mirror of
https://github.com/sinanyuntu/trade-message-center.git
synced 2026-09-17 13:22:11 +08:00
ci: build on VPS and deploy container
This commit is contained in:
YBF
@@ -7,6 +7,8 @@ node_modules
|
||||
dist
|
||||
**/dist
|
||||
.pnpm-store
|
||||
.ci
|
||||
**/.ci
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
|
||||
+95
-47
@@ -120,77 +120,121 @@ jobs:
|
||||
environment: production
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
env:
|
||||
IMAGE_NAME: ghcr.io/${{ github.repository }}-server
|
||||
IMAGE_NAME: trade-message-center-server
|
||||
IMAGE_TAG: ${{ github.sha }}
|
||||
SOURCE_TAG: ${{ github.ref_name }}
|
||||
BUILD_HOST: ${{ vars.BUILD_HOST }}
|
||||
BUILD_PORT: ${{ vars.BUILD_PORT }}
|
||||
BUILD_USER: ${{ vars.BUILD_USER }}
|
||||
BUILD_PATH: ${{ vars.BUILD_PATH }}
|
||||
DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
|
||||
DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
|
||||
DEPLOY_USER: ${{ vars.DEPLOY_USER }}
|
||||
DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
|
||||
DEPLOY_CONTAINER_NAME: ${{ vars.DEPLOY_CONTAINER_NAME }}
|
||||
DEPLOY_HOST_PORT: ${{ vars.DEPLOY_HOST_PORT }}
|
||||
GHCR_USERNAME: ${{ github.actor }}
|
||||
GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
HOST: ${{ vars.HOST }}
|
||||
PORT: ${{ vars.PORT }}
|
||||
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
||||
BUILD_SSH_KEY: ${{ secrets.BUILD_SSH_KEY }}
|
||||
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Log in to GHCR
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Build and push server image
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile.server
|
||||
push: true
|
||||
tags: ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
|
||||
build-args: |
|
||||
HOST=${{ vars.HOST }}
|
||||
PORT=${{ vars.PORT }}
|
||||
secrets: |
|
||||
database_url=${{ secrets.DATABASE_URL }}
|
||||
|
||||
- name: Install SSH key
|
||||
shell: bash
|
||||
run: |
|
||||
install -m 700 -d "$HOME/.ssh"
|
||||
printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
|
||||
chmod 600 "$HOME/.ssh/deploy_key"
|
||||
|
||||
- name: Deploy container over SSH
|
||||
- name: Prepare build VPS SSH key
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
: "${BUILD_HOST:?BUILD_HOST is required}"
|
||||
: "${BUILD_USER:?BUILD_USER is required}"
|
||||
: "${BUILD_PATH:?BUILD_PATH is required}"
|
||||
: "${BUILD_SSH_KEY:?BUILD_SSH_KEY is required}"
|
||||
install -m 700 -d "$HOME/.ssh"
|
||||
printf '%s\n' "$BUILD_SSH_KEY" > "$HOME/.ssh/build_key"
|
||||
chmod 600 "$HOME/.ssh/build_key"
|
||||
|
||||
- name: Build on build VPS and deploy to target server
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
: "${BUILD_HOST:?BUILD_HOST is required}"
|
||||
: "${BUILD_USER:?BUILD_USER is required}"
|
||||
: "${BUILD_PATH:?BUILD_PATH is required}"
|
||||
: "${SOURCE_TAG:?SOURCE_TAG is required}"
|
||||
: "${HOST:?HOST is required}"
|
||||
: "${PORT:?PORT is required}"
|
||||
: "${DATABASE_URL:?DATABASE_URL is required}"
|
||||
: "${DEPLOY_HOST:?DEPLOY_HOST is required}"
|
||||
: "${DEPLOY_USER:?DEPLOY_USER is required}"
|
||||
: "${DEPLOY_PATH:?DEPLOY_PATH is required}"
|
||||
: "${DEPLOY_CONTAINER_NAME:?DEPLOY_CONTAINER_NAME is required}"
|
||||
: "${DEPLOY_HOST_PORT:?DEPLOY_HOST_PORT is required}"
|
||||
: "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY is required}"
|
||||
