ci: use GitHub Container Registry
This commit is contained in:
@@ -1,118 +0,0 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: ['**']
|
||||
pull_request:
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
container:
|
||||
image: node:22-alpine
|
||||
# No live database is needed here — every Payload-backed route in this
|
||||
# app is force-dynamic, so `next build` never touches Postgres. These
|
||||
# are dummy values only so a real config error (a missing secret) is
|
||||
# never silently masked by CI happening to run without one.
|
||||
#
|
||||
# NODE_ENV is deliberately NOT set here: `npm ci` treats a production
|
||||
# NODE_ENV as `--omit=dev`, which would skip eslint/typescript/etc. and
|
||||
# break Lint/Typecheck/Test. It's set below, scoped to the Build step.
|
||||
env:
|
||||
NEXT_TELEMETRY_DISABLED: "1"
|
||||
DATABASE_URI: postgresql://ci:ci@localhost:5432/ci
|
||||
PAYLOAD_SECRET: ci-only-not-a-real-secret
|
||||
MEETING_SESSION_SECRET: ci-only-not-a-real-secret
|
||||
ANALYTICS_SALT_SECRET: ci-only-not-a-real-secret
|
||||
CRON_SECRET: ci-only-not-a-real-secret
|
||||
NEXT_PUBLIC_SERVER_URL: http://localhost:3000
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install build dependencies (sharp needs libc6-compat on alpine)
|
||||
run: apk add --no-cache libc6-compat
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Lint
|
||||
run: npm run lint
|
||||
|
||||
- name: Typecheck
|
||||
run: npx next typegen && npx tsc --noEmit
|
||||
|
||||
- name: Test
|
||||
run: npm test
|
||||
|
||||
- name: Build
|
||||
env:
|
||||
NODE_ENV: production
|
||||
run: npm run build
|
||||
|
||||
# Builds once per commit that lands on main and has passed the checks
|
||||
# above, and pushes it to the registry tagged by commit SHA. release.yml
|
||||
# (triggered by a version tag) never rebuilds — it only promotes this
|
||||
# exact, already-tested image to the release tag + `latest` and deploys
|
||||
# it. This guarantees byte-for-byte that what gets deployed is what CI
|
||||
# verified, and makes tagging a commit that never passed CI on main fail
|
||||
# loudly (no image to promote) instead of silently rebuilding from
|
||||
# source and skipping the checks.
|
||||
build-image:
|
||||
needs: test
|
||||
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||||
runs-on: ubuntu-latest
|
||||
# The anouma-runner runs as a Docker container itself (gitea/runner:3),
|
||||
# with the host's docker.sock bind-mounted in but no `docker` CLI binary
|
||||
# of its own — a job with no `container:` here runs directly inside that
|
||||
# minimal runner image and gets "docker: command not found".
|
||||
#
|
||||
# A plain `docker:27-cli` image (Alpine, no Node.js) doesn't work either:
|
||||
# actions/checkout@v4 is a JS action and needs a Node runtime in the job
|
||||
# container, which that image doesn't have — it fails at Checkout with
|
||||
# exit 127. Using a Node image as the base guarantees Node is already
|
||||
# there (same reason the `test` job's node:22-alpine works), and the
|
||||
# Docker CLI is added via apt. The runner auto-mounts the same host
|
||||
# docker.sock into this container (sibling containers — see
|
||||
# container.docker_host in the runner's config.yaml), so `docker
|
||||
# build`/`push` operate on the host's real Docker daemon. release.yml's
|
||||
# promote-and-deploy job uses the same setup, for the same reasons.
|
||||
container:
|
||||
image: node:22-bookworm-slim
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install Docker CLI
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y --no-install-recommends docker.io
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
- name: Determine image name
|
||||
id: image
|
||||
run: |
|
||||
echo "registry=${REGISTRY:-git.maro.run}" >> "$GITHUB_OUTPUT"
|
||||
echo "repo=${REGISTRY_REPO:-maro/anouma}" >> "$GITHUB_OUTPUT"
|
||||
env:
|
||||
REGISTRY: git.maro.run
|
||||
REGISTRY_REPO: maro/anouma
|
||||
|
||||
- name: Log in to registry
|
||||
env:
|
||||
REGISTRY_IMAGE: ${{ steps.image.outputs.registry }}
|
||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
||||
run: echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_IMAGE" -u "$REGISTRY_USERNAME" --password-stdin
|
||||
|
||||
- name: Build image
|
||||
env:
|
||||
IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
|
||||
# Tagged by commit SHA only — `latest` is reserved for whatever was
|
||||
# last actually released (see release.yml), not the newest main build.
|
||||
run: docker build -t "$IMAGE:$GITHUB_SHA" .
