Revert "ci: use GitHub Container Registry"

This reverts commit b29b017341.
2026-09-16 20:37:12 +02:00
parent b29b017341
commit caf586f1ad
10 changed files with 321 additions and 64 deletions
@@ -0,0 +1,120 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  # Deliberately does NOT rebuild or re-run lint/typecheck/test/build: the
+  # image for this exact commit was already built and pushed by ci.yml's
+  # build-image job when it landed on main (which itself only runs after
+  # the `test` job passes). This job just promotes that already-verified
+  # image to the release tag + `latest` and deploys it — if the tagged
+  # commit was never pushed to main (or CI hasn't finished yet), the
+  # "Pull the tested image" step below fails loudly instead of silently
+  # rebuilding from source and skipping the checks.
+  promote-and-deploy:
+    runs-on: ubuntu-latest
+    # Node-based image (not the bare runner, not a Docker-only image) for
+    # the same reasons as ci.yml's build-image job: the runner needs a
+    # Docker CLI added via apt (it has none of its own), and actions/checkout
+    # needs a Node runtime that a plain docker:*-cli image doesn't have.
+    container:
+      image: node:22-bookworm-slim
+    steps:
+      - name: Install Docker CLI and ssh client
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends docker.io openssh-client
+          rm -rf /var/lib/apt/lists/*
+
+      - name: Determine image tags
+        id: image
+        # Gitea Actions' runner is protocol-compatible with GitHub Actions,
+        # so step commands use the same $GITHUB_OUTPUT / $GITHUB_ENV
+        # mechanism (the `gitea.*` vs `github.*` expression contexts are
+        # just aliases of each other for `${{ }}` templating).
+        #
+        # The tag name (github.ref_name / $GITHUB_REF_NAME) is
+        # attacker-influenced: anyone with tag-push rights controls it, and
+        # git allows shell metacharacters in tag names. It's read here via
+        # the automatic $GITHUB_REF_NAME env var rather than `${{ github.ref_name }}`
+        # so its value reaches bash as data (argv/envp), never spliced into
+        # the script text — `${{ }}` expressions are substituted into the
+        # YAML before bash ever sees the script, which is what makes
+        # interpolating attacker-controlled values that way a script-injection
+        # vector (arbitrary code execution in a job that holds the registry
+        # and production deploy credentials).
+        run: |
+          echo "registry=${REGISTRY:-git.maro.run}" >> "$GITHUB_OUTPUT"
+          echo "repo=${REGISTRY_REPO:-maro/anouma}" >> "$GITHUB_OUTPUT"
+          echo "version=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
+        env:
+          REGISTRY: git.maro.run
+          REGISTRY_REPO: maro/anouma
+
+      - name: Log in to registry
+        env:
+          REGISTRY_IMAGE: ${{ steps.image.outputs.registry }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_IMAGE" -u "$REGISTRY_USERNAME" --password-stdin
+
+      - name: Pull the tested image for this commit
+        env:
+          IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
+        run: |
+          docker pull "$IMAGE:$GITHUB_SHA" || {
+            echo "::error::No image found for commit $GITHUB_SHA. This tag must point at a commit that was already pushed to main and built by ci.yml's build-image job — push to main first (and wait for CI to finish) before tagging a release." >&2
+            exit 1
+          }
+
+      - name: Promote image to the release tag and latest
+        env:
+          IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
+          VERSION: ${{ steps.image.outputs.version }}
+        run: |
+          docker tag "$IMAGE:$GITHUB_SHA" "$IMAGE:$VERSION"
+          docker tag "$IMAGE:$GITHUB_SHA" "$IMAGE:latest"
+
+      - name: Push promoted tags
+        env:
+          IMAGE: ${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}
+          VERSION: ${{ steps.image.outputs.version }}
+        run: |
+          docker push "$IMAGE:$VERSION"
+          docker push "$IMAGE:latest"
+
+      - name: Deploy to production
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          # Optional: pin the exact host key instead of trusting it on
+          # first connect (see DEPLOYMENT.md). Safe to leave unset.
+          DEPLOY_HOST_KEY: ${{ secrets.DEPLOY_HOST_KEY }}
+          VERSION: ${{ steps.image.outputs.version }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          umask 077
+          key_file="$(mktemp)"
+          known_hosts_file="$(mktemp)"
+          trap 'rm -f "$key_file" "$known_hosts_file"' EXIT
+
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$key_file"
+          chmod 600 "$key_file"
+
+          if [ -n "${DEPLOY_HOST_KEY:-}" ]; then
+            printf '%s\n' "$DEPLOY_HOST_KEY" > "$known_hosts_file"
+          else
+            ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" > "$known_hosts_file" 2>/dev/null
+          fi
+
+          # The forced command in the server's authorized_keys (see
+          # setup.sh) ignores this and always runs deploy.sh itself — the
+          # string below only ever reaches it via $SSH_ORIGINAL_COMMAND.
+          ssh -i "$key_file" -o UserKnownHostsFile="$known_hosts_file" -p "${DEPLOY_PORT:-22}" \
+            "${DEPLOY_USER}@${DEPLOY_HOST}" "deploy ${VERSION}"