yuxuanhui
89 lines
3.8 KiB
YAML
89 lines
3.8 KiB
YAML
name: Deploy production
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
# Build on the runner; the production Docker daemon is reached only over SSH.
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
IMAGE_PREFIX: ${{ vars.IMAGE_PREFIX }}
|
|
DEPLOY_TAG: ${{ gitea.sha }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- name: Set up QEMU for cross-platform builds
|
|
uses: https://github.com/docker/setup-qemu-action@v3
|
|
with:
|
|
platforms: amd64,arm64
|
|
# Gitea does not use the GitHub Actions cache backend.
|
|
cache-image: false
|
|
- name: Build and push to Gitea Packages
|
|
shell: bash
|
|
env:
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
BUILD_PLATFORM: ${{ vars.BUILD_PLATFORM }}
|
|
run: |
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${IMAGE_PREFIX:?Set IMAGE_PREFIX to registry/owner/image (without a scheme or tag)}"
|
|
: "${DEPLOY_TAG:?Missing commit SHA}"
|
|
: "${REGISTRY_USERNAME:?Set REGISTRY_USERNAME}"
|
|
: "${REGISTRY_PASSWORD:?Set REGISTRY_PASSWORD}"
|
|
registry="${IMAGE_PREFIX%%/*}"
|
|
auth_dir=$(mktemp -d)
|
|
builder_name=""
|
|
cleanup() {
|
|
local rc=$?
|
|
if [[ -n "$builder_name" ]]; then
|
|
docker buildx rm "$builder_name" >/dev/null || true
|
|
fi
|
|
rm -rf -- "$auth_dir"
|
|
exit "$rc"
|
|
}
|
|
trap cleanup EXIT
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
export DOCKER_CONFIG="$auth_dir"
|
|
export BUILDX_CONFIG="$auth_dir/buildx"
|
|
printf '%s' "$REGISTRY_PASSWORD" | docker login "$registry" --username "$REGISTRY_USERNAME" --password-stdin
|
|
unset REGISTRY_PASSWORD
|
|
# Create after selecting the isolated config; do not change the runner's default builder.
|
|
builder_name=$(docker buildx create --driver docker-container)
|
|
docker info --format 'Build host: {{.OSType}}/{{.Architecture}}'
|
|
echo "Target platform: ${BUILD_PLATFORM:-linux/amd64}"
|
|
docker buildx inspect "$builder_name" --bootstrap
|
|
docker buildx build --builder "$builder_name" --pull --load --platform "${BUILD_PLATFORM:-linux/amd64}" \
|
|
--label "org.opencontainers.image.revision=$DEPLOY_TAG" \
|
|
-f Dockerfile.backend -t "$IMAGE_PREFIX-backend:$DEPLOY_TAG" .
|
|
docker buildx build --builder "$builder_name" --pull --load --platform "${BUILD_PLATFORM:-linux/amd64}" \
|
|
--label "org.opencontainers.image.revision=$DEPLOY_TAG" \
|
|
-f Dockerfile.frontend -t "$IMAGE_PREFIX-web:$DEPLOY_TAG" .
|
|
docker push "$IMAGE_PREFIX-backend:$DEPLOY_TAG"
|
|
docker push "$IMAGE_PREFIX-web:$DEPLOY_TAG"
|
|
- name: Pull, migrate and deploy on server B
|
|
shell: bash
|
|
env:
|
|
PROD_HOST: ${{ secrets.PROD_HOST }}
|
|
PROD_PORT: ${{ secrets.PROD_PORT }}
|
|
PROD_USER: ${{ secrets.PROD_USER }}
|
|
DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
|
|
PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
|
|
PROD_KNOWN_HOSTS: ${{ secrets.PROD_KNOWN_HOSTS }}
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
|
ADMIN_PASSWORD: ${{ secrets.ADMIN_PASSWORD }}
|
|
WQ_EMAIL: ${{ secrets.WQ_EMAIL }}
|
|
WQ_PASSWORD: ${{ secrets.WQ_PASSWORD }}
|
|
ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
|
|
ADMIN_USERNAME: ${{ vars.ADMIN_USERNAME }}
|
|
PUBLIC_ORIGIN: ${{ vars.PUBLIC_ORIGIN }}
|
|
MCP_ENABLED: ${{ vars.MCP_ENABLED }}
|
|
run: bash scripts/deploy-remote.sh
|