linmeng
1b8d6fcce6
Add database-backed administrators, configurable Alipay packages, idempotent payment settlement and platform reporting. Standardize Gitea workflows on the xiaoxin runner so reviewed staging commits are tested, packaged, and deployed by immutable image digest.
60 lines
2.8 KiB
YAML
60 lines
2.8 KiB
YAML
name: Deploy production (manual only)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: production
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
GITEA_SHA: ${{ gitea.sha }}
|
|
DEPLOY_HOST: 103.117.123.53
|
|
DEPLOY_PORT: '22000'
|
|
DEPLOY_USER: root
|
|
DEPLOY_PATH: /opt/jyotisha-app
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: xiaoxin
|
|
timeout-minutes: 30
|
|
steps:
|
|
- name: Checkout current Gitea revision
|
|
run: |
|
|
set -euo pipefail
|
|
git init .
|
|
git remote remove origin 2>/dev/null || true
|
|
git remote add origin https://git.copse.top/root/Jyotisha.git
|
|
git fetch --no-tags origin "$GITEA_SHA" main
|
|
git checkout --detach --force "$GITEA_SHA"
|
|
- name: Verify runner toolchain and current main
|
|
run: |
|
|
set -euo pipefail
|
|
python3 --version
|
|
node --version
|
|
npm --version
|
|
docker version
|
|
test "$(git rev-parse HEAD)" = "$(git ls-remote origin refs/heads/main | awk '{print $1}')"
|
|
- name: Configure pinned production SSH
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
install -m 700 -d ~/.ssh
|
|
printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/jyotisha-production
|
|
chmod 600 ~/.ssh/jyotisha-production
|
|
printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts
|
|
- name: Sync and rebuild reviewed revision
|
|
run: |
|
|
set -euo pipefail
|
|
SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
|
|
rsync -az --delete --exclude='.git/' --exclude='.env.production' --exclude='frontend/node_modules/' --exclude='frontend/.next/' -e "ssh $SSH_OPTIONS" ./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/"
|
|
ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "cd '$DEPLOY_PATH' && GITHUB_SHA='$GITEA_SHA' docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"
|
|
- name: Verify production
|
|
run: |
|
|
set -euo pipefail
|
|
curl -fsS --retry 12 --retry-delay 5 https://jyotisha.chat/login >/dev/null
|
|
test "$(curl -sS -o /dev/null -w '%{http_code}' https://jyotisha.chat/api/account)" = 401
|
|
SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
|
|
ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" "cd '$DEPLOY_PATH' && docker compose --env-file .env.production -f deploy/docker-compose.server.yml exec -T web node -e 'fetch(\"http://api:5200/api/health\").then(async r=>{const b=await r.json();if(!r.ok||b.status!==\"ok\"||b.swisseph_available!==true)process.exit(1)})'"
|