mirror of
https://github.com/sinanyuntu/trade-message-center.git
synced 2026-09-17 13:22:11 +08:00
538 lines
27 KiB
YAML
538 lines
27 KiB
YAML
name: Generate Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "**"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: generate-release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
verify-main-tag:
|
|
name: verify-main-tag
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Checkout repository history
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Verify tag points to main
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
git fetch --no-tags origin main:refs/remotes/origin/main
|
|
tag_commit="$(git rev-parse "${GITHUB_SHA}^{commit}")"
|
|
if git merge-base --is-ancestor "$tag_commit" refs/remotes/origin/main; then
|
|
printf 'Tag %s points to main history.\n' "$GITHUB_REF_NAME"
|
|
exit 0
|
|
fi
|
|
echo "::error::Tag $GITHUB_REF_NAME does not point to a commit reachable from main."
|
|
exit 1
|
|
|
|
quality:
|
|
name: generate
|
|
needs: verify-main-tag
|
|
outputs:
|
|
extension_version: ${{ steps.package-version.outputs.version }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: production
|
|
env:
|
|
CI: "true"
|
|
NODE_ENV: test
|
|
MIND_AUTH_BASE_URL: http://127.0.0.1:8787
|
|
MIND_PAGE_ORIGIN: http://127.0.0.1:7878
|
|
ONETALK_PLUGIN_ORIGINS: chrome-extension://ogdbffjakeeidblabkeakakdecfbcmlf
|
|
MIND_AUTH_TIMEOUT_MS: "3000"
|
|
OSS_BUCKET: sinanpilot-bucket
|
|
OSS_ENDPOINT: https://oss-cn-hangzhou.aliyuncs.com
|
|
OSS_ACCESS_KEY_ID: ${{ secrets.OSS_ACCESS_KEY_ID }}
|
|
OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
|
|
VITE_BRIGHT_WEBSOCKET_URL: ${{ vars.VITE_BRIGHT_WEBSOCKET_URL }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 11.7.0
|
|
run_install: false
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: pnpm
|
|
cache-dependency-path: pnpm-lock.yaml
|
|
|
|
- name: Read and validate package version
|
|
id: package-version
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
version="$(node scripts/package-version.mjs)"
|
|
printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
|
|
printf 'PACKAGE_VERSION=%s\n' "$version" >> "$GITHUB_ENV"
|
|
printf 'TMC_PACKAGE_VERSION=%s\n' "$version" >> "$GITHUB_ENV"
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile --registry=https://registry.npmjs.org
|
|
|
|
- name: Build OneTalk contract
|
|
run: pnpm --filter @trade-message-center/onetalk-contract build
|
|
|
|
- name: Verify CI authorization environment
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
node --experimental-strip-types --input-type=module <<'NODE'
|
|
import assert from "node:assert/strict";
|
|
import { loadConfig } from "./apps/server/src/config.ts";
|
|
|
|
const config = loadConfig({
|
|
...process.env,
|
|
HOST: "127.0.0.1",
|
|
PORT: "7878",
|
|
DATABASE_URL: "postgres://ci/config-validation",
|
|
});
|
|
assert.deepEqual(config.mindAuthorization, {
|
|
baseUrl: process.env.MIND_AUTH_BASE_URL,
|
|
mindPageOrigin: process.env.MIND_PAGE_ORIGIN,
|
|
pluginOrigins: [process.env.ONETALK_PLUGIN_ORIGINS],
|
|
timeoutMs: Number(process.env.MIND_AUTH_TIMEOUT_MS),
|
|
});
|
|
console.log("Mind authorization environment is active in CI");
|
|
NODE
|
|
|
|
- name: Check formatting
|
|
run: pnpm format:check
|
|
|
|
- name: Check database migrations
|
|
run: pnpm --filter @trade-message-center/server db:check
|
|
|
|
- name: Typecheck
|
|
run: pnpm typecheck
|
|
|
|
- name: Run tests
|
|
run: pnpm test
|
|
|
|
- name: Build packages
|
|
run: pnpm build
|
|
|
|
- name: Package Chrome extension release
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
archive="$RUNNER_TEMP/$PACKAGE_VERSION.zip"
|
|
(
|
|
cd apps/chrome-extension/dist
|
|
zip -qr "$archive" .
