maroandClaude Sonnet 5
bd38781502
CI / test (push) Failing after 1m24s
Setting it job-wide made `npm ci` treat NODE_ENV=production as an implicit --omit=dev, silently skipping eslint/typescript/test devDependencies and failing Lint with "eslint: not found". Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
105 lines
3.9 KiB
YAML
105 lines
3.9 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: node:22-alpine
|
|
# NODE_ENV is deliberately NOT set at job level: `npm ci` treats a
|
|
# production NODE_ENV as `--omit=dev`, which would skip eslint/
|
|
# typescript/etc. and break Lint/Typecheck/Test. It's scoped to the
|
|
# Build step below instead.
|
|
env:
|
|
NEXT_TELEMETRY_DISABLED: "1"
|
|
DATABASE_URI: postgresql://ci:ci@localhost:5432/ci
|
|
PAYLOAD_SECRET: ci-only-not-a-real-secret
|
|
MEETING_SESSION_SECRET: ci-only-not-a-real-secret
|
|
CRON_SECRET: ci-only-not-a-real-secret
|
|
NEXT_PUBLIC_SERVER_URL: http://localhost:3000
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- run: apk add --no-cache libc6-compat
|
|
- run: npm ci
|
|
- run: npm run lint
|
|
- run: npx tsc --noEmit
|
|
- run: npm test
|
|
- run: npm run build
|
|
env:
|
|
NODE_ENV: production
|
|
|
|
build-and-deploy:
|
|
needs: test
|
|
runs-on: ubuntu-latest
|
|
# No container here — this job needs the Docker CLI + an SSH client
|
|
# directly on the runner host, not inside a Node container.
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Determine image tags
|
|
id: image
|
|
# Gitea Actions' runner is protocol-compatible with GitHub Actions,
|
|
# so step commands use the same $GITHUB_OUTPUT / $GITHUB_ENV
|
|
# mechanism (the `gitea.*` vs `github.*` expression contexts are
|
|
# just aliases of each other for `${{ }}` templating).
|
|
run: |
|
|
echo "registry=${REGISTRY:-git.maro.run}" >> "$GITHUB_OUTPUT"
|
|
echo "repo=${REGISTRY_REPO:-maro/anouma}" >> "$GITHUB_OUTPUT"
|
|
echo "version=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
REGISTRY: git.maro.run
|
|
REGISTRY_REPO: maro/anouma
|
|
|
|
- name: Log in to registry
|
|
run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${{ steps.image.outputs.registry }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
|
|
|
- name: Build image
|
|
run: |
|
|
IMAGE="${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}"
|
|
VERSION="${{ steps.image.outputs.version }}"
|
|
docker build -t "$IMAGE:$VERSION" -t "$IMAGE:latest" .
|
|
|
|
- name: Push image
|
|
run: |
|
|
IMAGE="${{ steps.image.outputs.registry }}/${{ steps.image.outputs.repo }}"
|
|
VERSION="${{ steps.image.outputs.version }}"
|
|
docker push "$IMAGE:$VERSION"
|
|
docker push "$IMAGE:latest"
|
|
|
|
- name: Deploy to production
|
|
env:
|
|
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
|
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
# Optional: pin the exact host key instead of trusting it on
|
|
# first connect (see DEPLOYMENT.md). Safe to leave unset.
|
|
DEPLOY_HOST_KEY: ${{ secrets.DEPLOY_HOST_KEY }}
|
|
VERSION: ${{ steps.image.outputs.version }}
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
key_file="$(mktemp)"
|
|
known_hosts_file="$(mktemp)"
|
|
trap 'rm -f "$key_file" "$known_hosts_file"' EXIT
|
|
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > "$key_file"
|
|
chmod 600 "$key_file"
|
|
|
|
if [ -n "${DEPLOY_HOST_KEY:-}" ]; then
|
|
printf '%s\n' "$DEPLOY_HOST_KEY" > "$known_hosts_file"
|
|
else
|
|
ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" > "$known_hosts_file" 2>/dev/null
|
|
fi
|
|
|
|
# The forced command in the server's authorized_keys (see
|
|
# setup.sh) ignores this and always runs deploy.sh itself — the
|
|
# string below only ever reaches it via $SSH_ORIGINAL_COMMAND.
|
|
ssh -i "$key_file" -o UserKnownHostsFile="$known_hosts_file" -p "${DEPLOY_PORT:-22}" \
|
|
"${DEPLOY_USER}@${DEPLOY_HOST}" "deploy ${VERSION}"
|