252 lines
12 KiB
YAML
252 lines
12 KiB
YAML
name: Deploy Trade-In
|
||
|
||
# Forgejo Actions — отдельный pipeline для подпроекта tradein-mvp/.
|
||
# Триггерится только на изменения внутри tradein-mvp/ (или этого workflow),
|
||
# не пересекается с основным deploy.yml.
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
paths:
|
||
- "tradein-mvp/**"
|
||
- ".forgejo/workflows/deploy-tradein.yml"
|
||
workflow_dispatch:
|
||
|
||
concurrency:
|
||
group: deploy-tradein-prod
|
||
cancel-in-progress: false
|
||
|
||
env:
|
||
IMAGE_BACKEND: ghcr.io/lekss361/gendesign-tradein-backend
|
||
IMAGE_FRONTEND: ghcr.io/lekss361/gendesign-tradein-frontend
|
||
|
||
jobs:
|
||
changes:
|
||
runs-on: ubuntu-latest
|
||
outputs:
|
||
backend: ${{ steps.filter.outputs.backend }}
|
||
frontend: ${{ steps.filter.outputs.frontend }}
|
||
infra: ${{ steps.filter.outputs.infra }}
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- uses: dorny/paths-filter@v3
|
||
id: filter
|
||
with:
|
||
filters: |
|
||
backend:
|
||
- 'tradein-mvp/backend/**'
|
||
frontend:
|
||
- 'tradein-mvp/frontend/**'
|
||
infra:
|
||
- 'tradein-mvp/docker-compose.prod.yml'
|
||
- 'tradein-mvp/deploy/**'
|
||
- '.forgejo/workflows/deploy-tradein.yml'
|
||
|
||
build-backend:
|
||
runs-on: ubuntu-latest
|
||
needs: changes
|
||
if: |
|
||
needs.changes.outputs.backend == 'true' ||
|
||
needs.changes.outputs.infra == 'true' ||
|
||
github.event_name == 'workflow_dispatch'
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Login to GHCR (shell-based — docker/login-action@v3 unreliable под Forgejo Actions)
|
||
env:
|
||
GHCR_PAT: ${{ secrets.GHCR_PAT }}
|
||
run: |
|
||
echo "$GHCR_PAT" | docker login ghcr.io -u lekss361 --password-stdin
|
||
|
||
- name: Set up Docker Buildx
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
- name: Build & push tradein-backend
|
||
uses: docker/build-push-action@v6
|
||
with:
|
||
context: ./tradein-mvp/backend
|
||
push: true
|
||
cache-from: type=registry,ref=${{ env.IMAGE_BACKEND }}:buildcache
|
||
cache-to: type=registry,ref=${{ env.IMAGE_BACKEND }}:buildcache,mode=max
|
||
tags: |
|
||
${{ env.IMAGE_BACKEND }}:latest
|
||
${{ env.IMAGE_BACKEND }}:${{ github.sha }}
|
||
|
||
build-frontend:
|
||
runs-on: ubuntu-latest
|
||
needs: changes
|
||
if: |
|
||
needs.changes.outputs.frontend == 'true' ||
|
||
needs.changes.outputs.infra == 'true' ||
|
||
github.event_name == 'workflow_dispatch'
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Login to GHCR (shell-based — docker/login-action@v3 unreliable под Forgejo Actions)
|
||
env:
|
||
GHCR_PAT: ${{ secrets.GHCR_PAT }}
|
||
run: |
|
||
echo "$GHCR_PAT" | docker login ghcr.io -u lekss361 --password-stdin
|
||
|
||
- name: Set up Docker Buildx
|
||
uses: docker/setup-buildx-action@v3
|
||
|
||
- name: Build & push tradein-frontend
|
||
uses: docker/build-push-action@v6
|
||
with:
|
||
context: ./tradein-mvp/frontend
|
||
push: true
|
||
# basePath=/trade-in baked-in во время build (Next.js)
|
||
build-args: |
|
||
NEXT_PUBLIC_BASE_PATH=/trade-in
|
||
NEXT_PUBLIC_API_BASE_URL=/trade-in
|
||
cache-from: type=registry,ref=${{ env.IMAGE_FRONTEND }}:buildcache
|
||
cache-to: type=registry,ref=${{ env.IMAGE_FRONTEND }}:buildcache,mode=max
|
||
tags: |
|
||
${{ env.IMAGE_FRONTEND }}:latest
|
||
${{ env.IMAGE_FRONTEND }}:${{ github.sha }}
|
||
|
||
deploy:
|
||
runs-on: ubuntu-latest
|
||
needs: [changes, build-backend, build-frontend]
|
||
if: |
|
||
always() &&
|
||
!cancelled() &&
|
||
needs.build-backend.result != 'failure' &&
|
||
needs.build-frontend.result != 'failure'
|
||
steps:
|
||
- name: Deploy via SSH
|
||
uses: appleboy/ssh-action@v1.0.3
|
||
env:
|
||
IMAGE_TAG: latest
|
||
GHCR_PAT: ${{ secrets.GHCR_PAT }}
|
||
with:
|
||
host: ${{ secrets.DEPLOY_HOST }}
|
||
username: ${{ secrets.DEPLOY_USER }}
|
||
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
||
port: ${{ secrets.DEPLOY_PORT }}
|
||
envs: IMAGE_TAG,GHCR_PAT
|
||
script: |
|
||
set -euo pipefail
|
||
cd /opt/gendesign
|
||
|
||
# repo уже clone'ен — origin = Forgejo. Подтягиваем последний main.
|
||
git fetch origin main
|
||
git reset --hard origin/main
|
||
|
||
cd tradein-mvp
|
||
|
||
# .env.runtime создаётся вручную при первом запуске (см. README-АДМИНУ.md).
|
||
# Здесь только подгружаем переменные для docker compose (POSTGRES_PASSWORD).
|
||
if [ ! -f .env.runtime ]; then
|
||
echo "ERROR: /opt/gendesign/tradein-mvp/.env.runtime отсутствует."
|
||
echo "Создай его вручную (см. tradein-mvp/README.md или DEPLOY.md)."
|
||
exit 1
|
||
fi
|
||
chmod 600 .env.runtime
|
||
set -a; source .env.runtime; set +a
|
||
|
||
# External network для Caddy (он в основном gendesign-стеке)
|
||
docker network inspect gendesign_shared >/dev/null 2>&1 \
|
||
|| docker network create gendesign_shared
|
||
|
||
# Re-login to GHCR (PAT может быть rotated)
|
||
echo "$GHCR_PAT" | docker login ghcr.io -u lekss361 --password-stdin
|
||
|
||
export IMAGE_TAG="$IMAGE_TAG"
|
||
docker compose -p gendesign-tradein -f docker-compose.prod.yml pull
|
||
docker compose -p gendesign-tradein -f docker-compose.prod.yml up -d
|
||
|
||
# Применяем SQL миграции (если есть backend/data/sql/*.sql)
|
||
# Postgres init load *.sql из /docker-entrypoint-initdb.d ТОЛЬКО при первом
|
||
# старте volume. Здесь — для повторных миграций после первого запуска.
|
||
# Tracking через _schema_migrations (порт паттерна из deploy.yml):
|
||
# каждый .sql применяется РОВНО один раз, failed migration → exit 1
|
||
# (никаких swallowed errors). cwd = /opt/gendesign/tradein-mvp.
|
||
sleep 5
|
||
|
||
# Pre-existence detection ДО CREATE TABLE: если таблицы ещё нет, это
|
||
# первый deploy после внедрения tracking на уже-наполненной prod-БД
|
||
# (миграции 001-076 живут в схеме). 7 из них (002/003/052/053/054/063/072)
|
||
# содержат INSERT-seed БЕЗ ON CONFLICT — повторный прогон под строгим
|
||
# ON_ERROR_STOP упал бы на PK violation. Поэтому: baseline (см. ниже).
|
||
migrations_table_existed=$(docker compose -p gendesign-tradein -f docker-compose.prod.yml exec -T postgres \
|
||
psql -U "${TRADEIN_POSTGRES_USER:-tradein}" -d tradein -tAc \
|
||
"SELECT to_regclass('public._schema_migrations') IS NOT NULL;" | tr -d '[:space:]')
|
||
|
||
docker compose -p gendesign-tradein -f docker-compose.prod.yml exec -T postgres \
|
||
psql -U "${TRADEIN_POSTGRES_USER:-tradein}" -d tradein -v ON_ERROR_STOP=on -c "
|
||
CREATE TABLE IF NOT EXISTS _schema_migrations (
|
||
filename TEXT PRIMARY KEY,
|
||
applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||
);
|
||
"