|
|
)
|
|
archive_name="trade-message-center-chrome-extension-${PACKAGE_VERSION}.zip"
|
|
cp "$archive" "$GITHUB_WORKSPACE/$archive_name"
|
|
test -s "$GITHUB_WORKSPACE/$archive_name"
|
|
|
|
- name: Verify packaged OneTalk runtime
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
extracted="$RUNNER_TEMP/extension-runtime-verification"
|
|
mkdir -p "$extracted"
|
|
unzip -q "$GITHUB_WORKSPACE/trade-message-center-chrome-extension-${PACKAGE_VERSION}.zip" -d "$extracted"
|
|
node apps/chrome-extension/scripts/verify-release-bundle.mjs "$extracted"
|
|
sha256sum "$GITHUB_WORKSPACE/trade-message-center-chrome-extension-${PACKAGE_VERSION}.zip"
|
|
|
|
- name: Upload Chrome extension release artifact
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: chrome-extension-${{ github.sha }}
|
|
path: trade-message-center-chrome-extension-${{ steps.package-version.outputs.version }}.zip
|
|
if-no-files-found: error
|
|
retention-days: 7
|
|
|
|
deploy:
|
|
name: deploy-server
|
|
needs: [quality, publish-extension]
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: production
|
|
concurrency:
|
|
group: deploy-production-server
|
|
cancel-in-progress: false
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
IMAGE_NAME: trade-message-center-server
|
|
HOST: 0.0.0.0
|
|
PORT: 7878
|
|
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
|
PACKAGE_VERSION: ${{ needs.quality.outputs.extension_version }}
|
|
OSS_BUCKET: sinanpilot-bucket
|
|
OSS_ENDPOINT: https://oss-cn-hangzhou.aliyuncs.com
|
|
OSS_ACCESS_KEY_ID: ${{ secrets.OSS_ACCESS_KEY_ID }}
|
|
OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
|
|
MIND_AUTH_BASE_URL: ${{ vars.MIND_AUTH_BASE_URL }}
|
|
MIND_PAGE_ORIGIN: ${{ vars.MIND_PAGE_ORIGIN }}
|
|
ONETALK_PLUGIN_ORIGINS: chrome-extension://ogdbffjakeeidblabkeakakdecfbcmlf
|
|
MIND_AUTH_TIMEOUT_MS: 3000
|
|
PUBLIC_NETWORK: trade-message-center-public
|
|
SUMMARY_NETWORK: trade-message-center-summary
|
|
|
|
IMAGE_TAG: ${{ github.sha }}
|
|
SOURCE_TAG: ${{ github.ref_name }}
|
|
|
|
BUILD_HOST: 124.223.40.241
|
|
BUILD_PORT: 22
|
|
BUILD_USER: tmc-build
|
|
BUILD_PATH: /opt/trade-message-center
|
|
BUILD_SSH_KEY: ${{ secrets.BUILD_SSH_KEY }}
|
|
|
|
DEPLOY_HOST: 112.124.53.207
|
|
DEPLOY_PORT: 22
|
|
DEPLOY_USER: tmc-deploy
|
|
DEPLOY_PATH: /opt/trade-message-center
|
|
DEPLOY_CONTAINER_NAME: trade-message-center
|
|
DEPLOY_HOST_PORT: 7878
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
steps:
|
|
- name: Prepare build VPS SSH key
