[skip ci] chore: cleanup workflows
This commit is contained in:
Hampus Kraft
135
.github/workflows/deploy-docs.yaml
vendored
135
.github/workflows/deploy-docs.yaml
vendored
@@ -4,25 +4,70 @@ on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
- canary
|
||||
paths:
|
||||
- fluxer_docs/**/*
|
||||
- fluxer_docs/**
|
||||
- .github/workflows/deploy-docs.yaml
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
channel:
|
||||
type: choice
|
||||
options:
|
||||
- stable
|
||||
- canary
|
||||
default: stable
|
||||
description: Channel to deploy
|
||||
ref:
|
||||
type: string
|
||||
required: false
|
||||
default: ''
|
||||
description: Optional git ref to deploy (defaults to main/canary based on channel)
|
||||
|
||||
concurrency:
|
||||
group: deploy-fluxer-docs
|
||||
group: deploy-fluxer-docs-${{ github.event_name == 'workflow_dispatch' && inputs.channel || (github.ref_name == 'canary' && 'canary') || 'stable' }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
channel-vars:
|
||||
uses: ./.github/workflows/channel-vars.yaml
|
||||
with:
|
||||
github_event_name: ${{ github.event_name }}
|
||||
github_ref_name: ${{ github.ref_name }}
|
||||
github_ref: ${{ github.ref }}
|
||||
workflow_dispatch_channel: ${{ github.event_name == 'workflow_dispatch' && inputs.channel || '' }}
|
||||
workflow_dispatch_ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
|
||||
|
||||
deploy:
|
||||
name: Deploy app
|
||||
name: Deploy docs
|
||||
needs: channel-vars
|
||||
runs-on: blacksmith-2vcpu-ubuntu-2404
|
||||
timeout-minutes: 10
|
||||
env:
|
||||
CHANNEL: ${{ needs.channel-vars.outputs.channel }}
|
||||
IS_CANARY: ${{ needs.channel-vars.outputs.is_canary }}
|
||||
SOURCE_REF: ${{ needs.channel-vars.outputs.source_ref }}
|
||||
STACK_SUFFIX: ${{ needs.channel-vars.outputs.stack_suffix }}
|
||||
|
||||
STACK: ${{ format('fluxer-docs{0}', needs.channel-vars.outputs.stack_suffix) }}
|
||||
CACHE_SCOPE: ${{ format('deploy-fluxer-docs{0}', needs.channel-vars.outputs.stack_suffix) }}
|
||||
|
||||
CADDY_DOMAIN: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'docs.canary.fluxer.app' || 'docs.fluxer.app' }}
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
with:
|
||||
ref: ${{ env.SOURCE_REF }}
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Record deploy commit
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sha=$(git rev-parse HEAD)
|
||||
echo "Deploying commit ${sha}"
|
||||
printf 'DEPLOY_SHA=%s\n' "$sha" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
@@ -38,11 +83,11 @@ jobs:
|
||||
with:
|
||||
context: fluxer_docs
|
||||
file: fluxer_docs/Dockerfile
|
||||
tags: fluxer-docs:${{ github.sha }}
|
||||
tags: ${{ env.STACK }}:${{ env.DEPLOY_SHA }}
|
||||
load: true
|
||||
platforms: linux/amd64
|
||||
cache-from: type=gha,scope=deploy-fluxer-docs
|
||||
cache-to: type=gha,mode=max,scope=deploy-fluxer-docs
|
||||
cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
|
||||
cache-to: type=gha,mode=max,scope=${{ env.CACHE_SCOPE }}
|
||||
env:
|
||||
DOCKER_BUILD_SUMMARY: false
|
||||
DOCKER_BUILD_RECORD_UPLOAD: false
|
||||
@@ -68,19 +113,36 @@ jobs:
|
||||
|
||||
- name: Push image and deploy
|
||||
env:
|
||||
IMAGE_TAG: fluxer-docs:${{ github.sha }}
