145 lines
5.1 KiB
YAML
145 lines
5.1 KiB
YAML
name: Build and Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
# One file, two lifecycles. The app pair (frontend + backend) moves with
|
|
# most commits; the lean image carries Mathlib and is heavy to build and
|
|
# push, so its job runs only when lean/** actually changed. This step reads
|
|
# the pushed diff and opens the gates for the jobs below.
|
|
changes:
|
|
runs-on: docker
|
|
|
|
outputs:
|
|
app: ${{ steps.filter.outputs.app }}
|
|
lean: ${{ steps.filter.outputs.lean }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: What changed?
|
|
id: filter
|
|
env:
|
|
BEFORE: ${{ github.event.before }}
|
|
AFTER: ${{ github.event.after }}
|
|
run: |
|
|
# Manual runs, first pushes or rewritten history carry no usable
|
|
# "before" commit — rebuild everything rather than guess.
|
|
if [ -z "${BEFORE}" ] || [ -z "${BEFORE//0/}" ] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
|
|
echo "app=yes" >> "$GITHUB_OUTPUT"
|
|
echo "lean=yes" >> "$GITHUB_OUTPUT"
|
|
echo "app=yes lean=yes (no usable before-commit)"
|
|
exit 0
|
|
fi
|
|
changed=$(git diff --name-only "$BEFORE" "$AFTER")
|
|
lean=no
|
|
app=no
|
|
if [ -n "$changed" ]; then
|
|
if echo "$changed" | grep -q '^lean/'; then lean=yes; fi
|
|
if echo "$changed" | grep -qvx 'lean/.*'; then app=yes; fi
|
|
fi
|
|
echo "app=$app" >> "$GITHUB_OUTPUT"
|
|
echo "lean=$lean" >> "$GITHUB_OUTPUT"
|
|
echo "app=$app lean=$lean"
|
|
|
|
# The wiki app itself. Its deploy (`compose pull && up -d`) also pulls
|
|
# whatever mathew-lean:latest the registry holds — the lean job keeps it current.
|
|
deploy:
|
|
runs-on: docker
|
|
needs: changes
|
|
if: needs.changes.outputs.app == 'yes'
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install SSH client
|
|
run: |
|
|
apt-get update -y && apt-get install -y openssh-client
|
|
|
|
- name: Setup SSH inside container
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
|
|
# Add the container host to known_hosts
|
|
ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts
|
|
|
|
- name: Log in to registry
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build frontend
|
|
run: |
|
|
docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-frontend:latest ./frontend
|
|
docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-frontend:latest
|
|
|
|
- name: Build backend
|
|
run: |
|
|
docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-backend:latest ./backend
|
|
docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-backend:latest
|
|
|
|
- name: Copy files
|
|
run: |
|
|
scp docker-compose.yml deploy@${{ secrets.DEPLOY_HOST }}:/var/www/app/
|
|
scp nginx.conf deploy@${{ secrets.DEPLOY_HOST }}:/var/www/app/nginx.conf
|
|
|
|
- name: Deploy
|
|
run: |
|
|
ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
cd /var/www/app/
|
|
docker compose pull
|
|
docker compose up -d --remove-orphans
|
|
EOF
|
|
|
|
# The Lean editor (lean4web): multi-stage, heavy by nature (it fetches
|
|
# Mathlib); expect a long build and a multi-GB push. Pin upstream with:
|
|
# docker build --build-arg LEAN4WEB_REF=v0.2.2 ...
|
|
deploy-lean:
|
|
runs-on: docker
|
|
needs: changes
|
|
if: needs.changes.outputs.lean == 'yes'
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install SSH client
|
|
run: |
|
|
apt-get update -y && apt-get install -y openssh-client
|
|
|
|
- name: Setup SSH inside container
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
|
|
# Add the container host to known_hosts
|
|
ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts
|
|
|
|
- name: Log in to registry
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build lean editor server
|
|
run: |
|
|
docker build -t git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest ./lean
|
|
docker push git.aranroig.com/${{ secrets.REGISTRY_USER }}/mathew-lean:latest
|
|
|
|
- name: Deploy
|
|
run: |
|
|
ssh deploy@${{ secrets.DEPLOY_HOST }} << 'EOF'
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.aranroig.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
cd /var/www/app/
|
|
docker compose pull lean
|
|
docker compose up -d lean
|
|
EOF
|