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
: "${BUILD_HOST:?BUILD_HOST is required}"
|
|
: "${BUILD_USER:?BUILD_USER is required}"
|
|
: "${BUILD_PATH:?BUILD_PATH is required}"
|
|
: "${BUILD_SSH_KEY:?BUILD_SSH_KEY is required}"
|
|
install -m 700 -d "$HOME/.ssh"
|
|
printf '%s\n' "$BUILD_SSH_KEY" > "$HOME/.ssh/build_key"
|
|
chmod 600 "$HOME/.ssh/build_key"
|
|
|
|
- name: Build on build VPS and deploy to target server
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
: "${BUILD_HOST:?BUILD_HOST is required}"
|
|
: "${BUILD_USER:?BUILD_USER is required}"
|
|
: "${BUILD_PATH:?BUILD_PATH is required}"
|
|
: "${SOURCE_TAG:?SOURCE_TAG is required}"
|
|
: "${HOST:?HOST is required}"
|
|
: "${PORT:?PORT is required}"
|
|
: "${DATABASE_URL:?DATABASE_URL is required}"
|
|
: "${PACKAGE_VERSION:?PACKAGE_VERSION is required}"
|
|
: "${OSS_BUCKET:?OSS_BUCKET is required}"
|
|
: "${OSS_ENDPOINT:?OSS_ENDPOINT is required}"
|
|
: "${OSS_ACCESS_KEY_ID:?OSS_ACCESS_KEY_ID is required}"
|
|
: "${OSS_ACCESS_KEY_SECRET:?OSS_ACCESS_KEY_SECRET is required}"
|
|
: "${MIND_AUTH_BASE_URL:?MIND_AUTH_BASE_URL is required}"
|
|
: "${MIND_PAGE_ORIGIN:?MIND_PAGE_ORIGIN is required}"
|
|
: "${ONETALK_PLUGIN_ORIGINS:?ONETALK_PLUGIN_ORIGINS is required}"
|
|
: "${MIND_AUTH_TIMEOUT_MS:?MIND_AUTH_TIMEOUT_MS is required}"
|
|
: "${PUBLIC_NETWORK:?PUBLIC_NETWORK is required}"
|
|
: "${SUMMARY_NETWORK:?SUMMARY_NETWORK is required}"
|
|
: "${DEPLOY_HOST:?DEPLOY_HOST is required}"
|
|
: "${DEPLOY_USER:?DEPLOY_USER is required}"
|
|
: "${DEPLOY_PATH:?DEPLOY_PATH is required}"
|
|
: "${DEPLOY_CONTAINER_NAME:?DEPLOY_CONTAINER_NAME is required}"
|
|
: "${DEPLOY_HOST_PORT:?DEPLOY_HOST_PORT is required}"
|
|
: "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY is required}"
|
|
[[ "$BUILD_PATH" == /* ]] || { echo "BUILD_PATH must be absolute" >&2; exit 1; }
|
|
[[ "$DEPLOY_PATH" == /* ]] || { echo "DEPLOY_PATH must be absolute" >&2; exit 1; }
|
|
|
|
quote_for_shell() {
|
|
printf '%q' "$1"
|
|
}
|
|
|
|
build_ssh_options=(
|
|
-i "$HOME/.ssh/build_key"
|
|
-o StrictHostKeyChecking=accept-new
|
|
-o BatchMode=yes
|
|
)
|
|
if [[ -n "${BUILD_PORT:-}" ]]; then
|
|
build_ssh_options+=( -p "$BUILD_PORT" )
|
|
fi
|
|
|
|
build_state_path="$BUILD_PATH/.ci"
|
|
database_file="$build_state_path/database_url"
|
|
oss_access_key_id_file="$build_state_path/oss_access_key_id"
|
|
oss_access_key_secret_file="$build_state_path/oss_access_key_secret"
|
|
runtime_env_file="$build_state_path/runtime.env"
|
|