|
||||
IMAGE_TAG: ${{ env.STACK }}:${{ env.DEPLOY_SHA }}
|
||||
SERVER: ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_IP }}
|
||||
STACK: ${{ env.STACK }}
|
||||
CADDY_DOMAIN: ${{ env.CADDY_DOMAIN }}
|
||||
IS_CANARY: ${{ env.IS_CANARY }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
docker pussh ${IMAGE_TAG} ${SERVER}
|
||||
docker pussh "${IMAGE_TAG}" "${SERVER}"
|
||||
|
||||
ssh ${SERVER} "IMAGE_TAG=${IMAGE_TAG}" bash << 'EOF'
|
||||
set -e
|
||||
sudo mkdir -p /opt/fluxer-docs
|
||||
sudo chown -R ${USER}:${USER} /opt/fluxer-docs
|
||||
cd /opt/fluxer-docs
|
||||
ssh "${SERVER}" "IMAGE_TAG=${IMAGE_TAG} STACK=${STACK} CADDY_DOMAIN=${CADDY_DOMAIN} IS_CANARY=${IS_CANARY} bash" << 'EOF'
|
||||
set -euo pipefail
|
||||
|
||||
sudo mkdir -p "/opt/${STACK}"
|
||||
sudo chown -R "${USER}:${USER}" "/opt/${STACK}"
|
||||
cd "/opt/${STACK}"
|
||||
|
||||
cat > compose.yaml << COMPOSEEOF
|
||||
x-deploy-base: &deploy_base
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
delay: 5s
|
||||
max_attempts: 3
|
||||
update_config:
|
||||
parallelism: 1
|
||||
delay: 10s
|
||||
order: start-first
|
||||
rollback_config:
|
||||
parallelism: 1
|
||||
delay: 10s
|
||||
|
||||
cat > compose.yaml << COMPOSEEOF
|
||||
services:
|
||||
app:
|
||||
image: ${IMAGE_TAG}
|
||||
@@ -89,26 +151,25 @@ jobs:
|
||||
environment:
|
||||
- NODE_ENV=production
|
||||
deploy:
|
||||
<<: *deploy_base
|
||||
replicas: 2
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
delay: 5s
|
||||
max_attempts: 3
|
||||
update_config:
|
||||
parallelism: 1
|
||||
delay: 10s
|
||||
order: start-first
|
||||
rollback_config:
|
||||
parallelism: 1
|
||||
delay: 10s
|
||||
labels:
|
||||
- 'caddy=docs.fluxer.app'
|
||||
- 'caddy.reverse_proxy={{upstreams 3000}}'
|
||||
- 'caddy.header.Strict-Transport-Security="max-age=31536000; includeSubDomains; preload"'
|
||||
- 'caddy.header.X-Xss-Protection="1; mode=block"'
|
||||
- 'caddy.header.X-Content-Type-Options=nosniff'
|
||||
- 'caddy.header.Referrer-Policy=strict-origin-when-cross-origin'
|
||||
- 'caddy.header.X-Frame-Options=DENY'
|
||||
labels:
|
||||
caddy: "${CADDY_DOMAIN}"
|
||||
caddy.reverse_proxy: "{{upstreams 3000}}"
|
||||
COMPOSEEOF
|
||||
|
||||
if [[ "${IS_CANARY}" == "true" ]]; then
|
||||
cat >> compose.yaml << 'COMPOSEEOF'
|
||||
caddy.header.X-Robots-Tag: "noindex, nofollow, nosnippet, noimageindex"
|
||||
COMPOSEEOF
|
||||
fi
|
||||
|
||||
cat >> compose.yaml << 'COMPOSEEOF'
|
||||
caddy.header.Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
|
||||
caddy.header.X-Xss-Protection: "1; mode=block"
|
||||
caddy.header.X-Content-Type-Options: "nosniff"
|
||||
caddy.header.Referrer-Policy: "strict-origin-when-cross-origin"
|
||||
caddy.header.X-Frame-Options: "DENY"
|
||||
networks:
|
||||
- fluxer-shared
|
||||
healthcheck:
|
||||
@@ -123,6 +184,10 @@ jobs:
|
||||
external: true
|
||||
COMPOSEEOF
|
||||
|
||||
docker stack deploy -c compose.yaml fluxer-docs
|
||||
docker service update --image ${IMAGE_TAG} fluxer-docs_app
|
||||
docker stack deploy \
|
||||
--with-registry-auth \
|
||||
--detach=false \
|
||||
--resolve-image never \
|
||||
-c compose.yaml \
|
||||
"${STACK}"
|
||||
EOF
|
||||
|
||||
Reference in New Issue
Block a user