Added new pipeline
This commit is contained in:
@@ -8,202 +8,161 @@ on:
|
||||
types: [opened, synchronize, reopened, closed]
|
||||
|
||||
env:
|
||||
# Base path for PR preview environments
|
||||
# --- PATH CONFIGURATION ---
|
||||
REMOTE_DEPLOY_PATH: /var/app/traefik/test
|
||||
|
||||
# --- CUSTOMIZABLE PRODUCTION PATH ---
|
||||
# Set the absolute path for your production deployment on the remote server.
|
||||
REMOTE_PROD_PATH: /var/app/traefik/prod
|
||||
|
||||
REMOTE_STAGING_PATH: /var/app/traefik/staging
|
||||
|
||||
# --- SECRETS ---
|
||||
SSH_HOST: ${{ secrets.SSH_HOST }}
|
||||
SSH_USER: ${{ secrets.SSH_USER }}
|
||||
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
SSH_PORT: ${{ secrets.SSH_PORT || 22 }}
|
||||
|
||||
jobs:
|
||||
prepare_deployment_vars:
|
||||
name: Prepare deployment vars
|
||||
# ------------------------------------------------------------------
|
||||
# STAGE 1: PREPARE
|
||||
# Calculate dynamic paths (like PR folders) so other jobs can use them
|
||||
# ------------------------------------------------------------------
|
||||
prepare_context:
|
||||
name: Prepare Context
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
deploy_path: ${{ steps.set-vars.outputs.deploy_path }}
|
||||
pr_path: ${{ steps.calc.outputs.pr_path }}
|
||||
steps:
|
||||
- name: Set deployment variables
|
||||
id: set-vars
|
||||
- id: calc
|
||||
run: |
|
||||
REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2)
|
||||
# Only needed for PRs
|
||||
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
|
||||
# For PRs, create a unique directory under the base path
|
||||
DEPLOY_PATH="${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}"
|
||||
else
|
||||
# For 'main' branch, use the specified production path.
|
||||
# Fallback to a default if REMOTE_PROD_PATH is empty.
|
||||
DEPLOY_PATH="${REMOTE_PROD_PATH:-${REMOTE_DEPLOY_PATH}/main}"
|
||||
echo "pr_path=${REMOTE_DEPLOY_PATH}/${REPO_NAME}-pr-${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
echo "DEPLOY_PATH=${DEPLOY_PATH}" >> $GITHUB_ENV
|
||||
echo "deploy_path=${DEPLOY_PATH}" >> $GITHUB_OUTPUT
|
||||
echo "DEPLOY_PATH will be: ${DEPLOY_PATH}"
|
||||
|
||||
create_remote_directory:
|
||||
name: Create remote directory
|
||||
# ------------------------------------------------------------------
|
||||
# STAGE 2: DEPLOY PREVIEW (DEV)
|
||||
# Runs only on Pull Requests
|
||||
# ------------------------------------------------------------------
|
||||
deploy_preview:
|
||||
name: Deploy (Dev/Preview)
|
||||
runs-on: ubuntu-latest
|
||||
needs: prepare_deployment_vars
|
||||
if: |
|
||||
(github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
|
||||
|| github.ref == 'refs/heads/main'
|
||||
needs: prepare_context
|
||||
if: github.event_name == 'pull_request' && github.event.action != 'closed'
|
||||
steps:
|
||||
- name: Setup SSH
|
||||
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
|
||||
with:
|
||||
ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
|
||||
- uses: actions/checkout@v4
|
||||
- uses: webfactory/ssh-agent@v0.9.0
|
||||
with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
|
||||
|
||||
- name: Add host to known_hosts
|
||||
- name: Sync & Build
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
|
||||
echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
|
||||
exit 1
|
||||
}
|
||||
chmod 644 ~/.ssh/known_hosts
|
||||
# 1. Setup Known Hosts
|
||||
mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
|
||||
|
||||
# 2. Define Target
|
||||
TARGET="${{ needs.prepare_context.outputs.pr_path }}"
|
||||
|
||||
# 3. Create Remote Dir
|
||||
ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
|
||||
|
||||
- name: Create directory on remote
|
||||
run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "mkdir -p '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'"
|
||||
# 4. Sync Files (Exclude .git to save bandwidth)
|
||||
rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
|
||||
--exclude '.git/' --exclude '.github/' \
|
||||
./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
|
||||
|
||||
sync_repo_files:
|
||||
name: Sync repository files
|
||||
# 5. Build and Run on Server
|
||||
ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
|
||||
cd '$TARGET'
|
||||
docker compose --env-file dev.env -f docker-compose.yaml up -d --build --remove-orphans
|
||||
"