target_key_file="$build_state_path/target_key"
|
|
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
|
"umask 077; mkdir -p $(quote_for_shell "$build_state_path"); cat > $(quote_for_shell "$database_file")" <<< "$DATABASE_URL"
|
|
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
|
"umask 077; cat > $(quote_for_shell "$oss_access_key_id_file")" <<< "$OSS_ACCESS_KEY_ID"
|
|
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
|
"umask 077; cat > $(quote_for_shell "$oss_access_key_secret_file")" <<< "$OSS_ACCESS_KEY_SECRET"
|
|
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
|
"umask 077; cat > $(quote_for_shell "$target_key_file")" <<< "$DEPLOY_SSH_KEY"
|
|
|
|
build_env="BUILD_PATH=$(quote_for_shell "$BUILD_PATH") SOURCE_TAG=$(quote_for_shell "$SOURCE_TAG") IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") HOST=$(quote_for_shell "$HOST") PORT=$(quote_for_shell "$PORT") PACKAGE_VERSION=$(quote_for_shell "$PACKAGE_VERSION") OSS_BUCKET=$(quote_for_shell "$OSS_BUCKET") OSS_ENDPOINT=$(quote_for_shell "$OSS_ENDPOINT") MIND_AUTH_BASE_URL=$(quote_for_shell "$MIND_AUTH_BASE_URL") MIND_PAGE_ORIGIN=$(quote_for_shell "$MIND_PAGE_ORIGIN") ONETALK_PLUGIN_ORIGINS=$(quote_for_shell "$ONETALK_PLUGIN_ORIGINS") MIND_AUTH_TIMEOUT_MS=$(quote_for_shell "$MIND_AUTH_TIMEOUT_MS") PUBLIC_NETWORK=$(quote_for_shell "$PUBLIC_NETWORK") SUMMARY_NETWORK=$(quote_for_shell "$SUMMARY_NETWORK") DEPLOY_HOST=$(quote_for_shell "$DEPLOY_HOST") DEPLOY_PORT=$(quote_for_shell "${DEPLOY_PORT:-}") DEPLOY_USER=$(quote_for_shell "$DEPLOY_USER") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") DATABASE_FILE=$(quote_for_shell "$database_file") OSS_ACCESS_KEY_ID_FILE=$(quote_for_shell "$oss_access_key_id_file") OSS_ACCESS_KEY_SECRET_FILE=$(quote_for_shell "$oss_access_key_secret_file") RUNTIME_ENV_FILE=$(quote_for_shell "$runtime_env_file") TARGET_KEY_FILE=$(quote_for_shell "$target_key_file")"
|
|
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
|
"$build_env bash -s" <<'BUILD_SCRIPT'
|
|
set -euo pipefail
|
|
quote_for_shell() {
|
|
printf '%q' "$1"
|
|
}
|
|
|
|
write_env_value() {
|
|
local name="$1"
|
|
local value="$2"
|
|
if [[ "$value" == *$'\n'* || "$value" == *$'\r'* ]]; then
|
|
echo "$name must not contain newlines" >&2
|
|
exit 1
|
|
fi
|
|
printf '%s=%s\n' "$name" "$value"
|
|
}
|
|
|
|
cleanup() {
|
|
rm -f "$DATABASE_FILE" "$OSS_ACCESS_KEY_ID_FILE" "$OSS_ACCESS_KEY_SECRET_FILE" "$RUNTIME_ENV_FILE" "$TARGET_KEY_FILE"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
