mivanchenko
6b7d47fa4c
actions/checkout@v4 failed with "Cannot find: node in PATH" (the runner intentionally has no Node toolchain). Replaced with a plain git clone authenticated via a new DEPLOY_TOKEN Gitea Actions secret, since the repo needs auth even for a read-only clone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
66 lines
2.5 KiB
YAML
66 lines
2.5 KiB
YAML
name: Deploy backoffice (smb-crm)
|
|
|
|
# Manual only, on purpose: this runner has docker-compose access on the
|
|
# homelab host, so triggering it is equivalent to a deploy. Only Gitea users
|
|
# with write access to this repo can see/press the "Run workflow" button —
|
|
# that's the access boundary, so keep collaborator roles deliberate as more
|
|
# people join (see TODO.md).
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
ref:
|
|
description: "Branch/tag/commit to deploy"
|
|
required: false
|
|
default: "main"
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: [self-hosted, homelab]
|
|
steps:
|
|
# Plain git clone instead of actions/checkout@v4: that action is
|
|
# Node.js-based, and this runner deliberately has no Node toolchain
|
|
# (host-mode jobs run directly on the homelab, kept minimal). Auth is
|
|
# via the DEPLOY_TOKEN Actions secret (repo is private); the token is
|
|
# stripped from the stored remote URL right after cloning.
|
|
- name: Checkout
|
|
env:
|
|
DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
find . -mindepth 1 -delete
|
|
git clone --depth 1 --branch "${{ inputs.ref }}" \
|
|
"http://${DEPLOY_TOKEN}@172.24.0.2:3000/BPPP/smb-online.git" .
|
|
git remote set-url origin http://172.24.0.2:3000/BPPP/smb-online.git
|
|
|
|
# Only db/ and app/ — never touch secrets/ or .env, which live only on
|
|
# the host and aren't in the repo.
|
|
- name: Sync backoffice files
|
|
run: |
|
|
set -euo pipefail
|
|
rsync -a --delete backoffice/db/ /home/mivanchenko/smb-crm/db/
|
|
rsync -a --delete backoffice/app/ /home/mivanchenko/smb-crm/app/
|
|
|
|
# init.sql is all CREATE ... IF NOT EXISTS, so re-running it against the
|
|
# live DB on every deploy is safe and needs no separate migration tool.
|
|
- name: Apply pending schema changes
|
|
run: docker exec -i smb-db psql -U smbcrm -d smbcrm < backoffice/db/init.sql
|
|
|
|
- name: Build and restart smb-crm
|
|
run: |
|
|
cd /home/mivanchenko/smb-crm
|
|
docker compose build smb-crm
|
|
docker compose up -d --no-deps smb-crm
|
|
|
|
- name: Health check
|
|
run: |
|
|
set -euo pipefail
|
|
for i in $(seq 1 10); do
|
|
if docker exec smb-crm python3 -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8080/healthz').status==200 else 1)"; then
|
|
echo "smb-crm healthy"
|
|
exit 0
|
|
fi
|
|
sleep 2
|
|
done
|
|
echo "smb-crm failed health check after deploy" >&2
|
|
exit 1
|