|
||
|
||
if [ "$migrations_table_existed" != "t" ]; then
|
||
# BASELINE: таблицы не было → seed ВСЕ текущие миграции как applied
|
||
# БЕЗ их прогона. prod уже работает на этой схеме; помечаем её
|
||
# текущим состоянием, чтобы под строгий gate попадали только НОВЫЕ
|
||
# (077+) миграции. INSERT ... ON CONFLICT DO NOTHING — идемпотентно.
|
||
echo "→ _schema_migrations отсутствовала — baseline существующих миграций (без прогона)"
|
||
for sql_file in $(ls -1 backend/data/sql/*.sql 2>/dev/null | sort); do
|
||
fname=$(basename "$sql_file")
|
||
echo " baseline: $fname"
|
||
docker compose -p gendesign-tradein -f docker-compose.prod.yml exec -T postgres \
|
||
psql -U "${TRADEIN_POSTGRES_USER:-tradein}" -d tradein -v ON_ERROR_STOP=on -c \
|
||
"INSERT INTO _schema_migrations (filename) VALUES ('$fname') ON CONFLICT DO NOTHING;"
|
||
done
|
||
echo "Baseline complete — existing schema marked as applied."
|
||
fi
|
||
|
||
for sql_file in $(ls -1 backend/data/sql/*.sql 2>/dev/null | sort); do
|
||
fname=$(basename "$sql_file")
|
||
applied=$(docker compose -p gendesign-tradein -f docker-compose.prod.yml exec -T postgres \
|
||
psql -U "${TRADEIN_POSTGRES_USER:-tradein}" -d tradein -tAc \
|
||
"SELECT COUNT(*) FROM _schema_migrations WHERE filename='$fname'" | tr -d '[:space:]')
|
||
if [ "$applied" = "0" ]; then
|
||
echo "→ Applying migration: $fname"
|
||
docker compose -p gendesign-tradein -f docker-compose.prod.yml exec -T postgres \
|
||
psql -U "${TRADEIN_POSTGRES_USER:-tradein}" -d tradein -v ON_ERROR_STOP=on \
|
||
< "$sql_file" \
|
||
|| { echo "FAILED on migration: $fname"; exit 1; }
|
||
docker compose -p gendesign-tradein -f docker-compose.prod.yml exec -T postgres \
|
||
psql -U "${TRADEIN_POSTGRES_USER:-tradein}" -d tradein -c \
|
||
"INSERT INTO _schema_migrations (filename) VALUES ('$fname') ON CONFLICT DO NOTHING;"
|
||
else
|
||
echo "✓ Already applied: $fname"
|
||
fi
|
||
done
|
||
echo "All migrations applied."
|
||
|
||
# Retry backend lifespan hook AFTER migrations applied.
|
||
# tradein-backend startup runs ensure_fdw_user_mapping which needs
|
||
# FOREIGN SERVER gendesign_remote (created by 060_postgres_fdw_extension.sql).
|
||
# Without restart, the first compose-up's startup hook failed with
|
||
# "server gendesign_remote does not exist" because migrations hadn't run yet.
|
||
# See PR #493 deploy/1156 for the incident details.
|
||
echo "→ Restarting tradein-backend so lifespan hook retries USER MAPPING setup"
|
||
docker restart tradein-backend
|
||
# Give backend time to come up before Caddy reload + health check below
|
||
sleep 5
|
||
|
||
# Caddy reload — основной Caddyfile содержит inline tradein routes
|
||
# (см. Caddyfile в корне репы). Reload, чтобы Caddy перечитал DNS
|
||
# tradein-backend / tradein-frontend (они в gendesign_shared network).
|
||
cd /opt/gendesign
|
||
docker compose -p gendesign -f docker-compose.prod.yml exec -T caddy \
|
||
caddy reload --config /etc/caddy/Caddyfile || true
|
||
|
||
# Health check
|
||
for i in $(seq 1 30); do
|
||
docker compose -p gendesign-tradein -f /opt/gendesign/tradein-mvp/docker-compose.prod.yml \
|
||
exec -T backend curl -fsS http://localhost:8000/health && break
|
||
sleep 1
|
||
done
|
||
|
||
# Cleanup старых образов
|
||
for repo in ghcr.io/lekss361/gendesign-tradein-backend \
|
||
ghcr.io/lekss361/gendesign-tradein-frontend; do
|
||
docker images "$repo" --format '{{.Repository}}:{{.Tag}}' \
|
||
| grep -v ':latest$' | tail -n +3 \
|
||
| xargs -r docker rmi 2>/dev/null || true
|
||
done
|
||
docker image prune -af || true
|