if [[ ! -d "$BUILD_PATH/.git" ]]; then
|
|
echo "BUILD_PATH must contain a pre-cloned repository" >&2
|
|
exit 1
|
|
fi
|
|
# Keep only the checked-out repository state; .ci contains this run's secrets.
|
|
git -C "$BUILD_PATH" clean -ffdx -e .ci
|
|
git -C "$BUILD_PATH" fetch --force --tags origin "refs/tags/$SOURCE_TAG:refs/tags/$SOURCE_TAG"
|
|
git -C "$BUILD_PATH" checkout --detach --force "refs/tags/$SOURCE_TAG"
|
|
|
|
image="$IMAGE_NAME:$IMAGE_TAG"
|
|
docker build \
|
|
--file "$BUILD_PATH/Dockerfile.server" \
|
|
--build-arg "PORT=$PORT" \
|
|
--tag "$image" \
|
|
"$BUILD_PATH"
|
|
|
|
database_url="$(<"$DATABASE_FILE")"
|
|
oss_access_key_id="$(<"$OSS_ACCESS_KEY_ID_FILE")"
|
|
oss_access_key_secret="$(<"$OSS_ACCESS_KEY_SECRET_FILE")"
|
|
{
|
|
write_env_value NODE_ENV production
|
|
write_env_value HOST "$HOST"
|
|
write_env_value PORT "$PORT"
|
|
write_env_value DATABASE_URL "$database_url"
|
|
write_env_value TMC_PACKAGE_VERSION "$PACKAGE_VERSION"
|
|
write_env_value OSS_BUCKET "$OSS_BUCKET"
|
|
write_env_value OSS_ENDPOINT "$OSS_ENDPOINT"
|
|
write_env_value OSS_ACCESS_KEY_ID "$oss_access_key_id"
|
|
write_env_value OSS_ACCESS_KEY_SECRET "$oss_access_key_secret"
|
|
write_env_value MIND_AUTH_BASE_URL "$MIND_AUTH_BASE_URL"
|
|
write_env_value MIND_PAGE_ORIGIN "$MIND_PAGE_ORIGIN"
|
|
write_env_value ONETALK_PLUGIN_ORIGINS "$ONETALK_PLUGIN_ORIGINS"
|
|
write_env_value MIND_AUTH_TIMEOUT_MS "$MIND_AUTH_TIMEOUT_MS"
|
|
} > "$RUNTIME_ENV_FILE"
|
|
chmod 600 "$RUNTIME_ENV_FILE"
|
|
|
|
target_ssh_options=(
|
|
-i "$TARGET_KEY_FILE"
|
|
-o StrictHostKeyChecking=accept-new
|
|
-o BatchMode=yes
|
|
)
|
|
if [[ -n "${DEPLOY_PORT:-}" ]]; then
|
|
target_ssh_options+=( -p "$DEPLOY_PORT" )
|
|
fi
|
|
|
|
docker save "$image" | gzip -1 | ssh "${target_ssh_options[@]}" \
|
|
"$DEPLOY_USER@$DEPLOY_HOST" "gzip -d | docker load"
|
|
|
|
target_env_file="$DEPLOY_PATH/server.env"
|
|
target_next_env_file="$DEPLOY_PATH/.server.env.next"
|
|
ssh "${target_ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
|
"umask 077; mkdir -p $(quote_for_shell "$DEPLOY_PATH"); cat > $(quote_for_shell "$target_next_env_file"); chmod 600 $(quote_for_shell "$target_next_env_file")" \
|
|
< "$RUNTIME_ENV_FILE"
|
|
|
|
target_env="IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") CURRENT_ENV_FILE=$(quote_for_shell "$target_env_file") NEXT_ENV_FILE=$(quote_for_shell "$target_next_env_file") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") CONTAINER_PORT=$(quote_for_shell "$PORT") PUBLIC_NETWORK=$(quote_for_shell "$PUBLIC_NETWORK") SUMMARY_NETWORK=$(quote_for_shell "$SUMMARY_NETWORK")"
|
|
ssh "${target_ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
|
"$target_env bash -s" <<'TARGET_SCRIPT'
|
|
set -euo pipefail
|
|
image="$IMAGE_NAME:$IMAGE_TAG"
|
|
env_file="$CURRENT_ENV_FILE"
|
|
next_env_file="$NEXT_ENV_FILE"
|
|
public_network="$PUBLIC_NETWORK"
|
|
summary_network="$SUMMARY_NETWORK"
|
|
cleanup() {
|
|
rm -f "$next_env_file"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
