Jesse_Chen
89 lines
3.8 KiB
YAML
89 lines
3.8 KiB
YAML
name: Deploy production
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: production
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
DEPLOY_HOST: 103.117.123.53
|
|
DEPLOY_PORT: "22000"
|
|
DEPLOY_USER: root
|
|
DEPLOY_PATH: /opt/jyotisha-app
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Checkout tested revision
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
|
|
- name: Reject stale CI revision
|
|
id: revision
|
|
run: |
|
|
tested_sha="$(git rev-parse HEAD)"
|
|
main_sha="$(git ls-remote origin refs/heads/main | awk '{print $1}')"
|
|
if [ "$tested_sha" = "$main_sha" ]; then
|
|
echo "deploy=true" >> "$GITHUB_OUTPUT"
|
|
echo "Deploying current main revision $tested_sha"
|
|
else
|
|
echo "deploy=false" >> "$GITHUB_OUTPUT"
|
|
echo "Skipping stale CI revision $tested_sha; current main is $main_sha"
|
|
fi
|
|
|
|
- name: Configure SSH
|
|
if: steps.revision.outputs.deploy == 'true'
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}
|
|
run: |
|
|
install -m 700 -d ~/.ssh
|
|
printf '%s\n' "$SSH_PRIVATE_KEY" > ~/.ssh/jyotisha-production
|
|
chmod 600 ~/.ssh/jyotisha-production
|
|
printf '%s\n' '[103.117.123.53]:22000 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQJvN2Mo3Yq8e6ZIK4P2blJ5Vjj0HbknEuk7TyjhMbO' > ~/.ssh/known_hosts
|
|
|
|
- name: Sync and rebuild
|
|
if: steps.revision.outputs.deploy == 'true'
|
|
env:
|
|
DEPLOY_GIT_SHA: ${{ github.sha }}
|
|
run: |
|
|
SSH_OPTIONS="-i $HOME/.ssh/jyotisha-production -p $DEPLOY_PORT -o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20"
|
|
RSYNC_SSH="ssh $SSH_OPTIONS"
|
|
rsync -az --delete \
|
|
--exclude='.git/' \
|
|
--exclude='.env.production' \
|
|
--exclude='frontend/node_modules/' \
|
|
--exclude='frontend/.next/' \
|
|
-e "$RSYNC_SSH" \
|
|
./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/"
|
|
|
|
ssh $SSH_OPTIONS "$DEPLOY_USER@$DEPLOY_HOST" \
|
|
"cd '$DEPLOY_PATH' && GITHUB_SHA='$DEPLOY_GIT_SHA' docker compose --env-file .env.production -f deploy/docker-compose.server.yml up -d --build --remove-orphans"
|
|
|
|
- name: Verify production
|
|
if: steps.revision.outputs.deploy == 'true'
|
|
env:
|
|
DEPLOY_GIT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
|
|
run: |
|
|
curl --fail --silent --show-error --retry 12 --retry-delay 5 https://jyotisha.chat/login >/dev/null
|
|
test "$(curl --silent --output /dev/null --write-out '%{http_code}' https://jyotisha.chat/api/account)" = "401"
|
|
deployed_sha=""
|
|
for attempt in $(seq 1 24); do
|
|
deployed_sha="$(curl --fail --silent --show-error https://jyotisha.chat/api/health | python3 -c 'import json, sys; print(json.load(sys.stdin).get("deployment", {}).get("gitCommit", ""))')" || deployed_sha=""
|
|
[ "$deployed_sha" = "$DEPLOY_GIT_SHA" ] && break
|
|
sleep 5
|
|
done
|
|
test "$deployed_sha" = "$DEPLOY_GIT_SHA" || { echo "Production revision did not converge: expected $DEPLOY_GIT_SHA, got ${deployed_sha:-empty}" >&2; exit 1; }
|
|
ssh -i ~/.ssh/jyotisha-production -p "$DEPLOY_PORT" \
|
|
-o BatchMode=yes -o IdentitiesOnly=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20 \
|
|
"$DEPLOY_USER@$DEPLOY_HOST" \
|
|
"cd '$DEPLOY_PATH' && docker compose --env-file .env.production -f deploy/docker-compose.server.yml exec -T web node -e 'fetch(\"http://api:5200/api/health\").then(async r => { const body = await r.json(); if (!r.ok || body.status !== \"ok\" || body.swisseph_available !== true) process.exit(1); console.log(JSON.stringify(body)); })'"
|