yuxuanhui
66 lines
2.8 KiB
YAML
66 lines
2.8 KiB
YAML
name: Deploy production
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
# Build on the runner; the production Docker daemon is reached only over SSH.
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
IMAGE_PREFIX: ${{ vars.IMAGE_PREFIX }}
|
|
DEPLOY_TAG: ${{ gitea.sha }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- name: Build and push to Gitea Packages
|
|
shell: bash
|
|
env:
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
BUILD_PLATFORM: ${{ vars.BUILD_PLATFORM }}
|
|
run: |
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${IMAGE_PREFIX:?Set IMAGE_PREFIX to registry/owner/image (without a scheme or tag)}"
|
|
: "${DEPLOY_TAG:?Missing commit SHA}"
|
|
: "${REGISTRY_USERNAME:?Set REGISTRY_USERNAME}"
|
|
: "${REGISTRY_PASSWORD:?Set REGISTRY_PASSWORD}"
|
|
registry="${IMAGE_PREFIX%%/*}"
|
|
auth_dir=$(mktemp -d)
|
|
trap 'rm -rf -- "$auth_dir"' EXIT
|
|
export DOCKER_CONFIG="$auth_dir"
|
|
printf '%s' "$REGISTRY_PASSWORD" | docker login "$registry" --username "$REGISTRY_USERNAME" --password-stdin
|
|
unset REGISTRY_PASSWORD
|
|
docker build --pull --load --platform "${BUILD_PLATFORM:-linux/amd64}" \
|
|
--label "org.opencontainers.image.revision=$DEPLOY_TAG" \
|
|
-f Dockerfile.backend -t "$IMAGE_PREFIX-backend:$DEPLOY_TAG" .
|
|
docker build --pull --load --platform "${BUILD_PLATFORM:-linux/amd64}" \
|
|
--label "org.opencontainers.image.revision=$DEPLOY_TAG" \
|
|
-f Dockerfile.frontend -t "$IMAGE_PREFIX-web:$DEPLOY_TAG" .
|
|
docker push "$IMAGE_PREFIX-backend:$DEPLOY_TAG"
|
|
docker push "$IMAGE_PREFIX-web:$DEPLOY_TAG"
|
|
- name: Pull, migrate and deploy on server B
|
|
shell: bash
|
|
env:
|
|
PROD_HOST: ${{ secrets.PROD_HOST }}
|
|
PROD_PORT: ${{ secrets.PROD_PORT }}
|
|
PROD_USER: ${{ secrets.PROD_USER }}
|
|
DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
|
|
PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
|
|
PROD_KNOWN_HOSTS: ${{ secrets.PROD_KNOWN_HOSTS }}
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
|
ADMIN_PASSWORD: ${{ secrets.ADMIN_PASSWORD }}
|
|
WQ_EMAIL: ${{ secrets.WQ_EMAIL }}
|
|
WQ_PASSWORD: ${{ secrets.WQ_PASSWORD }}
|
|
ENCRYPTION_KEY: ${{ secrets.ENCRYPTION_KEY }}
|
|
ADMIN_USERNAME: ${{ vars.ADMIN_USERNAME }}
|
|
PUBLIC_ORIGIN: ${{ vars.PUBLIC_ORIGIN }}
|
|
MCP_ENABLED: ${{ vars.MCP_ENABLED }}
|
|
run: bash scripts/deploy-remote.sh
|