mkdir -p "$DEPLOY_PATH"
|
|
test -s "$next_env_file"
|
|
ensure_public_network() {
|
|
if docker network inspect "$public_network" >/dev/null 2>&1; then
|
|
[[ "$(docker network inspect --format '{{.Internal}}' "$public_network")" == "false" ]] || {
|
|
echo "Docker network $public_network must allow egress" >&2
|
|
return 1
|
|
}
|
|
return
|
|
fi
|
|
docker network create "$public_network" >/dev/null
|
|
}
|
|
ensure_summary_network() {
|
|
if docker network inspect "$summary_network" >/dev/null 2>&1; then
|
|
[[ "$(docker network inspect --format '{{.Internal}}' "$summary_network")" == "true" ]] || {
|
|
echo "Docker network $summary_network must be internal" >&2
|
|
return 1
|
|
}
|
|
return
|
|
fi
|
|
docker network create --internal "$summary_network" >/dev/null
|
|
}
|
|
start_container() {
|
|
local container_image="$1"
|
|
local container_env_file="$2"
|
|
if [[ -n "$container_env_file" ]]; then
|
|
docker run -d \
|
|
--name "$DEPLOY_CONTAINER_NAME" \
|
|
--restart unless-stopped \
|
|
--env-file "$container_env_file" \
|
|
--network "$public_network" \
|
|
--publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
|
|
"$container_image"
|
|
else
|
|
docker run -d \
|
|
--name "$DEPLOY_CONTAINER_NAME" \
|
|
--restart unless-stopped \
|
|
--network "$public_network" \
|
|
--publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
|
|
"$container_image"
|
|
fi
|
|
docker network connect "$summary_network" "$DEPLOY_CONTAINER_NAME"
|
|
}
|
|
ensure_public_network
|
|
ensure_summary_network
|
|
previous_image="$(docker inspect --format '{{.Config.Image}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)"
|
|
restore_previous() {
|
|
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
|
if [[ -z "$previous_image" ]]; then
|
|
return
|
|
fi
|
|
if [[ -s "$env_file" ]]; then
|
|
start_container "$previous_image" "$env_file"
|
|
return
|
|
fi
|
|
echo "Restoring legacy image without an env-file: $previous_image" >&2
|
|
start_container "$previous_image" ""
|
|
}
|
|
|
|
migration_container="${DEPLOY_CONTAINER_NAME}-migration"
|
|
docker rm -f "$migration_container" 2>/dev/null || true
|
|
docker run --rm \
|
|
--name "$migration_container" \
|
|
--env-file "$next_env_file" \
|
|
"$image" \
|
|
node dist/src/database/migrate.js
|
|
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
|
if ! start_container "$image" "$next_env_file"; then
|
|
restore_previous
|
|
exit 1
|
|
fi
|
|
for attempt in {1..30}; do
|
|
status="$(docker inspect --format '{{.State.Health.Status}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)"
|
|
if [[ "$status" == "healthy" ]]; then
|
|
if ! mv -f "$next_env_file" "$env_file"; then
|
|
echo "Failed to activate the server env file; restoring the previous container" >&2
|
|
restore_previous
|
|
exit 1
|
|
fi
|
|
trap - EXIT
|
|
printf '%s\n' "$image" > "$DEPLOY_PATH/current-image"
|
|
docker image prune -f
|
|
exit 0
|
|
fi
|
|
if [[ "$status" == "unhealthy" || "$status" == "exited" ]]; then
