ci: deploy the verified local image

Build and test the Next.js application once with persistent BuildKit caches, smoke-test the immutable runtime image, and activate that same image through the shared production Docker daemon with serialized rollback-safe deployment.

.gitea/buildkitd.toml

@@ -0,0 +1,2 @@
+[worker.oci]
+  max-parallelism = 1

.gitea/workflows/ci-cd.yml

@@ -12,68 +12,80 @@ on:
 jobs:
   verify:
     name: Verify production build
-    runs-on: ubuntu-latest
+    if: gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository
+    runs-on: portfolio-ci
     timeout-minutes: 15
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-
-      - name: Install dependencies
-        run: |
-          npm ci \
-            --registry="https://package-mirror.liara.ir/repository/npm/" \
-            --replace-registry-host=registry.npmjs.org \
-            --include=optional
-
-      - name: Lint
-        run: npm run lint
-
-      - name: Type-check
-        run: npm run typecheck
-
-      - name: Build standalone Next.js application
-        run: npm run build
-
-      - name: Test standalone runtime
-        run: npm test
-
-      - name: Audit production dependencies
-        run: |
-          npm audit \
-            --registry="https://package-mirror.liara.ir/repository/npm/" \
-            --audit-level=high
-
-  deploy:
-    name: Deploy production
-    needs: verify
-    if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
     env:
-      RELEASE_ID: ${{ gitea.sha }}
-      DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
-      DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
-      DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
-      DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
-      DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
-      SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+      BUILDER_NAME: portfolio-builder
+      VERIFY_IMAGE: portfolio-verify:${{ gitea.sha }}
+      RUNTIME_IMAGE: amiirkhl-portfolio:${{ gitea.sha }}
+      NPM_REGISTRY: https://package-mirror.liara.ir/repository/npm/
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
 
-      - name: Configure SSH
+      - name: Prepare persistent BuildKit builder
         shell: bash
+        run: |
+          set -Eeuo pipefail
+          if ! docker buildx inspect "$BUILDER_NAME" >/dev/null 2>&1; then
+            docker buildx create \
+              --name "$BUILDER_NAME" \
+              --driver docker-container \
+              --buildkitd-config .gitea/buildkitd.toml
+          fi
+          docker buildx use "$BUILDER_NAME"
+          docker buildx inspect --bootstrap
+
+      - name: Verify application once
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          docker buildx build \
+            --builder "$BUILDER_NAME" \
+            --target verification \
+            --build-arg "NPM_REGISTRY=$NPM_REGISTRY" \
+            --tag "$VERIFY_IMAGE" \
+            --load \
+            --progress plain \
+            .
+
+      - name: Audit dependencies
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          docker run --rm "$VERIFY_IMAGE" \
+            npm audit \
+              --registry="$NPM_REGISTRY" \
+              --audit-level=high
+
+      - name: Create immutable runtime image
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          docker buildx build \
+            --builder "$BUILDER_NAME" \
+            --target runtime \
+            --build-arg "NPM_REGISTRY=$NPM_REGISTRY" \
+            --tag "$RUNTIME_IMAGE" \
+            --load \
+            --progress plain \
+            .
+
+      - name: Smoke-test runtime image
+        shell: bash
+        run: bash scripts/smoke-container.sh "$RUNTIME_IMAGE"
+
+      - name: Configure deployment SSH
+        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
+        shell: bash
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+          SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
         run: |
           set -Eeuo pipefail
           : "${DEPLOY_HOST:?DEPLOY_HOST secret is required}"
-          : "${DEPLOY_USER:?DEPLOY_USER secret is required}"
-          : "${DEPLOY_PATH:?DEPLOY_PATH secret is required}"
           : "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS secret is required}"
           : "${SSH_PRIVATE_KEY:?DEPLOY_SSH_KEY secret is required}"
 
@@ -83,41 +95,56 @@ jobs:
           printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
           chmod 600 "$HOME/.ssh/known_hosts"
 
-      - name: Package release
-        shell: bash
-        run: |
-          set -Eeuo pipefail
-          git archive \
-            --format=tar.gz \
-            --output="$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \
-            HEAD
-
-      - name: Upload and activate release
+      - name: Upload release manifest
+        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
         shell: bash
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
         run: |
           set -Eeuo pipefail
+          : "${DEPLOY_USER:?DEPLOY_USER secret is required}"
           DEPLOY_PORT="${DEPLOY_PORT:-22}"
-          remote_archive="/tmp/portfolio-$RELEASE_ID.tar.gz"
-          ssh_options=(
-            -i "$HOME/.ssh/deploy_key"
-            -o BatchMode=yes
-            -o StrictHostKeyChecking=yes
-            -p "$DEPLOY_PORT"
-          )
-
           scp \
             -i "$HOME/.ssh/deploy_key" \
             -o BatchMode=yes \
             -o StrictHostKeyChecking=yes \
             -P "$DEPLOY_PORT" \
-            "$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \
-            "$DEPLOY_USER@$DEPLOY_HOST:$remote_archive"
+            compose.yaml \
+            "$DEPLOY_USER@$DEPLOY_HOST:/tmp/portfolio-${{ gitea.sha }}-compose.yaml"
 
+      - name: Activate verified image
+        if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
+        shell: bash
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+        run: |
+          set -Eeuo pipefail
+          : "${DEPLOY_PATH:?DEPLOY_PATH secret is required}"
+          DEPLOY_PORT="${DEPLOY_PORT:-22}"
+          remote_compose="/tmp/portfolio-${{ gitea.sha }}-compose.yaml"
           printf -v remote_command \
-            'bash -s -- %q %q %q' \
-            "$DEPLOY_PATH" "$RELEASE_ID" "$remote_archive"
+            'bash -s -- %q %q %q %q %q' \
+            "$DEPLOY_PATH" \
+            "${{ gitea.sha }}" \
+            "$RUNTIME_IMAGE" \
+            "${{ gitea.run_number }}" \
+            "$remote_compose"
 
-          ssh "${ssh_options[@]}" \
+          ssh \
+            -i "$HOME/.ssh/deploy_key" \
+            -o BatchMode=yes \
+            -o StrictHostKeyChecking=yes \
+            -p "$DEPLOY_PORT" \
             "$DEPLOY_USER@$DEPLOY_HOST" \
             "$remote_command" \
             < scripts/deploy-release.sh
+
+      - name: Remove temporary verification image
+        if: always()
+        shell: bash
+        run: docker image rm "$VERIFY_IMAGE" >/dev/null 2>&1 || true