[[ "$BUILD_PATH" == /* ]] || { echo "BUILD_PATH must be absolute" >&2; exit 1; }
|
||||
[[ "$DEPLOY_PATH" == /* ]] || { echo "DEPLOY_PATH must be absolute" >&2; exit 1; }
|
||||
|
||||
ssh_options=(
|
||||
-i "$HOME/.ssh/deploy_key"
|
||||
quote_for_shell() {
|
||||
printf '%q' "$1"
|
||||
}
|
||||
|
||||
build_ssh_options=(
|
||||
-i "$HOME/.ssh/build_key"
|
||||
-o StrictHostKeyChecking=accept-new
|
||||
-o BatchMode=yes
|
||||
)
|
||||
if [[ -n "${BUILD_PORT:-}" ]]; then
|
||||
build_ssh_options+=( -p "$BUILD_PORT" )
|
||||
fi
|
||||
|
||||
build_state_path="$BUILD_PATH/.ci"
|
||||
database_file="$build_state_path/database_url"
|
||||
target_key_file="$build_state_path/target_key"
|
||||
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
||||
"umask 077; mkdir -p $(quote_for_shell "$build_state_path"); cat > $(quote_for_shell "$database_file")" <<< "$DATABASE_URL"
|
||||
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
||||
"umask 077; cat > $(quote_for_shell "$target_key_file")" <<< "$DEPLOY_SSH_KEY"
|
||||
|
||||
build_env="BUILD_PATH=$(quote_for_shell "$BUILD_PATH") SOURCE_TAG=$(quote_for_shell "$SOURCE_TAG") IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") HOST=$(quote_for_shell "$HOST") PORT=$(quote_for_shell "$PORT") DEPLOY_HOST=$(quote_for_shell "$DEPLOY_HOST") DEPLOY_PORT=$(quote_for_shell "${DEPLOY_PORT:-}") DEPLOY_USER=$(quote_for_shell "$DEPLOY_USER") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") DATABASE_FILE=$(quote_for_shell "$database_file") TARGET_KEY_FILE=$(quote_for_shell "$target_key_file")"
|
||||
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
||||
"$build_env bash -s" <<'BUILD_SCRIPT'
|
||||
set -euo pipefail
|
||||
cleanup() {
|
||||
rm -f "$DATABASE_FILE" "$TARGET_KEY_FILE"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
if [[ ! -d "$BUILD_PATH/.git" ]]; then
|
||||
echo "BUILD_PATH must contain a pre-cloned repository" >&2
|
||||
exit 1
|
||||
fi
|
||||
git -C "$BUILD_PATH" fetch --force --tags origin "refs/tags/$SOURCE_TAG:refs/tags/$SOURCE_TAG"
|
||||
git -C "$BUILD_PATH" checkout --detach --force "refs/tags/$SOURCE_TAG"
|
||||
|
||||
image="$IMAGE_NAME:$IMAGE_TAG"
|
||||
docker build \
|
||||
--file "$BUILD_PATH/Dockerfile.server" \
|
||||
--build-arg "HOST=$HOST" \
|
||||
--build-arg "PORT=$PORT" \
|
||||
--secret "id=database_url,src=$DATABASE_FILE" \
|
||||
--tag "$image" \
|
||||
"$BUILD_PATH"
|
||||
|
||||
target_ssh_options=(
|
||||
-i "$TARGET_KEY_FILE"
|
||||
-o StrictHostKeyChecking=accept-new
|
||||
-o BatchMode=yes
|
||||
)
|
||||
if [[ -n "${DEPLOY_PORT:-}" ]]; then
|
||||
ssh_options+=( -p "$DEPLOY_PORT" )
|
||||
target_ssh_options+=( -p "$DEPLOY_PORT" )
|
||||
fi
|
||||
|
||||
printf '%s' "$GHCR_TOKEN" | ssh "${ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
||||
"docker login ghcr.io -u '$GHCR_USERNAME' --password-stdin"
|
||||
ssh "${ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
||||
"IMAGE_NAME='$IMAGE_NAME' IMAGE_TAG='$IMAGE_TAG' DEPLOY_PATH='$DEPLOY_PATH' DEPLOY_CONTAINER_NAME='$DEPLOY_CONTAINER_NAME' DEPLOY_HOST_PORT='$DEPLOY_HOST_PORT' bash -s" <<'REMOTE_SCRIPT'
|
||||
docker save "$image" | gzip -1 | ssh "${target_ssh_options[@]}" \
|
||||
"$DEPLOY_USER@$DEPLOY_HOST" "gzip -d | docker load"
|
||||
|
||||
target_env="IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") CONTAINER_PORT=$(quote_for_shell "$PORT")"
|
||||
ssh "${target_ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
