=$DEPLOY_PORT" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
|
install -d -m 700 "$HOME/.ssh"
|
||||||
|
printf '%s\n' "$SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key"
|
||||||
|
chmod 600 "$HOME/.ssh/deploy_key"
|
||||||
|
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
|
||||||
|
chmod 600 "$HOME/.ssh/known_hosts"
|
||||||
|
|
||||||
|
- name: Package release
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
set -Eeuo pipefail
|
||||||
|
git archive \
|
||||||
|
--format=tar.gz \
|
||||||
|
--output="$RUNNER_TEMP/portfolio-$GITHUB_SHA.tar.gz" \
|
||||||
|
HEAD
|
||||||
|
|
||||||
|
- name: Upload and activate release
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
set -Eeuo pipefail
|
||||||
|
remote_archive="/tmp/portfolio-$GITHUB_SHA.tar.gz"
|
||||||
|
ssh_options=(
|
||||||
|
-i "$HOME/.ssh/deploy_key"
|
||||||
|
-o BatchMode=yes
|
||||||
|
-o StrictHostKeyChecking=yes
|
||||||
|
-p "$DEPLOY_PORT"
|
||||||
|
)
|
||||||
|
|
||||||
|
scp \
|
||||||
|
-i "$HOME/.ssh/deploy_key" \
|
||||||
|
-o BatchMode=yes \
|
||||||
|
-o StrictHostKeyChecking=yes \
|
||||||
|
-P "$DEPLOY_PORT" \
|
||||||
|
"$RUNNER_TEMP/portfolio-$GITHUB_SHA.tar.gz" \
|
||||||
|
"$DEPLOY_USER@$DEPLOY_HOST:$remote_archive"
|
||||||
|
|
||||||
|
printf -v remote_command \
|
||||||
|
'bash -s -- %q %q %q' \
|
||||||
|
"$DEPLOY_PATH" "$GITHUB_SHA" "$remote_archive"
|
||||||
|
|
||||||
|
ssh "${ssh_options[@]}" \
|
||||||
|
"$DEPLOY_USER@$DEPLOY_HOST" \
|
||||||
|
"$remote_command" \
|
||||||
|
< scripts/deploy-release.sh
|
||||||
114
scripts/deploy-release.sh
Normal file
114
scripts/deploy-release.sh
Normal file
@@ -0,0 +1,114 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -Eeuo pipefail
|
||||||
|
|
||||||
|
deploy_root="${1:?deployment root is required}"
|
||||||
|
release_id="${2:?release id is required}"
|
||||||
|
archive="${3:?release archive is required}"
|
||||||
|
|
||||||
|
if [[ "$deploy_root" != /* || "$deploy_root" == "/" ]]; then
|
||||||
|
echo "DEPLOY_PATH must be an absolute directory other than /." >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! "$release_id" =~ ^[0-9a-f]{7,64}$ ]]; then
|
||||||
|
echo "The release id must be a Git commit SHA." >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -f "$archive" ]]; then
|
||||||
|
echo "Release archive not found: $archive" >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
releases_dir="$deploy_root/releases"
|
||||||
|
release_dir="$releases_dir/$release_id"
|
||||||
|
current_link="$deploy_root/current"
|
||||||
|
staging_dir="$releases_dir/.incoming-$release_id-$$"
|
||||||
|
|
||||||
|
cleanup() {
|
||||||
|
rm -f -- "$archive"
|
||||||
|
if [[ -d "$staging_dir" ]]; then
|
||||||
|
rm -rf -- "$staging_dir"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
trap cleanup EXIT
|
||||||
|
|
||||||
|
mkdir -p -- "$releases_dir"
|
||||||
|
|
||||||
|
if [[ ! -d "$release_dir" ]]; then
|
||||||
|
mkdir -- "$staging_dir"
|
||||||
|
tar -xzf "$archive" -C "$staging_dir"
|
||||||
|
mv -- "$staging_dir" "$release_dir"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -f "$release_dir/compose.yaml" ]]; then
|
||||||
|
echo "The release does not contain compose.yaml." >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
previous_release=""
|
||||||
|
if [[ -L "$current_link" ]]; then
|
||||||
|
previous_release="$(readlink -f -- "$current_link" || true)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
compose() {
|
||||||
|
local directory="$1"
|
||||||
|
shift
|
||||||
|
docker compose \
|
||||||
|
--project-name portfolio \
|
||||||
|
--file "$directory/compose.yaml" \
|
||||||
|
"$@"
|
||||||
|
}
|
||||||
|
|
||||||
|
wait_until_healthy() {
|
||||||
|
local directory="$1"
|
||||||
|
local container_id status
|
||||||
|
|
||||||
|
container_id="$(compose "$directory" ps -q static-site)"
|
||||||
|
if [[ -z "$container_id" ]]; then
|
||||||
|
echo "The static-site container was not created." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
for _ in {1..30}; do
|
||||||
|
status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")"
|
||||||
|
case "$status" in
|
||||||
|
healthy|running)
|
||||||
|
return 0
|
||||||
|
;;
|
||||||
|
unhealthy|exited|dead)
|
||||||
|
echo "Container entered state: $status" >&2
|
||||||
|
return 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
sleep 2
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "Container did not become healthy within 60 seconds." >&2
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
deploy() {
|
||||||
|
local directory="$1"
|
||||||
|
compose "$directory" config --quiet
|
||||||
|
compose "$directory" up --detach --build --remove-orphans
|
||||||
|
wait_until_healthy "$directory"
|
||||||
|
}
|
||||||
|
|
||||||
|
if deploy "$release_dir"; then
|
||||||
|
new_link="$deploy_root/.current-$release_id-$$"
|
||||||
|
ln -s -- "$release_dir" "$new_link"
|
||||||
|
mv -Tf -- "$new_link" "$current_link"
|
||||||
|
echo "Deployment succeeded: $release_id"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Deployment failed; attempting rollback." >&2
|
||||||
|
if [[ -n "$previous_release" && -f "$previous_release/compose.yaml" ]]; then
|
||||||
|
deploy "$previous_release"
|
||||||
|
echo "Rollback succeeded: $(basename "$previous_release")" >&2
|
||||||
|
else
|
||||||
|
echo "No previous release is available to roll back to." >&2
|
||||||
|
fi
|
||||||
|
|
||||||
|
exit 1
|
||||||
Reference in New Issue
Block a user