|
||||
|
||||
- name: Push image
|
||||
env:
|
||||
IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
|
||||
run: docker push "$IMAGE:$GITHUB_SHA"
|
||||
@@ -1,120 +0,0 @@
|
||||
name: Release
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'v*'
|
||||
|
||||
jobs:
|
||||
# Deliberately does NOT rebuild or re-run lint/typecheck/test/build: the
|
||||
# image for this exact commit was already built and pushed by ci.yml's
|
||||
# build-image job when it landed on main (which itself only runs after
|
||||
# the `test` job passes). This job just promotes that already-verified
|
||||
# image to the release tag + `latest` and deploys it — if the tagged
|
||||
# commit was never pushed to main (or CI hasn't finished yet), the
|
||||
# "Pull the tested image" step below fails loudly instead of silently
|
||||
# rebuilding from source and skipping the checks.
|
||||
promote-and-deploy:
|
||||
runs-on: ubuntu-latest
|
||||
# Node-based image (not the bare runner, not a Docker-only image) for
|
||||
# the same reasons as ci.yml's build-image job: the runner needs a
|
||||
# Docker CLI added via apt (it has none of its own), and actions/checkout
|
||||
# needs a Node runtime that a plain docker:*-cli image doesn't have.
|
||||
container:
|
||||
image: node:22-bookworm-slim
|
||||
steps:
|
||||
- name: Install Docker CLI and ssh client
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y --no-install-recommends docker.io openssh-client
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
- name: Determine image tags
|
||||
id: image
|
||||
# Gitea Actions' runner is protocol-compatible with GitHub Actions,
|
||||
# so step commands use the same $GITHUB_OUTPUT / $GITHUB_ENV
|
||||
# mechanism (the `gitea.*` vs `github.*` expression contexts are
|
||||
# just aliases of each other for `${{ }}` templating).
|
||||
#
|
||||
# The tag name (github.ref_name / $GITHUB_REF_NAME) is
|
||||
# attacker-influenced: anyone with tag-push rights controls it, and
|
||||
# git allows shell metacharacters in tag names. It's read here via
|
||||
# the automatic $GITHUB_REF_NAME env var rather than `${{ github.ref_name }}`
|
||||
# so its value reaches bash as data (argv/envp), never spliced into
|
||||
# the script text — `${{ }}` expressions are substituted into the
|
||||
# YAML before bash ever sees the script, which is what makes
|
||||
# interpolating attacker-controlled values that way a script-injection
|
||||
# vector (arbitrary code execution in a job that holds the registry
|
||||
# and production deploy credentials).
|
||||
run: |
|
||||
echo "registry=${REGISTRY:-git.maro.run}" >> "$GITHUB_OUTPUT"
|
||||
echo "repo=${REGISTRY_REPO:-maro/anouma}" >> "$GITHUB_OUTPUT"
|
||||
echo "version=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
|
||||
env:
|
||||
REGISTRY: git.maro.run
|
||||
REGISTRY_REPO: maro/anouma
|
||||
|
||||
- name: Log in to registry
|
||||
env:
|
||||
REGISTRY_IMAGE: ${{ steps.image.outputs.registry }}
|
||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
||||
run: echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_IMAGE" -u "$REGISTRY_USERNAME" --password-stdin
|
||||
|
||||
- name: Pull the tested image for this commit
|
||||
env:
|
||||
IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
|
||||
run: |
|
||||
docker pull "$IMAGE:$GITHUB_SHA" || {
|
||||
echo "::error::No image found for commit $GITHUB_SHA. This tag must point at a commit that was already pushed to main and built by ci.yml's build-image job — push to main first (and wait for CI to finish) before tagging a release." >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
- name: Promote image to the release tag and latest
|
||||
env:
|
||||
IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
|
||||
VERSION: ${{ steps.image.outputs.version }}
|
||||
run: |
|
||||
docker tag "$IMAGE:$GITHUB_SHA" "$IMAGE:$VERSION"
|
||||
docker tag "$IMAGE:$GITHUB_SHA" "$IMAGE:latest"
|
||||
|
||||
- name: Push promoted tags
|
||||
env:
|
||||
IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
|
||||
VERSION: ${{ steps.image.outputs.version }}
|
||||
run: |
|
||||
docker push "$IMAGE:$VERSION"
|
||||
docker push "$IMAGE:latest"
|
||||
|
||||
- name: Deploy to production
|
||||
env:
|
||||
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
||||
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
||||
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
||||
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||
# Optional: pin the exact host key instead of trusting it on
|
||||
# first connect (see DEPLOYMENT.md). Safe to leave unset.
|
||||
DEPLOY_HOST_KEY: ${{ secrets.DEPLOY_HOST_KEY }}
|
||||
VERSION: ${{ steps.image.outputs.version }}
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
umask 077
|
||||
key_file="$(mktemp)"
|
||||
known_hosts_file="$(mktemp)"
|
||||
trap 'rm -f "$key_file" "$known_hosts_file"' EXIT
|
||||
|
||||
printf '%s\n' "$DEPLOY_SSH_KEY" > "$key_file"
|
||||
chmod 600 "$key_file"
|
||||
|
||||
if [ -n "${DEPLOY_HOST_KEY:-}" ]; then
|
||||
printf '%s\n' "$DEPLOY_HOST_KEY" > "$known_hosts_file"
|
||||
else
|
||||
ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" > "$known_hosts_file" 2>/dev/null
|
||||
fi
|
||||
|
||||
# The forced command in the server's authorized_keys (see
|
||||
# setup.sh) ignores this and always runs deploy.sh itself — the
|
||||
# string below only ever reaches it via $SSH_ORIGINAL_COMMAND.
|
||||
ssh -i "$key_file" -o UserKnownHostsFile="$known_hosts_file" -p "${DEPLOY_PORT:-22}" \
|
||||
"${DEPLOY_USER}@${DEPLOY_HOST}" "deploy ${VERSION}"
|
||||
Reference in New Issue
Block a user