||||
"$target_env bash -s" <<'TARGET_SCRIPT'
|
||||
set -euo pipefail
|
||||
image="$IMAGE_NAME:$IMAGE_TAG"
|
||||
docker pull "$image"
|
||||
mkdir -p "$DEPLOY_PATH"
|
||||
previous_image="$(docker inspect --format '{{.Config.Image}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)"
|
||||
migration_container="${DEPLOY_CONTAINER_NAME}-migration"
|
||||
@@ -204,7 +248,7 @@ jobs:
|
||||
docker run -d \
|
||||
--name "$DEPLOY_CONTAINER_NAME" \
|
||||
--restart unless-stopped \
|
||||
--publish "$DEPLOY_HOST_PORT:7878" \
|
||||
--publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
|
||||
"$image"
|
||||
for attempt in {1..30}; do
|
||||
status="$(docker inspect --format '{{.State.Health.Status}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)"
|
||||
@@ -219,8 +263,10 @@ jobs:
|
||||
docker run -d \
|
||||
--name "$DEPLOY_CONTAINER_NAME" \
|
||||
--restart unless-stopped \
|
||||
--publish "$DEPLOY_HOST_PORT:7878" \
|
||||
--publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
|
||||
"$previous_image"
|
||||
else
|
||||
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
@@ -232,8 +278,10 @@ jobs:
|
||||
docker run -d \
|
||||
--name "$DEPLOY_CONTAINER_NAME" \
|
||||
--restart unless-stopped \
|
||||
--publish "$DEPLOY_HOST_PORT:7878" \
|
||||
--publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
|
||||
"$previous_image"
|
||||
else
|
||||
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
||||
fi
|
||||
exit 1
|
||||
REMOTE_SCRIPT
|
||||
TARGET_SCRIPT
|
||||
|
||||
+8
-3
@@ -5,10 +5,12 @@ FROM node:22.22.2-bookworm-slim AS build
|
||||
WORKDIR /workspace
|
||||
|
||||
RUN corepack enable && corepack prepare pnpm@11.7.0 --activate
|
||||
ENV HUSKY=0
|
||||
|
||||
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
|
||||
COPY apps/onetalk-contract/package.json apps/onetalk-contract/package.json
|
||||
COPY apps/server/package.json apps/server/package.json
|
||||
COPY apps/chrome-extension/package.json apps/chrome-extension/package.json
|
||||
|
||||
RUN pnpm install --frozen-lockfile --registry=https://registry.npmjs.org
|
||||
|
||||
@@ -24,19 +26,22 @@ ENV PORT=${PORT}
|
||||
RUN --mount=type=secret,id=database_url \
|
||||
DATABASE_URL="$(cat /run/secrets/database_url)" \
|
||||
pnpm --filter @trade-message-center/server build && \
|
||||
pnpm --filter @trade-message-center/server deploy --prod --legacy /opt/server
|
||||
pnpm --filter @trade-message-center/server deploy --prod --legacy /opt/server && \
|
||||
rm -rf /opt/server/src /opt/server/test /opt/server/scripts /opt/server/tsconfig.json /opt/server/drizzle.config.ts
|
||||
|
||||
FROM node:22.22.2-bookworm-slim AS runtime
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
ARG PORT
|
||||
ENV NODE_ENV=production
|
||||
ENV SERVER_PORT=${PORT}
|
||||
|
||||
COPY --from=build /opt/server ./
|
||||
|
||||
EXPOSE 7878
|
||||
EXPOSE ${PORT}
|
||||
|
||||
HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=6 \
|
||||
CMD node -e "fetch('http://127.0.0.1:7878/health').then((response) => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1))"
|
||||
CMD node -e "fetch('http://127.0.0.1:' + process.env.SERVER_PORT + '/health').then((response) => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1))"
|
||||
|
||||
CMD ["sh", "-c", "node dist/src/database/migrate.js && exec node dist/src/entry.js"]
|
||||
|
||||
Reference in New Issue
Block a user