194 lines
8.4 KiB
YAML
194 lines
8.4 KiB
YAML
# Staging: build backend/frontend images, push to Gitea Container Registry, deploy on self-hosted runner.
|
|
#
|
|
# Triggers: push to master/main, or manual workflow_dispatch.
|
|
# Production (nudentic.ir / git tags) is a separate later workflow — this file is Windows staging only.
|
|
#
|
|
# Repository Variables (Settings → Actions → Variables):
|
|
# REGISTRY_HOST Docker registry host:port (no http/https). Windows Docker Desktop → host.docker.internal:3000
|
|
# REGISTRY_OWNER Gitea user or org that owns the packages
|
|
# PUBLIC_BASE_URL URL users open in the browser, e.g. http://wixur.ir (no trailing slash, no :8088)
|
|
# DEPLOY_SECRETS_DIR absolute path on runner, e.g. C:/dyolink/secrets
|
|
#
|
|
# Optional:
|
|
# STAGING_HTTP_PORT public HTTP port (default 80) — Windows portproxy listens here → 18088
|
|
# STAGING_LOCAL_PORT Docker bind on 127.0.0.1 (default 18088) — must not equal the public port if portproxy owns it
|
|
# CLONE_HOST git clone host when runner = Gitea host → 127.0.0.1:3000
|
|
#
|
|
# Same Windows PC runs Gitea + runner + deploy:
|
|
# CLONE_HOST → 127.0.0.1:3000 (git runs on Windows host)
|
|
# REGISTRY_HOST → host.docker.internal:3000 (docker commands run inside Docker Desktop VM)
|
|
# Gitea app.ini ROOT_URL → http://host.docker.internal:3000/ (Docker registry auth; browsers use http://wixur.ir:3000)
|
|
# PUBLIC_BASE_URL → http://wixur.ir (staging app; Gitea stays on :3000)
|
|
#
|
|
# Add host.docker.internal:3000 (and wixur.ir:3000 if you pull by public hostname) to Docker Desktop insecure-registries.
|
|
#
|
|
# Repository Secrets (Settings → Actions → Secrets):
|
|
# REGISTRY_USERNAME Gitea username for docker login
|
|
# REGISTRY_PASSWORD Gitea access token (packages:read/write) or account password
|
|
#
|
|
# Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"]
|
|
#
|
|
# Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).
|
|
|
|
name: Registry — build, push, deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main, master]
|
|
workflow_dispatch:
|
|
|
|
defaults:
|
|
run:
|
|
shell: powershell
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: windows
|
|
outputs:
|
|
image_tag: ${{ steps.meta.outputs.image_tag }}
|
|
steps:
|
|
- name: Checkout (clone from this Gitea — no gitea.com)
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($cloneHost)) {
|
|
$Server = "${{ github.server_url }}".TrimEnd('/')
|
|
} elseif ($cloneHost -match '^https?://') {
|
|
$Server = $cloneHost.TrimEnd('/')
|
|
} else {
|
|
$Server = 'http://' + $cloneHost
|
|
}
|
|
$Repo = "${{ github.repository }}"
|
|
$Branch = "${{ github.ref_name }}"
|
|
$Token = "${{ github.token }}"
|
|
$Actor = "${{ github.actor }}"
|
|
$hp = $Server -replace '^https?://', ''
|
|
if ($Server.StartsWith('https')) {
|
|
$cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
|
} else {
|
|
$cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
|
}
|
|
$env:GIT_TERMINAL_PROMPT = '0'
|
|
git clone --depth 1 --branch $Branch $cloneUrl .
|
|
|
|
- name: Image tag and registry prefix
|
|
id: meta
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$short = (git rev-parse --short HEAD).Trim()
|
|
$utf8 = New-Object System.Text.UTF8Encoding $false
|
|
[System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
|
|
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
|
|
[System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
|
|
|
|
- name: Log in to container registry
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$pass = @'
|
|
${{ secrets.REGISTRY_PASSWORD }}
|
|
'@
|
|
$pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
|
|
|
- name: Build and push backend
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$tag = "${{ steps.meta.outputs.image_tag }}"
|
|
docker build `
|
|
-t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
|
|
-t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
|
|
./backend
|
|
docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
|
|
docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"
|
|
|
|
- name: Build and push frontend
|
|
env:
|
|
PUBLIC_BASE_URL: ${{ vars.PUBLIC_BASE_URL }}
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$tag = "${{ steps.meta.outputs.image_tag }}"
|
|
$base = $env:PUBLIC_BASE_URL
|
|
docker build `
|
|
--build-arg "NEXT_PUBLIC_API_URL=$base/api" `
|
|
--build-arg "NEXT_PUBLIC_APP_URL=$base" `
|
|
--build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
|
|
-t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
|
|
-t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
|
|
./frontend
|
|
docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
|
|
docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"
|
|
|
|
deploy:
|
|
needs: build-and-push
|
|
runs-on: windows
|
|
steps:
|
|
- name: Checkout (shallow clone from this Gitea — no gitea.com)
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($cloneHost)) {
|
|
$Server = "${{ github.server_url }}".TrimEnd('/')
|
|
} elseif ($cloneHost -match '^https?://') {
|
|
$Server = $cloneHost.TrimEnd('/')
|
|
} else {
|
|
$Server = 'http://' + $cloneHost
|
|
}
|
|
$Repo = "${{ github.repository }}"
|
|
$Branch = "${{ github.ref_name }}"
|
|
$Token = "${{ github.token }}"
|
|
$Actor = "${{ github.actor }}"
|
|
$hp = $Server -replace '^https?://', ''
|
|
if ($Server.StartsWith('https')) {
|
|
$cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
|
} else {
|
|
$cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
|
}
|
|
$env:GIT_TERMINAL_PROMPT = '0'
|
|
git clone --depth 1 --branch $Branch $cloneUrl .
|
|
|
|
- name: Write deploy.registry.env and validate secrets path
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$SD = '${{ vars.DEPLOY_SECRETS_DIR }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($SD)) {
|
|
Write-Host "Set repository variable DEPLOY_SECRETS_DIR to the absolute path on this runner"
|
|
Write-Host "where database.staging.env and backend.staging.env live (not in git)."
|
|
exit 1
|
|
}
|
|
if (-not (Test-Path (Join-Path $SD "database.staging.env"))) {
|
|
Write-Host "Missing $(Join-Path $SD 'database.staging.env')"
|
|
exit 1
|
|
}
|
|
if (-not (Test-Path (Join-Path $SD "backend.staging.env"))) {
|
|
Write-Host "Missing $(Join-Path $SD 'backend.staging.env')"
|
|
exit 1
|
|
}
|
|
$stagingPort = '${{ vars.STAGING_HTTP_PORT }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' }
|
|
$localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' }
|
|
$imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
|
|
$lines = @(
|
|
"REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
|
|
"IMAGE_TAG=$imageTag",
|
|
"STAGING_HTTP_PORT=$stagingPort",
|
|
"STAGING_LOCAL_PORT=$localPort",
|
|
"DEPLOY_SECRETS_DIR=$SD"
|
|
)
|
|
Set-Location infrastructure
|
|
$lines | Set-Content -Path deploy.registry.env -Encoding utf8
|
|
|
|
- name: Log in to container registry (for pull)
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$pass = @'
|
|
${{ secrets.REGISTRY_PASSWORD }}
|
|
'@
|
|
$pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
|
|
|
- name: Pull and start stack
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
Set-Location infrastructure
|
|
docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
|
|
docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
|