127 lines
3.8 KiB
YAML
127 lines
3.8 KiB
YAML
name: Build and deploy
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
|
|
env:
|
|
DOMAIN: ${{ vars.DOMAIN }}
|
|
IMAGE: ${{ vars.IMAGE }}
|
|
IMAGE_REPO: ${{ vars.IMAGE_REPO }}
|
|
PUSH_LATEST: ${{ vars.PUSH_LATEST }}
|
|
REGISTRY: ${{ vars.REGISTRY }}
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
STACK_NAME: ${{ vars.STACK_NAME }}
|
|
TRAEFIK_NETWORK: ${{ vars.TRAEFIK_NETWORK }}
|
|
TRAEFIK_ENTRYPOINT: ${{ vars.TRAEFIK_ENTRYPOINT }}
|
|
DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
|
|
DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
|
|
DEPLOY_USER: ${{ vars.DEPLOY_USER }}
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Prepare image name
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
short_sha="${GITHUB_SHA:-${GITEA_SHA:-manual}}"
|
|
short_sha="${short_sha:0:12}"
|
|
|
|
if [ -z "${IMAGE}" ]; then
|
|
: "${IMAGE_REPO:?Set IMAGE or IMAGE_REPO in Gitea variables}"
|
|
IMAGE="${IMAGE_REPO}:${short_sha}"
|
|
fi
|
|
|
|
if [ -z "${IMAGE_REPO}" ]; then
|
|
IMAGE_REPO="${IMAGE%:*}"
|
|
fi
|
|
|
|
{
|
|
echo "IMAGE=${IMAGE}"
|
|
echo "IMAGE_REPO=${IMAGE_REPO}"
|
|
echo "IMAGE_TAG=${short_sha}"
|
|
echo "STACK_NAME=${STACK_NAME:-progcode}"
|
|
echo "TRAEFIK_NETWORK=${TRAEFIK_NETWORK:-traefik-public}"
|
|
echo "TRAEFIK_ENTRYPOINT=${TRAEFIK_ENTRYPOINT:-websecure}"
|
|
echo "DEPLOY_PORT=${DEPLOY_PORT:-22}"
|
|
} >> "${GITHUB_ENV}"
|
|
|
|
- name: Docker login
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [ -n "${REGISTRY_PASSWORD}" ]; then
|
|
: "${REGISTRY:?Set REGISTRY when REGISTRY_PASSWORD is configured}"
|
|
: "${REGISTRY_USER:?Set REGISTRY_USER secret when REGISTRY_PASSWORD is configured}"
|
|
echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
|
|
else
|
|
echo "REGISTRY_PASSWORD is not set; skipping docker login"
|
|
fi
|
|
|
|
- name: Build image
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
docker build --pull -t "${IMAGE}" .
|
|
|
|
- name: Push image
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
docker push "${IMAGE}"
|
|
|
|
if [ "${PUSH_LATEST:-false}" = "true" ]; then
|
|
latest_image="${IMAGE_REPO}:latest"
|
|
docker tag "${IMAGE}" "${latest_image}"
|
|
docker push "${latest_image}"
|
|
fi
|
|
|
|
- name: Configure remote Docker host
|
|
if: ${{ vars.DEPLOY_HOST != '' }}
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
: "${DEPLOY_USER:?Set DEPLOY_USER when DEPLOY_HOST is configured}"
|
|
: "${DEPLOY_SSH_KEY:?Set DEPLOY_SSH_KEY secret when DEPLOY_HOST is configured}"
|
|
|
|
mkdir -p "${HOME}/.ssh"
|
|
chmod 700 "${HOME}/.ssh"
|
|
printf '%s\n' "${DEPLOY_SSH_KEY}" > "${HOME}/.ssh/id_deploy"
|
|
chmod 600 "${HOME}/.ssh/id_deploy"
|
|
ssh-keyscan -p "${DEPLOY_PORT}" "${DEPLOY_HOST}" >> "${HOME}/.ssh/known_hosts"
|
|
|
|
cat > "${HOME}/.ssh/config" <<EOF
|
|
Host swarm-manager
|
|
HostName ${DEPLOY_HOST}
|
|
Port ${DEPLOY_PORT}
|
|
User ${DEPLOY_USER}
|
|
IdentityFile ${HOME}/.ssh/id_deploy
|
|
IdentitiesOnly yes
|
|
EOF
|
|
|
|
echo "DOCKER_HOST=ssh://swarm-manager" >> "${GITHUB_ENV}"
|
|
|
|
- name: Deploy stack
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
: "${DOMAIN:?Set DOMAIN in Gitea variables}"
|
|
|
|
docker stack deploy \
|
|
--with-registry-auth \
|
|
-c deploy/stack.example.yml \
|
|
"${STACK_NAME}"
|