Claude Fable 5
28f05e270d
All checks were successful
CD / Build and push images (push) Successful in 1m5s
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m6s
CD / Promote to Int (push) Successful in 10s
CI / Lint, typecheck, test (push) Successful in 3m33s
CI / Build container images (push) Has been skipped
Release / Build release images and notes (push) Successful in 1m1s
Prod deploy / Deploy the released images to Prod (push) Successful in 14s
CI / Auth e2e pack (push) Successful in 5m31s
CI / Import/export fidelity gate (push) Successful in 47s
Pushing vX.Y.Z builds the four semver images and publishes a Gitea release whose notes list the changes since the previous release with a migration call-out derived from the migrations diff (the repo is trunk-based — commit subjects stand in for PR titles). Deploying to Prod is a separate human act: pushing prod-vX.Y.Z-<suffix> — Gitea 1.22 has no environment approvals, so the tag push is the gate — verifies the release images exist, pins TAG in the Prod .env, restarts the stack, and waits for readiness; rollbacks are new suffix tags on the previous release. The Prod stage is provisioned on ONE (ports 8120-8122, secrets generated on the host, full backup profile); deploy/go-live.md carries the executed mechanics and the operator checklist that blocks the DNS switch (DNS, Caddy block, wizard/SMTP, legal texts, monitors, Prod drill, BASEL mirror). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
62 lines
2.4 KiB
YAML
62 lines
2.4 KiB
YAML
# Prod deploy behind the manual gate (issue #89): after reviewing a
|
|
# published release vX.Y.Z, a human pushes `prod-vX.Y.Z-<suffix>` — that
|
|
# tag push IS the approval (Gitea 1.22 has no environment approvals; move
|
|
# to a real environment gate on 1.23+). The suffix keeps tags unique, so
|
|
# re-deploys and rollbacks are just new tags pointing at the same release:
|
|
# git tag prod-v0.1.0-initial && git push origin prod-v0.1.0-initial
|
|
# git tag prod-v0.1.0-rollback1 && git push origin prod-v0.1.0-rollback1
|
|
|
|
name: Prod deploy
|
|
|
|
on:
|
|
push:
|
|
tags: ['prod-v*']
|
|
|
|
env:
|
|
IMAGE_BASE: gitea.101010.cloud/stwaidele/dorfteich
|
|
DEPLOY_HOST: one.101010.cloud
|
|
|
|
jobs:
|
|
deploy-prod:
|
|
name: Deploy the released images to Prod
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Resolve the release version from the tag
|
|
run: |
|
|
VERSION=$(echo "$GITHUB_REF_NAME" | grep -o 'v[0-9]\+\.[0-9]\+\.[0-9]\+' | head -n1)
|
|
[ -n "$VERSION" ] || { echo "tag $GITHUB_REF_NAME carries no vX.Y.Z version" >&2; exit 1; }
|
|
echo "VERSION=$VERSION" >> "$GITHUB_ENV"
|
|
echo "deploying release $VERSION"
|
|
|
|
- name: Verify the release images exist (never deploy unbuilt tags)
|
|
run: |
|
|
printf '%s' "${{ secrets.REGISTRY_TOKEN }}" | tr -d '[:space:]' | docker login gitea.101010.cloud -u fable-5 --password-stdin
|
|
for app in web api collab backup; do
|
|
docker buildx imagetools inspect $IMAGE_BASE-$app:$VERSION > /dev/null
|
|
done
|
|
|
|
- name: Set up SSH
|
|
run: |
|
|
mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY_TEST }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
printf '%s\n' "${{ secrets.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts
|
|
|
|
- name: Pin the version and restart the Prod stack
|
|
run: |
|
|
ssh deploy@$DEPLOY_HOST "cd /home/DOCKER/dorfteich-prod \
|
|
&& sed -i 's/^TAG=.*/TAG=$VERSION/' .env \
|
|
&& docker compose pull --quiet && docker compose up -d --remove-orphans \
|
|
&& docker compose ps"
|
|
|
|
- name: Wait for Prod readiness
|
|
run: |
|
|
for i in $(seq 1 45); do
|
|
body=$(ssh deploy@$DEPLOY_HOST 'curl -s http://127.0.0.1:8121/api/v1/readyz' || true)
|
|
case "$body" in
|
|
*'"database","status":"ok"'*) echo "readyz: $body"; exit 0 ;;
|
|
esac
|
|
sleep 4
|
|
done
|
|
echo "Prod did not become ready" >&2; exit 1
|