|
|
docker logs "$DEPLOY_CONTAINER_NAME" || true
|
|
restore_previous
|
|
exit 1
|
|
fi
|
|
sleep 2
|
|
done
|
|
docker logs "$DEPLOY_CONTAINER_NAME" || true
|
|
restore_previous
|
|
exit 1
|
|
TARGET_SCRIPT
|
|
|
|
publish-extension:
|
|
name: publish-extension
|
|
needs: quality
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: production
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
PACKAGE_VERSION: ${{ needs.quality.outputs.extension_version }}
|
|
OSS_BUCKET: sinanpilot-bucket
|
|
OSS_ENDPOINT: https://oss-cn-hangzhou.aliyuncs.com
|
|
OSS_REGION: cn-hangzhou
|
|
OSS_ACCESS_KEY_ID: ${{ secrets.OSS_ACCESS_KEY_ID }}
|
|
OSS_ACCESS_KEY_SECRET: ${{ secrets.OSS_ACCESS_KEY_SECRET }}
|
|
OSSUTIL_VERSION: "2.4.0"
|
|
OSSUTIL_ARCHIVE: ossutil-2.4.0-linux-amd64.zip
|
|
OSSUTIL_SHA256: 85edf66b2fb7238f5c7e25cab820cf29312319fe4935b7c86a6b8485eb434f3c
|
|
steps:
|
|
- name: Download Chrome extension release artifact
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: chrome-extension-${{ github.sha }}
|
|
path: ${{ runner.temp }}/extension-artifact
|
|
|
|
- name: Install ossutil
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
archive="$RUNNER_TEMP/$OSSUTIL_ARCHIVE"
|
|
curl --fail --location --silent --show-error \
|
|
--output "$archive" \
|
|
"https://gosspublic.alicdn.com/ossutil/v2/$OSSUTIL_VERSION/$OSSUTIL_ARCHIVE"
|
|
printf '%s %s\n' "$OSSUTIL_SHA256" "$archive" | sha256sum --check
|
|
install_dir="$RUNNER_TEMP/ossutil"
|
|
mkdir -p "$install_dir"
|
|
unzip -q "$archive" -d "$install_dir"
|
|
ossutil_path="$install_dir/ossutil-$OSSUTIL_VERSION-linux-amd64/ossutil"
|
|
test -f "$ossutil_path"
|
|
chmod 755 "$ossutil_path"
|
|
printf 'OSSUTIL_PATH=%s\n' "$ossutil_path" >> "$GITHUB_ENV"
|
|
"$ossutil_path" version
|
|
|
|
- name: Publish Chrome extension to OSS
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
: "${OSS_BUCKET:?OSS_BUCKET is required}"
|
|
: "${OSS_REGION:?OSS_REGION is required}"
|
|
: "${OSS_ACCESS_KEY_ID:?OSS_ACCESS_KEY_ID is required}"
|
|
: "${OSS_ACCESS_KEY_SECRET:?OSS_ACCESS_KEY_SECRET is required}"
|
|
archive_name="trade-message-center-chrome-extension-${PACKAGE_VERSION}.zip"
|
|
archive="$RUNNER_TEMP/extension-artifact/$archive_name"
|
|
test -s "$archive"
|
|
manifest_version="$(unzip -p "$archive" manifest.json | node --input-type=module -e '
|
|
let source = "";
|
|
process.stdin.on("data", (chunk) => { source += chunk; });
|
|
process.stdin.on("end", () => {
|
|
const manifest = JSON.parse(source);
|
|
if (typeof manifest.version !== "string") process.exit(1);
|
|
process.stdout.write(manifest.version);
|
|
});
|
|
' )"
|
|
if [[ "$manifest_version" != "$PACKAGE_VERSION" ]]; then
|
|
echo "::error::Generated manifest version does not match the quality job version."
|
|
exit 1
|
|
fi
|
|
destination="oss://${OSS_BUCKET}/chrome-extension/${PACKAGE_VERSION}/${archive_name}"
|
|
"$OSSUTIL_PATH" cp --force "$archive" "$destination"
|
|
printf 'Published Chrome extension: %s\n' "$destination"
|