maroandClaude Sonnet 5
56b2a6497b
Production no longer builds from source or self-updates via cron/git pull:
setup.sh now only provisions the server once (Docker, /opt/anouma, a
restricted `anouma-deploy` SSH user whose key can only ever run
deploy.sh, generated secrets). All future deployments run through
.gitea/workflows/ci.yml (lint/typecheck/test/build on every push) and
release.yml (on a vX.Y.Z tag: build the image, push it to the Gitea
registry, then SSH-trigger deploy.sh on the server), which pulls,
migrates, restarts, healthchecks, backs up the database first, and
automatically rolls back the code on a failed healthcheck.
docker-compose.yml's app service now runs a registry image
(${ANOUMA_IMAGE}) instead of building locally.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: ['**']
|
|
pull_request:
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: node:22-alpine
|
|
# No live database is needed here — every Payload-backed route in this
|
|
# app is force-dynamic, so `next build` never touches Postgres. These
|
|
# are dummy values only so a real config error (a missing secret) is
|
|
# never silently masked by CI happening to run without one.
|
|
env:
|
|
NODE_ENV: production
|
|
NEXT_TELEMETRY_DISABLED: "1"
|
|
DATABASE_URI: postgresql://ci:ci@localhost:5432/ci
|
|
PAYLOAD_SECRET: ci-only-not-a-real-secret
|
|
MEETING_SESSION_SECRET: ci-only-not-a-real-secret
|
|
CRON_SECRET: ci-only-not-a-real-secret
|
|
NEXT_PUBLIC_SERVER_URL: http://localhost:3000
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install build dependencies (sharp needs libc6-compat on alpine)
|
|
run: apk add --no-cache libc6-compat
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Typecheck
|
|
run: npx tsc --noEmit
|
|
|
|
- name: Test
|
|
run: npm test
|
|
|
|
- name: Build
|
|
run: npm run build
|