127 lines
3.7 KiB
YAML
127 lines
3.7 KiB
YAML
name: Test and deploy
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
verify:
|
|
name: Verify production build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
npm ci \
|
|
--registry="https://package-mirror.liara.ir/repository/npm/" \
|
|
--replace-registry-host=registry.npmjs.org \
|
|
--include=optional
|
|
|
|
- name: Verify image optimizer dependency
|
|
run: node -e "const sharp = require('sharp'); if (!sharp.format.webp.output) throw new Error('Sharp WebP output is unavailable')"
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Type-check
|
|
run: npm run typecheck
|
|
|
|
- name: Build standalone Next.js application
|
|
run: npm run build
|
|
|
|
- name: Test standalone runtime
|
|
run: npm test
|
|
|
|
- name: Audit production dependencies
|
|
run: |
|
|
npm audit \
|
|
--registry="https://package-mirror.liara.ir/repository/npm/" \
|
|
--audit-level=high
|
|
|
|
deploy:
|
|
name: Deploy production
|
|
needs: verify
|
|
if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
env:
|
|
RELEASE_ID: ${{ gitea.sha }}
|
|
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
|
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
|
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
|
|
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
|
SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Configure SSH
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
: "${DEPLOY_HOST:?DEPLOY_HOST secret is required}"
|
|
: "${DEPLOY_USER:?DEPLOY_USER secret is required}"
|
|
: "${DEPLOY_PATH:?DEPLOY_PATH secret is required}"
|
|
: "${DEPLOY_KNOWN_HOSTS:?DEPLOY_KNOWN_HOSTS secret is required}"
|
|
: "${SSH_PRIVATE_KEY:?DEPLOY_SSH_KEY secret is required}"
|
|
|
|
install -d -m 700 "$HOME/.ssh"
|
|
printf '%s\n' "$SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key"
|
|
chmod 600 "$HOME/.ssh/deploy_key"
|
|
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
|
|
chmod 600 "$HOME/.ssh/known_hosts"
|
|
|
|
- name: Package release
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
git archive \
|
|
--format=tar.gz \
|
|
--output="$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \
|
|
HEAD
|
|
|
|
- name: Upload and activate release
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
DEPLOY_PORT="${DEPLOY_PORT:-22}"
|
|
remote_archive="/tmp/portfolio-$RELEASE_ID.tar.gz"
|
|
ssh_options=(
|
|
-i "$HOME/.ssh/deploy_key"
|
|
-o BatchMode=yes
|
|
-o StrictHostKeyChecking=yes
|
|
-p "$DEPLOY_PORT"
|
|
)
|
|
|
|
scp \
|
|
-i "$HOME/.ssh/deploy_key" \
|
|
-o BatchMode=yes \
|
|
-o StrictHostKeyChecking=yes \
|
|
-P "$DEPLOY_PORT" \
|
|
"$RUNNER_TEMP/portfolio-$RELEASE_ID.tar.gz" \
|
|
"$DEPLOY_USER@$DEPLOY_HOST:$remote_archive"
|
|
|
|
printf -v remote_command \
|
|
'bash -s -- %q %q %q' \
|
|
"$DEPLOY_PATH" "$RELEASE_ID" "$remote_archive"
|
|
|
|
ssh "${ssh_options[@]}" \
|
|
"$DEPLOY_USER@$DEPLOY_HOST" \
|
|
"$remote_command" \
|
|
< scripts/deploy-release.sh
|