117 lines
3.7 KiB
YAML
117 lines
3.7 KiB
YAML
name: CI/CD
|
|
|
|
on:
|
|
push:
|
|
branches: ['**']
|
|
pull_request:
|
|
branches: ['**']
|
|
|
|
concurrency:
|
|
group: production-deploy
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
backend-tests:
|
|
name: Backend tests (.NET)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
defaults:
|
|
run:
|
|
working-directory: backend
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
|
|
- name: Restore
|
|
run: dotnet restore Musify.slnx
|
|
|
|
- name: Build
|
|
run: dotnet build Musify.slnx --no-restore -c Release
|
|
|
|
- name: Test
|
|
run: dotnet test Musify.slnx --no-build -c Release
|
|
|
|
web-player-checks:
|
|
name: web-player (check + lint)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
defaults:
|
|
run:
|
|
working-directory: web-player
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
cache: npm
|
|
cache-dependency-path: web-player/package-lock.json
|
|
|
|
- run: npm ci
|
|
|
|
- name: Type-check (svelte-check)
|
|
run: npm run check
|
|
|
|
- name: Lint (prettier + eslint + design tokens)
|
|
run: npm run lint
|
|
|
|
# Runs on the production host itself, through the existing self-hosted
|
|
# Gitea Actions runner (act_runner), which also carries a "production"
|
|
# label registered in native (non-docker) mode so its steps see the host's
|
|
# real Docker daemon directly (Docker socket + a bind-mounted deploy
|
|
# directory — see deploy/README.md for how that runner is set up).
|
|
#
|
|
# DEPLOY_PATH is the persistent clone already on that host (the one whose
|
|
# deploy/.env.prod is filled in and matches SharedServices/.env.prod) —
|
|
# deploy reuses it instead of a fresh checkout, since .env.prod is
|
|
# untracked and only lives there.
|
|
deploy:
|
|
name: Deploy to production
|
|
needs: [backend-tests, web-player-checks]
|
|
if: github.ref == 'refs/heads/master' && github.event_name == 'push'
|
|
runs-on: [production]
|
|
timeout-minutes: 20
|
|
env:
|
|
DEPLOY_PATH: /home/ubuntu/deploys/musify
|
|
COMPOSE: docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml
|
|
steps:
|
|
- name: Pull latest master
|
|
run: |
|
|
set -euo pipefail
|
|
cd "$DEPLOY_PATH"
|
|
git fetch origin master
|
|
git reset --hard origin/master
|
|
|
|
- name: Migrate database, generate keys
|
|
run: |
|
|
set -euo pipefail
|
|
cd "$DEPLOY_PATH"
|
|
$COMPOSE up -d wait-for-postgres keys-init migrate
|
|
|
|
# zitadel-init/seaweedfs-init verify themselves through the PUBLIC
|
|
# auth./s3. URLs (see deploy/compose.yml), so they only succeed once a
|
|
# real domain is registered and nginx is serving it (see the TODO
|
|
# below and deploy/README.md). Tolerated for now so a red step here
|
|
# doesn't block the rest of the deploy; drop the `|| true` once that's
|
|
# in place, so a real regression here fails the job again.
|
|
- name: Create OIDC app + S3 bucket (pending public domain)
|
|
run: |
|
|
cd "$DEPLOY_PATH"
|
|
$COMPOSE up -d seaweedfs-init zitadel-init || echo "expected to fail until the production domain + nginx edge exist"
|
|
|
|
- name: Build and start apps
|
|
run: |
|
|
set -euo pipefail
|
|
cd "$DEPLOY_PATH"
|
|
$COMPOSE --profile apps up -d --build api worker gateway web-player
|
|
|
|
# TODO once a domain is registered and pointed at this server: merge
|
|
# Musify's vhosts (deploy/nginx/templates) into the existing
|
|
# gitea-nginx config instead of running the `nginx` service from
|
|
# compose.prod.yml, since gitea-nginx already owns host ports 80/443
|
|
# for gitea.ikerdemo.cat. See "Continuous deployment" in
|
|
# deploy/README.md.
|