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# STAGE 3: DEPLOY STAGING
|
||||
# Runs on 'main'. Always runs before Prod.
|
||||
# ------------------------------------------------------------------
|
||||
deploy_staging:
|
||||
name: Deploy (Staging)
|
||||
runs-on: ubuntu-latest
|
||||
needs: [create_remote_directory, prepare_deployment_vars]
|
||||
if: |
|
||||
(github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
|
||||
|| github.ref == 'refs/heads/main'
|
||||
if: github.ref == 'refs/heads/main'
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
|
||||
- uses: actions/checkout@v4
|
||||
- uses: webfactory/ssh-agent@v0.9.0
|
||||
with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
|
||||
|
||||
- name: Sync files via scp
|
||||
uses: appleboy/scp-action@master
|
||||
with:
|
||||
host: ${{ env.SSH_HOST }}
|
||||
username: ${{ env.SSH_USER }}
|
||||
key: ${{ env.SSH_PRIVATE_KEY }}
|
||||
port: ${{ env.SSH_PORT }}
|
||||
source: "./"
|
||||
target: "${{ needs.prepare_deployment_vars.outputs.deploy_path }}"
|
||||
- name: Sync & Build
|
||||
run: |
|
||||
mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
|
||||
|
||||
TARGET="${{ env.REMOTE_STAGING_PATH }}"
|
||||
|
||||
ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
|
||||
|
||||
- name: Sync file via scp (staging)
|
||||
if: github.ref == 'refs/heads/main'
|
||||
uses: appleboy/scp-action@master
|
||||
with:
|
||||
host: ${{ env.SSH_HOST }}
|
||||
username: ${{ env.SSH_USER }}
|
||||
key: ${{ env.SSH_PRIVATE_KEY }}
|
||||
port: ${{ env.SSH_PORT }}
|
||||
source: "./"
|
||||
target: ${{ env.REMOTE_STAGING_PATH }}
|
||||
rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
|
||||
--exclude '.git/' --exclude '.github/' \
|
||||
./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
|
||||
|
||||
run_docker_compose_dev:
|
||||
name: Run docker-compose remotely (Dev)
|
||||
ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
|
||||
cd '$TARGET'
|
||||
docker compose --env-file staging.env -f docker-compose.yaml up -d --build --remove-orphans
|
||||
"
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# STAGE 4: DEPLOY PRODUCTION
|
||||
# Runs on 'main'. DEPENDS ON STAGING SUCCESS.
|
||||
# ------------------------------------------------------------------
|
||||
deploy_prod:
|
||||
name: Deploy (Production)
|
||||
runs-on: ubuntu-latest
|
||||
needs: [sync_repo_files, prepare_deployment_vars]
|
||||
if: |
|
||||
(github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.merged == false)
|
||||
needs: deploy_staging # <--- This is the key logic separation
|
||||
if: github.ref == 'refs/heads/main'
|
||||
steps:
|
||||
- name: Setup SSH
|
||||
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
|
||||
with:
|
||||
ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
|
||||
- uses: actions/checkout@v4
|
||||
- uses: webfactory/ssh-agent@v0.9.0
|
||||
with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
|
||||
|
||||
- name: Add host to known_hosts
|
||||
- name: Sync & Build
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
|
||||
echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
|
||||
exit 1
|
||||
}
|
||||
chmod 644 ~/.ssh/known_hosts
|
||||
mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
|
||||
|
||||
TARGET="${{ env.REMOTE_PROD_PATH }}"
|
||||
|
||||
ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "mkdir -p '$TARGET'"
|
||||
|
||||
- name: Run docker-compose on remote host
|
||||
run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file dev.env -f docker-compose.yaml up -d --build"
|
||||
rsync -avz -e "ssh -p ${{ env.SSH_PORT }}" \
|
||||
--exclude '.git/' --exclude '.github/' \
|
||||
./ ${{ env.SSH_USER }}@${{ env.SSH_HOST }}:$TARGET/
|
||||
|
||||
run_docker_compose_staging:
|
||||
name: Run docker-compose remotely (Staging)
