97 lines
3.5 KiB
YAML
97 lines
3.5 KiB
YAML
name: Gateway
|
|
|
|
# Every push touching the gateway: typecheck and tests. On main, also build the image, push it to
|
|
# the Gitea registry tagged with the commit and `latest`, and ask junior.gib (the VPS) to deploy it
|
|
# now. Its nightly update-containers timer is the fallback when the deploy trigger fails.
|
|
#
|
|
# Uses the user-level secrets REGISTRY_USER and REGISTRY_PASSWORD, and the repo secret
|
|
# DEPLOY_SSH_KEY_VPS_B64, a base64 encoded key that junior.gib only accepts for
|
|
# ~/Server/ci-deploy.sh.
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- 'gateway/**'
|
|
- '.gitea/workflows/gateway.yml'
|
|
pull_request:
|
|
paths:
|
|
- 'gateway/**'
|
|
|
|
concurrency:
|
|
group: gateway-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: build
|
|
steps:
|
|
- name: Checkout
|
|
# Plain git instead of actions/checkout: rootless podman on some runners rejects symlinks
|
|
# inside cached actions.
|
|
env:
|
|
GITEA_TOKEN: ${{ gitea.token }}
|
|
run: |
|
|
git init -q .
|
|
git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
|
|
auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
|
|
git -c http.extraHeader="Authorization: basic $auth" \
|
|
fetch -q --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Set up Bun
|
|
# The install script instead of oven-sh/setup-bun, for the same symlink reason.
|
|
run: |
|
|
curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.0" >/dev/null
|
|
echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Typecheck and test
|
|
working-directory: gateway
|
|
run: |
|
|
bun install --frozen-lockfile
|
|
bun run typecheck
|
|
bun test
|
|
|
|
image:
|
|
needs: [check]
|
|
if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
|
|
runs-on: build
|
|
env:
|
|
IMAGE: git.gbrown.org/gib/wristcode-gateway
|
|
steps:
|
|
- name: Checkout
|
|
env:
|
|
GITEA_TOKEN: ${{ gitea.token }}
|
|
run: |
|
|
git init -q .
|
|
git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
|
|
auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
|
|
git -c http.extraHeader="Authorization: basic $auth" \
|
|
fetch -q --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Build
|
|
run: docker build -f gateway/Containerfile -t "$IMAGE:${{ gitea.sha }}" -t "$IMAGE:latest" gateway
|
|
|
|
- name: Push
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
docker push "$IMAGE:${{ gitea.sha }}"
|
|
docker push "$IMAGE:latest"
|
|
|
|
- name: Deploy
|
|
# 192.168.2.2 is junior's WireGuard address, reachable from every runner. The secret is the
|
|
# private key base64 encoded on one line. The runner prints each step's
|
|
# env, and Gitea only masks a secret it can match in full, which a multi-line key defeats.
|
|
env:
|
|
DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_VPS_B64 }}
|
|
run: |
|
|
install -m600 /dev/null "$HOME/.deploy_key"
|
|
printf '%s' "$DEPLOY_SSH_KEY_B64" | base64 -d > "$HOME/.deploy_key"
|
|
ssh -i "$HOME/.deploy_key" \
|
|
-o BatchMode=yes \
|
|
-o StrictHostKeyChecking=accept-new \
|
|
-o ConnectTimeout=15 \
|
|
[email protected] wristcode \
|
|
|| echo "::warning::deploy trigger failed; the nightly update timer will deploy instead"
|
|
rm -f "$HOME/.deploy_key"
|