ben
761f1a1f78
Drop the flaky host Node docker step (image build already runs Vite), hard-reset the deploy checkout to the CI SHA, and fail deploy if assets still emit http://.
118 lines
4.0 KiB
YAML
118 lines
4.0 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: gitea.z00.nu
|
|
# Baked into the Vite client bundle for production WebSockets.
|
|
VITE_REVERB_HOST: reverb.transcribe.z00.nu
|
|
VITE_REVERB_PORT: "443"
|
|
VITE_REVERB_SCHEME: https
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
set -euo pipefail
|
|
HOST="${{ gitea.server_url }}"
|
|
HOST="${HOST#https://}"
|
|
HOST="${HOST#http://}"
|
|
git clone --depth 1 \
|
|
"https://x-access-token:${{ secrets.GITHUB_TOKEN }}@${HOST}/${{ gitea.repository }}.git" \
|
|
.
|
|
git fetch --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout --force "${{ gitea.sha }}"
|
|
|
|
- name: Install PHP dependencies
|
|
run: composer install --no-interaction --prefer-dist --optimize-autoloader
|
|
|
|
- name: Run tests
|
|
run: |
|
|
set -euo pipefail
|
|
cp .env.example .env
|
|
php artisan key:generate --force --no-interaction
|
|
php -d memory_limit=512M artisan test --compact
|
|
|
|
- name: Validate compose
|
|
run: |
|
|
set -euo pipefail
|
|
APP_IMAGE="${REGISTRY}/$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]'):test" \
|
|
APP_KEY="base64:dGVzdC1hcHAta2V5LWZvci1jaS1jb21wb3NlLXZhbGlkYXRpb24=" \
|
|
docker compose -f docker-compose.yml -f compose.z00.yaml config --quiet
|
|
|
|
build-and-push:
|
|
if: gitea.event_name != 'pull_request'
|
|
needs: test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
set -euo pipefail
|
|
HOST="${{ gitea.server_url }}"
|
|
HOST="${HOST#https://}"
|
|
HOST="${HOST#http://}"
|
|
git clone --depth 1 \
|
|
"https://x-access-token:${{ secrets.GITHUB_TOKEN }}@${HOST}/${{ gitea.repository }}.git" \
|
|
.
|
|
git fetch --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout --force "${{ gitea.sha }}"
|
|
|
|
- name: Build and push image
|
|
run: |
|
|
set -euo pipefail
|
|
REPO_LC="$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]')"
|
|
TAG_SHA="${REGISTRY}/${REPO_LC}:${{ gitea.sha }}"
|
|
TAG_LATEST="${REGISTRY}/${REPO_LC}:latest"
|
|
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${REGISTRY}" -u "${{ gitea.actor }}" --password-stdin
|
|
DOCKER_BUILDKIT=1 docker build \
|
|
--build-arg VITE_APP_NAME=AndyTranscribe \
|
|
--build-arg VITE_REVERB_APP_KEY=andytranscribe-key \
|
|
--build-arg "VITE_REVERB_HOST=${VITE_REVERB_HOST}" \
|
|
--build-arg "VITE_REVERB_PORT=${VITE_REVERB_PORT}" \
|
|
--build-arg "VITE_REVERB_SCHEME=${VITE_REVERB_SCHEME}" \
|
|
-t "${TAG_SHA}" \
|
|
-t "${TAG_LATEST}" \
|
|
.
|
|
docker push "${TAG_SHA}"
|
|
docker push "${TAG_LATEST}"
|
|
|
|
deploy:
|
|
if: gitea.ref == 'refs/heads/main' && gitea.event_name != 'pull_request'
|
|
needs: build-and-push
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
set -euo pipefail
|
|
HOST="${{ gitea.server_url }}"
|
|
HOST="${HOST#https://}"
|
|
HOST="${HOST#http://}"
|
|
git clone --depth 1 \
|
|
"https://x-access-token:${{ secrets.GITHUB_TOKEN }}@${HOST}/${{ gitea.repository }}.git" \
|
|
.
|
|
git fetch --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout --force "${{ gitea.sha }}"
|
|
|
|
- name: Deploy production
|
|
env:
|
|
DEPLOY_PATHS: ${{ secrets.DEPLOY_PATHS }}
|
|
DEPLOY_SHA: ${{ gitea.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
REPO_LC="$(echo "${{ gitea.repository }}" | tr '[:upper:]' '[:lower:]')"
|
|
export APP_IMAGE="${REGISTRY}/${REPO_LC}:${{ gitea.sha }}"
|
|
chmod +x scripts/deploy-production.sh
|
|
if [ -z "${DEPLOY_PATHS:-}" ]; then
|
|
echo "DEPLOY_PATHS secret is not set; skipping deploy."
|
|
echo "Built image: ${APP_IMAGE}"
|
|
exit 0
|
|
fi
|
|
./scripts/deploy-production.sh
|