|
||||
# Note: Since Staging just built this commit on the same server,
|
||||
# this build step will be nearly instant (using Docker cache).
|
||||
ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
|
||||
cd '$TARGET'
|
||||
docker compose --env-file prod.env -f docker-compose.yaml up -d --build --remove-orphans
|
||||
"
|
||||
|
||||
# ------------------------------------------------------------------
|
||||
# CLEANUP (On PR Close)
|
||||
# ------------------------------------------------------------------
|
||||
cleanup:
|
||||
name: Cleanup Preview
|
||||
runs-on: ubuntu-latest
|
||||
needs: [sync_repo_files, prepare_deployment_vars]
|
||||
if: |
|
||||
(github.ref == 'refs/heads/main')
|
||||
needs: prepare_context
|
||||
if: github.event_name == 'pull_request' && (github.event.action == 'closed' || github.event.pull_request.merged == true)
|
||||
steps:
|
||||
- name: Setup SSH
|
||||
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
|
||||
with:
|
||||
ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
|
||||
- uses: webfactory/ssh-agent@v0.9.0
|
||||
with: { ssh-private-key: ${{ env.SSH_PRIVATE_KEY }} }
|
||||
|
||||
- name: Add host to known_hosts
|
||||
- name: Remove Remote Environment
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
|
||||
echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
|
||||
exit 1
|
||||
}
|
||||
chmod 644 ~/.ssh/known_hosts
|
||||
|
||||
- name: Run docker-compose on remote host
|
||||
run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${REMOTE_STAGING_PATH}' && docker-compose --env-file staging.env -f docker-compose.yaml up -d --build"
|
||||
|
||||
run_docker_compose_prod:
|
||||
name: Run docker-compose remotely (Prod)
|
||||
runs-on: ubuntu-latest
|
||||
needs: [sync_repo_files, prepare_deployment_vars]
|
||||
if: |
|
||||
(github.ref == 'refs/heads/main')
|
||||
steps:
|
||||
- name: Setup SSH
|
||||
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
|
||||
with:
|
||||
ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
|
||||
|
||||
- name: Add host to known_hosts
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
|
||||
echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
|
||||
exit 1
|
||||
}
|
||||
chmod 644 ~/.ssh/known_hosts
|
||||
|
||||
- name: Run docker-compose on remote host
|
||||
run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose --env-file prod.env -f docker-compose.yaml up -d --build"
|
||||
|
||||
cleanup_mr_environment:
|
||||
name: Cleanup MR environment
|
||||
runs-on: ubuntu-latest
|
||||
needs: prepare_deployment_vars
|
||||
if: |
|
||||
github.event_name == 'pull_request' &&
|
||||
(github.event.action == 'closed' || github.event.pull_request.merged == true)
|
||||
steps:
|
||||
- name: Setup SSH
|
||||
uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
|
||||
with:
|
||||
ssh-private-key: ${{ env.SSH_PRIVATE_KEY }}
|
||||
|
||||
- name: Add host to known_hosts
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
chmod 700 ~/.ssh
|
||||
ssh-keyscan -p "$SSH_PORT" -T 10 -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null || {
|
||||
echo "::error::Failed to ssh-keyscan $SSH_HOST:$SSH_PORT"
|
||||
exit 1
|
||||
}
|
||||
chmod 644 ~/.ssh/known_hosts
|
||||
|
||||
- name: Run docker-compose down on remote host
|
||||
run: ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "cd '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' && docker-compose down"
|
||||
|
||||
- name: Delete deployment directory
|
||||
run: |
|
||||
ssh -p "$SSH_PORT" $SSH_USER@$SSH_HOST "if [ -d '${{ needs.prepare_deployment_vars.outputs.deploy_path }}' ]; then rm -rf '${{ needs.prepare_deployment_vars.outputs.deploy_path }}'; echo 'Directory removed.'; else echo 'Directory not found, skipping.'; fi"
|
||||
mkdir -p ~/.ssh && ssh-keyscan -p ${{ env.SSH_PORT }} ${{ env.SSH_HOST }} >> ~/.ssh/known_hosts
|
||||
|
||||
TARGET="${{ needs.prepare_context.outputs.pr_path }}"
|
||||
|
||||
ssh -p ${{ env.SSH_PORT }} ${{ env.SSH_USER }}@${{ env.SSH_HOST }} "
|
||||
if [ -d '$TARGET' ]; then
|
||||
cd '$TARGET'
|
||||
docker compose down -v || true
|
||||
cd ..
