forked from EduCraft/curriculum-project-hub
hongjr03
7269480abb
Add deploy_fleet_release.sh and a workflow that rolls immutable Hub releases (including admin-web) to educraft-dev on push/PR and educraft on main/tags, selecting silos by HUB_PUBLIC_BASE_URL middle domain.
127 lines
4.9 KiB
YAML
127 lines
4.9 KiB
YAML
name: deploy admin (hub fleet)
|
|
|
|
# Rolls Hub releases that include the org-admin SPA (`admin-web` → registerStaticSpa)
|
|
# onto the managed Alpha host. Two fleets share one machine and are separated by
|
|
# the middle DNS label of each Silo's public URL:
|
|
#
|
|
# dev → https://<slug>.educraft-dev.paradigm-edu.net (every push + PR)
|
|
# prod → https://<slug>.educraft.paradigm-edu.net (main + tags)
|
|
#
|
|
# Example prod tenant:
|
|
# https://para-26071100.educraft.paradigm-edu.net/auth/feishu/para-26071100
|
|
#
|
|
# Required Gitea secret:
|
|
# DEPLOY_SSH_KEY — private key for root@39.107.254.4
|
|
#
|
|
# Optional secrets / vars (defaults match NEW_SILO_RUNBOOK):
|
|
# DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_PORT, DEPLOY_BASE
|
|
# vars.ALLOW_EMPTY_FLEET=1 — green when the fleet has no silos yet
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- "hub/**"
|
|
- ".gitea/workflows/deploy-admin.yml"
|
|
pull_request:
|
|
paths:
|
|
- "hub/**"
|
|
- ".gitea/workflows/deploy-admin.yml"
|
|
workflow_dispatch:
|
|
inputs:
|
|
fleet:
|
|
description: "Which fleet to deploy (dev | prod | both)"
|
|
required: true
|
|
default: both
|
|
allow_empty_fleet:
|
|
description: "Succeed if no silo matches (1/0)"
|
|
required: false
|
|
default: "0"
|
|
|
|
concurrency:
|
|
group: deploy-admin-host
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy-dev:
|
|
name: deploy fleet dev (educraft-dev)
|
|
runs-on: ubuntu-latest
|
|
if: >
|
|
github.event_name == 'pull_request' ||
|
|
(github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) ||
|
|
(github.event_name == 'workflow_dispatch' &&
|
|
(github.event.inputs.fleet == 'dev' || github.event.inputs.fleet == 'both'))
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
|
|
- name: Install rsync + ssh
|
|
run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
|
|
|
|
- name: Deploy Hub + admin SPA to educraft-dev fleet
|
|
env:
|
|
CPH_FLEET: dev
|
|
PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
|
PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
|
|
PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
|
|
PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
|
|
ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
|
|
DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
|
|
echo "missing secret DEPLOY_SSH_KEY" >&2
|
|
exit 1
|
|
fi
|
|
key="$(mktemp)"
|
|
trap 'rm -f "$key"' EXIT
|
|
printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
|
|
chmod 600 "$key"
|
|
export PLATFORM_DEPLOY_SSH_KEY="$key"
|
|
# Apply managed-host defaults when secrets are unset.
|
|
export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
|
|
export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
|
|
export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
|
|
export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
|
|
bash hub/deploy/deploy_fleet_release.sh
|
|
|
|
deploy-prod:
|
|
name: deploy fleet prod (educraft)
|
|
runs-on: ubuntu-latest
|
|
if: >
|
|
(github.event_name == 'push' && github.ref == 'refs/heads/main') ||
|
|
(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
|
|
(github.event_name == 'workflow_dispatch' &&
|
|
(github.event.inputs.fleet == 'prod' || github.event.inputs.fleet == 'both'))
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
|
|
- name: Install rsync + ssh
|
|
run: sudo apt-get update && sudo apt-get install -y rsync openssh-client
|
|
|
|
- name: Deploy Hub + admin SPA to educraft fleet
|
|
env:
|
|
CPH_FLEET: prod
|
|
PLATFORM_DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
PLATFORM_DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
|
PLATFORM_DEPLOY_PORT: ${{ secrets.DEPLOY_SSH_PORT }}
|
|
PLATFORM_DEPLOY_BASE: ${{ secrets.DEPLOY_BASE }}
|
|
PLATFORM_DEPLOY_RELEASE: ${{ github.sha }}
|
|
ALLOW_EMPTY_FLEET: ${{ github.event.inputs.allow_empty_fleet || vars.ALLOW_EMPTY_FLEET || '0' }}
|
|
DEPLOY_SSH_KEY_BODY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${DEPLOY_SSH_KEY_BODY:-}" ]; then
|
|
echo "missing secret DEPLOY_SSH_KEY" >&2
|
|
exit 1
|
|
fi
|
|
key="$(mktemp)"
|
|
trap 'rm -f "$key"' EXIT
|
|
printf '%s\n' "$DEPLOY_SSH_KEY_BODY" >"$key"
|
|
chmod 600 "$key"
|
|
export PLATFORM_DEPLOY_SSH_KEY="$key"
|
|
export PLATFORM_DEPLOY_HOST="${PLATFORM_DEPLOY_HOST:-39.107.254.4}"
|
|
export PLATFORM_DEPLOY_USER="${PLATFORM_DEPLOY_USER:-root}"
|
|
export PLATFORM_DEPLOY_PORT="${PLATFORM_DEPLOY_PORT:-22}"
|
|
export PLATFORM_DEPLOY_BASE="${PLATFORM_DEPLOY_BASE:-/srv/curriculum-project-hub}"
|
|
bash hub/deploy/deploy_fleet_release.sh
|