From 5d3c4fc846a3e550b31d213855fa3b2dbaa6129b Mon Sep 17 00:00:00 2001 From: YBF <47051132+YBFACC@users.noreply.github.com> Date: Fri, 28 Aug 2026 18:19:47 +0800 Subject: [PATCH] ci: build on VPS and deploy container --- .dockerignore | 2 + .github/workflows/ci.yml | 142 ++++++++++++++++++++++++++------------- Dockerfile.server | 11 ++- 3 files changed, 105 insertions(+), 50 deletions(-) diff --git a/.dockerignore b/.dockerignore index 063907d..fef2fe3 100644 --- a/.dockerignore +++ b/.dockerignore @@ -7,6 +7,8 @@ node_modules dist **/dist .pnpm-store +.ci +**/.ci .env .env.* !.env.example diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fbe9587..5486c18 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -120,77 +120,121 @@ jobs: environment: production permissions: contents: read - packages: write env: - IMAGE_NAME: ghcr.io/${{ github.repository }}-server + IMAGE_NAME: trade-message-center-server IMAGE_TAG: ${{ github.sha }} + SOURCE_TAG: ${{ github.ref_name }} + BUILD_HOST: ${{ vars.BUILD_HOST }} + BUILD_PORT: ${{ vars.BUILD_PORT }} + BUILD_USER: ${{ vars.BUILD_USER }} + BUILD_PATH: ${{ vars.BUILD_PATH }} DEPLOY_HOST: ${{ vars.DEPLOY_HOST }} DEPLOY_PORT: ${{ vars.DEPLOY_PORT }} DEPLOY_USER: ${{ vars.DEPLOY_USER }} DEPLOY_PATH: ${{ vars.DEPLOY_PATH }} DEPLOY_CONTAINER_NAME: ${{ vars.DEPLOY_CONTAINER_NAME }} DEPLOY_HOST_PORT: ${{ vars.DEPLOY_HOST_PORT }} - GHCR_USERNAME: ${{ github.actor }} - GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} + HOST: ${{ vars.HOST }} + PORT: ${{ vars.PORT }} + DATABASE_URL: ${{ secrets.DATABASE_URL }} + BUILD_SSH_KEY: ${{ secrets.BUILD_SSH_KEY }} DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Log in to GHCR - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and push server image - uses: docker/build-push-action@v6 - with: - context: . - file: Dockerfile.server - push: true - tags: ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} - build-args: | - HOST=${{ vars.HOST }} - PORT=${{ vars.PORT }} - secrets: | - database_url=${{ secrets.DATABASE_URL }} - - - name: Install SSH key - shell: bash - run: | - install -m 700 -d "$HOME/.ssh" - printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key" - chmod 600 "$HOME/.ssh/deploy_key" - - - name: Deploy container over SSH + - name: Prepare build VPS SSH key shell: bash run: | set -euo pipefail + : "${BUILD_HOST:?BUILD_HOST is required}" + : "${BUILD_USER:?BUILD_USER is required}" + : "${BUILD_PATH:?BUILD_PATH is required}" + : "${BUILD_SSH_KEY:?BUILD_SSH_KEY is required}" + install -m 700 -d "$HOME/.ssh" + printf '%s\n' "$BUILD_SSH_KEY" > "$HOME/.ssh/build_key" + chmod 600 "$HOME/.ssh/build_key" + + - name: Build on build VPS and deploy to target server + shell: bash + run: | + set -euo pipefail + : "${BUILD_HOST:?BUILD_HOST is required}" + : "${BUILD_USER:?BUILD_USER is required}" + : "${BUILD_PATH:?BUILD_PATH is required}" + : "${SOURCE_TAG:?SOURCE_TAG is required}" + : "${HOST:?HOST is required}" + : "${PORT:?PORT is required}" + : "${DATABASE_URL:?DATABASE_URL is required}" : "${DEPLOY_HOST:?DEPLOY_HOST is required}" : "${DEPLOY_USER:?DEPLOY_USER is required}" : "${DEPLOY_PATH:?DEPLOY_PATH is required}" : "${DEPLOY_CONTAINER_NAME:?DEPLOY_CONTAINER_NAME is required}" : "${DEPLOY_HOST_PORT:?DEPLOY_HOST_PORT is required}" : "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY is required}" + [[ "$BUILD_PATH" == /* ]] || { echo "BUILD_PATH must be absolute" >&2; exit 1; } + [[ "$DEPLOY_PATH" == /* ]] || { echo "DEPLOY_PATH must be absolute" >&2; exit 1; } - ssh_options=( - -i "$HOME/.ssh/deploy_key" + quote_for_shell() { + printf '%q' "$1" + } + + build_ssh_options=( + -i "$HOME/.ssh/build_key" + -o StrictHostKeyChecking=accept-new + -o BatchMode=yes + ) + if [[ -n "${BUILD_PORT:-}" ]]; then + build_ssh_options+=( -p "$BUILD_PORT" ) + fi + + build_state_path="$BUILD_PATH/.ci" + database_file="$build_state_path/database_url" + target_key_file="$build_state_path/target_key" + ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \ + "umask 077; mkdir -p $(quote_for_shell "$build_state_path"); cat > $(quote_for_shell "$database_file")" <<< "$DATABASE_URL" + ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \ + "umask 077; cat > $(quote_for_shell "$target_key_file")" <<< "$DEPLOY_SSH_KEY" + + build_env="BUILD_PATH=$(quote_for_shell "$BUILD_PATH") SOURCE_TAG=$(quote_for_shell "$SOURCE_TAG") IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") HOST=$(quote_for_shell "$HOST") PORT=$(quote_for_shell "$PORT") DEPLOY_HOST=$(quote_for_shell "$DEPLOY_HOST") DEPLOY_PORT=$(quote_for_shell "${DEPLOY_PORT:-}") DEPLOY_USER=$(quote_for_shell "$DEPLOY_USER") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") DATABASE_FILE=$(quote_for_shell "$database_file") TARGET_KEY_FILE=$(quote_for_shell "$target_key_file")" + ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \ + "$build_env bash -s" <<'BUILD_SCRIPT' + set -euo pipefail + cleanup() { + rm -f "$DATABASE_FILE" "$TARGET_KEY_FILE" + } + trap cleanup EXIT + + if [[ ! -d "$BUILD_PATH/.git" ]]; then + echo "BUILD_PATH must contain a pre-cloned repository" >&2 + exit 1 + fi + git -C "$BUILD_PATH" fetch --force --tags origin "refs/tags/$SOURCE_TAG:refs/tags/$SOURCE_TAG" + git -C "$BUILD_PATH" checkout --detach --force "refs/tags/$SOURCE_TAG" + + image="$IMAGE_NAME:$IMAGE_TAG" + docker build \ + --file "$BUILD_PATH/Dockerfile.server" \ + --build-arg "HOST=$HOST" \ + --build-arg "PORT=$PORT" \ + --secret "id=database_url,src=$DATABASE_FILE" \ + --tag "$image" \ + "$BUILD_PATH" + + target_ssh_options=( + -i "$TARGET_KEY_FILE" -o StrictHostKeyChecking=accept-new -o BatchMode=yes ) if [[ -n "${DEPLOY_PORT:-}" ]]; then - ssh_options+=( -p "$DEPLOY_PORT" ) + target_ssh_options+=( -p "$DEPLOY_PORT" ) fi - printf '%s' "$GHCR_TOKEN" | ssh "${ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \ - "docker login ghcr.io -u '$GHCR_USERNAME' --password-stdin" - ssh "${ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \ - "IMAGE_NAME='$IMAGE_NAME' IMAGE_TAG='$IMAGE_TAG' DEPLOY_PATH='$DEPLOY_PATH' DEPLOY_CONTAINER_NAME='$DEPLOY_CONTAINER_NAME' DEPLOY_HOST_PORT='$DEPLOY_HOST_PORT' bash -s" <<'REMOTE_SCRIPT' + docker save "$image" | gzip -1 | ssh "${target_ssh_options[@]}" \ + "$DEPLOY_USER@$DEPLOY_HOST" "gzip -d | docker load" + + target_env="IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") CONTAINER_PORT=$(quote_for_shell "$PORT")" + ssh "${target_ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \ + "$target_env bash -s" <<'TARGET_SCRIPT' set -euo pipefail image="$IMAGE_NAME:$IMAGE_TAG" - docker pull "$image" mkdir -p "$DEPLOY_PATH" previous_image="$(docker inspect --format '{{.Config.Image}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)" migration_container="${DEPLOY_CONTAINER_NAME}-migration" @@ -204,7 +248,7 @@ jobs: docker run -d \ --name "$DEPLOY_CONTAINER_NAME" \ --restart unless-stopped \ - --publish "$DEPLOY_HOST_PORT:7878" \ + --publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \ "$image" for attempt in {1..30}; do status="$(docker inspect --format '{{.State.Health.Status}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)" @@ -219,8 +263,10 @@ jobs: docker run -d \ --name "$DEPLOY_CONTAINER_NAME" \ --restart unless-stopped \ - --publish "$DEPLOY_HOST_PORT:7878" \ + --publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \ "$previous_image" + else + docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true fi exit 1 fi @@ -232,8 +278,10 @@ jobs: docker run -d \ --name "$DEPLOY_CONTAINER_NAME" \ --restart unless-stopped \ - --publish "$DEPLOY_HOST_PORT:7878" \ + --publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \ "$previous_image" + else + docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true fi exit 1 - REMOTE_SCRIPT + TARGET_SCRIPT diff --git a/Dockerfile.server b/Dockerfile.server index f5ab4b0..60f89c7 100644 --- a/Dockerfile.server +++ b/Dockerfile.server @@ -5,10 +5,12 @@ FROM node:22.22.2-bookworm-slim AS build WORKDIR /workspace RUN corepack enable && corepack prepare pnpm@11.7.0 --activate +ENV HUSKY=0 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./ COPY apps/onetalk-contract/package.json apps/onetalk-contract/package.json COPY apps/server/package.json apps/server/package.json +COPY apps/chrome-extension/package.json apps/chrome-extension/package.json RUN pnpm install --frozen-lockfile --registry=https://registry.npmjs.org @@ -24,19 +26,22 @@ ENV PORT=${PORT} RUN --mount=type=secret,id=database_url \ DATABASE_URL="$(cat /run/secrets/database_url)" \ pnpm --filter @trade-message-center/server build && \ - pnpm --filter @trade-message-center/server deploy --prod --legacy /opt/server + pnpm --filter @trade-message-center/server deploy --prod --legacy /opt/server && \ + rm -rf /opt/server/src /opt/server/test /opt/server/scripts /opt/server/tsconfig.json /opt/server/drizzle.config.ts FROM node:22.22.2-bookworm-slim AS runtime WORKDIR /app +ARG PORT ENV NODE_ENV=production +ENV SERVER_PORT=${PORT} COPY --from=build /opt/server ./ -EXPOSE 7878 +EXPOSE ${PORT} HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=6 \ - CMD node -e "fetch('http://127.0.0.1:7878/health').then((response) => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1))" + CMD node -e "fetch('http://127.0.0.1:' + process.env.SERVER_PORT + '/health').then((response) => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1))" CMD ["sh", "-c", "node dist/src/database/migrate.js && exec node dist/src/entry.js"]