|
||||
rm -rf '$TARGET'
|
||||
echo 'Cleanup successful'
|
||||
else
|
||||
echo 'Directory not found, skipping.'
|
||||
fi
|
||||
"
|
||||
3
dev.env
3
dev.env
@@ -4,5 +4,4 @@ ENV=dev
|
||||
NETWORK_NAME=proxy
|
||||
CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
DOMAIN=dev.kovagoadi.hu
|
||||
TRAEFIK_LEGACY_OPT=
|
||||
EXTRA_NETWORK=proxy
|
||||
TRAEFIK_LEGACY_OPT=
|
||||
50
docker-compose.prod.yaml
Normal file
50
docker-compose.prod.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
services:
|
||||
traefik:
|
||||
image: "traefik:v3.6@sha256:aaf0f6185419a50c74651448c1a5bf4606bd2d2ddb7b8749eed505d55bf8b8ea"
|
||||
restart: unless-stopped
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
networks:
|
||||
- proxy
|
||||
command:
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
- "--providers.docker.network=proxy"
|
||||
- "--providers.docker.constraints=Label(`env`, `${ENV}`)"
|
||||
- "--entryPoints.web.address=:80"
|
||||
- "--entryPoints.https.address=:443"
|
||||
- "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
|
||||
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
|
||||
- "--certificatesresolvers.letsencrypt.acme.email=kovagoadi@gmail.com"
|
||||
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
|
||||
- "--certificatesResolvers.letsencrypt.acme.caServer=${CERTBOT_CA_RESOLVER}"
|
||||
- "${TRAEFIK_LEGACY_OPT:-}"
|
||||
- "--providers.file.watch=true"
|
||||
ports:
|
||||
- "${PORT}:80"
|
||||
- "${HTTPS_PORT}:443"
|
||||
- "8080"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock:ro"
|
||||
- "./data/letsencrypt:/letsencrypt"
|
||||
- "./${ENV}/forward-to-legacy-nginx.yaml:/etc/traefik/forward-to-legacy-nginx.yaml"
|
||||
|
||||
whoami:
|
||||
image: "traefik/whoami@sha256:200689790a0a0ea48ca45992e0450bc26ccab5307375b41c84dfc4f2475937ab"
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- proxy
|
||||
labels:
|
||||
- "env=${ENV}"
|
||||
- "traefik.enable=true"
|
||||
- "traefik.http.routers.whoami.rule=Host(`test-whoami.${DOMAIN}`)"
|
||||
- "traefik.http.routers.https.rule=Host(`test-whoami.${DOMAIN}`)"
|
||||
- "traefik.http.routers.whoami.entrypoints=web"
|
||||
- traefik.http.routers.https.entrypoints=https
|
||||
- traefik.http.routers.https.tls=true
|
||||
- traefik.http.routers.https.tls.certresolver=letsencrypt
|
||||
networks:
|
||||
proxy:
|
||||
legacy-nginx:
|
||||
name: proxy
|
||||
external: true
|
||||
@@ -6,7 +6,6 @@ services:
|
||||
- no-new-privileges:true
|
||||
networks:
|
||||
- proxy
|
||||
- ${EXTRA_NETWORK}
|
||||
command:
|
||||
- "--providers.docker=true"
|
||||
- "--providers.docker.exposedbydefault=false"
|
||||
|
||||
3
prod.env
3
prod.env
@@ -4,5 +4,4 @@ ENV=prod
|
||||
NETWORK_NAME=proxy
|
||||
CERTBOT_CA_RESOLVER=https://acme-v02.api.letsencrypt.org/directory
|
||||
DOMAIN=kovagoadi.hu
|
||||
TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
|
||||
EXTRA_NETWORK=legacy-nginx
|
||||
TRAEFIK_LEGACY_OPT="--providers.file.filename=/etc/traefik/forward-to-legacy-nginx.yaml"
|
||||
@@ -4,5 +4,4 @@ ENV=staging
|
||||
NETWORK_NAME=proxy
|
||||
CERTBOT_CA_RESOLVER=https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
DOMAIN=staging.kovagoadi.hu
|
||||
TRAEFIK_LEGACY_OPT=
|
||||
EXTRA_NETWORK=proxy
|
||||
TRAEFIK_LEGACY_OPT=
|
||||
Reference in New Issue
Block a user