pkirillw
81feeda6fc
All checks were successful
Deploy / deploy (push) Successful in 1m23s
Прогон sync-workflows.sh 2026-10-16 при добавлении caddy — закрывает известный дрейф deploy.yml старого поколения. Co-Authored-By: Claude Code <noreply@anthropic.com>
103 lines
4.4 KiB
YAML
103 lines
4.4 KiB
YAML
name: Deploy
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
workflow_dispatch:
|
||
|
||
# !!! Сгенерировано из ci-templates/deploy.template.yml скриптом sync-workflows.sh.
|
||
# !!! Правь ШАБЛОН и прогоняй sync, а не этот файл вручную.
|
||
#
|
||
# Раннер Gitea не умеет тянуть внешние uses:-actions (mkdir /.cache: permission
|
||
# denied), поэтому весь деплой — inline через SSH, без actions/checkout и т.п.
|
||
jobs:
|
||
deploy:
|
||
runs-on: ubuntu-latest
|
||
env:
|
||
SERVICE: max-bot-test
|
||
REPO: max-bot-test
|
||
HEALTHCHECK: ""
|
||
BUILD: "true"
|
||
SERVER_HOST: ${{ vars.SERVER_HOST }}
|
||
SERVER_PORT: ${{ vars.SERVER_PORT }}
|
||
SERVER_USER: ${{ vars.SERVER_USER }}
|
||
SERVER_BASE: ${{ vars.SERVER_BASE }}
|
||
NTFY_URL: ${{ vars.NTFY_URL }}
|
||
steps:
|
||
- name: Setup SSH
|
||
env:
|
||
SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||
run: |
|
||
mkdir -p ~/.ssh
|
||
printf '%s\n' "$SSH_KEY" | sed 's/^[[:space:]]*//' > ~/.ssh/id_rsa
|
||
chmod 600 ~/.ssh/id_rsa
|
||
ssh-keyscan -p "$SERVER_PORT" "$SERVER_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
||
|
||
- name: Clone or reset repo on server
|
||
env:
|
||
GIT_TOKEN: ${{ secrets.GIT_TOKEN }}
|
||
run: |
|
||
# Аутентификация git к приватным репо через http.extraHeader (токен не
|
||
# оседает в .git/config сервера). fetch и reset — РАЗДЕЛЬНО, иначе при
|
||
# set -e ошибка fetch в 'fetch && reset' молча проглатывается.
|
||
AUTH="http.extraHeader=Authorization: token ${GIT_TOKEN}"
|
||
ssh -i ~/.ssh/id_rsa -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "
|
||
set -e
|
||
URL=https://git.pkirillw-server.ru/pkirillw/$REPO.git
|
||
if [ -d '$SERVER_BASE/$SERVICE/.git' ]; then
|
||
cd '$SERVER_BASE/$SERVICE'
|
||
git rev-parse HEAD > /tmp/deploy_prev_$SERVICE 2>/dev/null || : > /tmp/deploy_prev_$SERVICE
|
||
git -c \"$AUTH\" fetch origin main
|
||
git reset --hard origin/main
|
||
elif [ -d '$SERVER_BASE/$SERVICE' ]; then
|
||
# папка есть, но не git (развёрнуто вручную) — инициализируем на месте
|
||
cd '$SERVER_BASE/$SERVICE'
|
||
git init -q
|
||
git remote add origin \$URL 2>/dev/null || git remote set-url origin \$URL
|
||
git -c \"$AUTH\" fetch origin main
|
||
git reset --hard origin/main
|
||
: > /tmp/deploy_prev_$SERVICE
|
||
else
|
||
mkdir -p '$SERVER_BASE'
|
||
cd '$SERVER_BASE'
|
||
git -c \"$AUTH\" clone \$URL '$SERVICE'
|
||
: > /tmp/deploy_prev_$SERVICE
|
||
fi"
|
||
|
||
|
||
- name: Deploy
|
||
run: |
|
||
if [ "$BUILD" = "true" ]; then CMD="docker compose up -d --build"; else CMD="docker compose pull && docker compose up -d"; fi
|
||
ssh -i ~/.ssh/id_rsa -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "
|
||
set -e
|
||
cd '$SERVER_BASE/$SERVICE'
|
||
$CMD
|
||
docker image prune -f"
|
||
|
||
- name: Health check
|
||
if: ${{ env.HEALTHCHECK != '' }}
|
||
run: |
|
||
ok=""
|
||
for i in $(seq 1 5); do
|
||
if ssh -i ~/.ssh/id_rsa -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "curl -fsS -m 5 '$HEALTHCHECK' >/dev/null 2>&1"; then ok=1; break; fi
|
||
sleep 5
|
||
done
|
||
[ -n "$ok" ] || { echo "::error::health-check не прошёл: $HEALTHCHECK"; exit 1; }
|
||
|
||
- name: Rollback on failure
|
||
if: failure()
|
||
run: |
|
||
ssh -i ~/.ssh/id_rsa -p "$SERVER_PORT" "$SERVER_USER@$SERVER_HOST" "
|
||
PREV=\$(cat /tmp/deploy_prev_$SERVICE 2>/dev/null || true)
|
||
if [ -n \"\$PREV\" ]; then
|
||
echo 'Откат на '\$PREV
|
||
cd '$SERVER_BASE/$SERVICE' && git reset --hard \$PREV && docker compose up -d || true
|
||
fi"
|
||
|
||
- name: Notify ntfy
|
||
if: always()
|
||
run: |
|
||
[ -n "$NTFY_URL" ] || exit 0
|
||
if [ "${{ job.status }}" = "success" ]; then T="✅ $SERVICE задеплоен"; P=default; G=white_check_mark; else T="❌ $SERVICE: деплой упал"; P=high; G=rotating_light; fi
|
||
curl -fsS -H "Title: $T" -H "Priority: $P" -H "Tags: $G" -d "commit ${{ github.sha }}" "$NTFY_URL" || true
|