mirror of
https://github.com/sinanyuntu/trade-message-center.git
synced 2026-09-17 13:22:11 +08:00
288 lines
13 KiB
YAML
288 lines
13 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
tags:
|
|
- "**"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
quality:
|
|
name: quality
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: production
|
|
env:
|
|
CI: "true"
|
|
TMC_BAKE_SERVER_CONFIG: ${{ startsWith(github.ref, 'refs/tags/') }}
|
|
HOST: ${{ vars.HOST }}
|
|
PORT: ${{ vars.PORT }}
|
|
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
|
VITE_BRIGHT_WEBSOCKET_URL: ${{ vars.VITE_BRIGHT_WEBSOCKET_URL }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 11.7.0
|
|
run_install: false
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: pnpm
|
|
cache-dependency-path: pnpm-lock.yaml
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile --registry=https://registry.npmjs.org
|
|
|
|
- name: Check formatting
|
|
run: pnpm format:check
|
|
|
|
- name: Check database migrations
|
|
run: pnpm --filter @trade-message-center/server db:check
|
|
|
|
- name: Typecheck
|
|
run: pnpm typecheck
|
|
|
|
- name: Run tests
|
|
run: pnpm test
|
|
|
|
- name: Build packages
|
|
run: pnpm build
|
|
|
|
postgres-integration:
|
|
name: postgres-integration
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
env:
|
|
CI: "true"
|
|
TMC_BAKE_SERVER_CONFIG: "false"
|
|
DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/trade_message_center_test
|
|
TEST_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/trade_message_center_test
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_DB: trade_message_center_test
|
|
POSTGRES_USER: postgres
|
|
POSTGRES_PASSWORD: postgres
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U postgres -d trade_message_center_test"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 12
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 11.7.0
|
|
run_install: false
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: pnpm
|
|
cache-dependency-path: pnpm-lock.yaml
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile --registry=https://registry.npmjs.org
|
|
|
|
- name: Apply database migrations
|
|
run: pnpm --filter @trade-message-center/server db:migrate
|
|
|
|
- name: Run server tests with PostgreSQL
|
|
run: pnpm --filter @trade-message-center/server test
|
|
|
|
deploy:
|
|
name: deploy
|
|
needs: [quality, postgres-integration]
|
|
if: startsWith(github.ref, 'refs/tags/')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
environment: production
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
IMAGE_NAME: trade-message-center-server
|
|
IMAGE_TAG: ${{ github.sha }}
|
|
SOURCE_TAG: ${{ github.ref_name }}
|
|
BUILD_HOST: ${{ vars.BUILD_HOST }}
|
|
BUILD_PORT: ${{ vars.BUILD_PORT }}
|
|
BUILD_USER: ${{ vars.BUILD_USER }}
|
|
BUILD_PATH: ${{ vars.BUILD_PATH }}
|
|
DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
|
|
DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
|
|
DEPLOY_USER: ${{ vars.DEPLOY_USER }}
|
|
DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
|
|
DEPLOY_CONTAINER_NAME: ${{ vars.DEPLOY_CONTAINER_NAME }}
|
|
DEPLOY_HOST_PORT: ${{ vars.DEPLOY_HOST_PORT }}
|
|
HOST: ${{ vars.HOST }}
|
|
PORT: ${{ vars.PORT }}
|
|
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
|
BUILD_SSH_KEY: ${{ secrets.BUILD_SSH_KEY }}
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
steps:
|
|
- name: Prepare build VPS SSH key
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
: "${BUILD_HOST:?BUILD_HOST is required}"
|
|
: "${BUILD_USER:?BUILD_USER is required}"
|
|
: "${BUILD_PATH:?BUILD_PATH is required}"
|
|
: "${BUILD_SSH_KEY:?BUILD_SSH_KEY is required}"
|
|
install -m 700 -d "$HOME/.ssh"
|
|
printf '%s\n' "$BUILD_SSH_KEY" > "$HOME/.ssh/build_key"
|
|
chmod 600 "$HOME/.ssh/build_key"
|
|
|
|
- name: Build on build VPS and deploy to target server
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
: "${BUILD_HOST:?BUILD_HOST is required}"
|
|
: "${BUILD_USER:?BUILD_USER is required}"
|
|
: "${BUILD_PATH:?BUILD_PATH is required}"
|
|
: "${SOURCE_TAG:?SOURCE_TAG is required}"
|
|
: "${HOST:?HOST is required}"
|
|
: "${PORT:?PORT is required}"
|
|
: "${DATABASE_URL:?DATABASE_URL is required}"
|
|
: "${DEPLOY_HOST:?DEPLOY_HOST is required}"
|
|
: "${DEPLOY_USER:?DEPLOY_USER is required}"
|
|
: "${DEPLOY_PATH:?DEPLOY_PATH is required}"
|
|
: "${DEPLOY_CONTAINER_NAME:?DEPLOY_CONTAINER_NAME is required}"
|
|
: "${DEPLOY_HOST_PORT:?DEPLOY_HOST_PORT is required}"
|
|
: "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY is required}"
|
|
[[ "$BUILD_PATH" == /* ]] || { echo "BUILD_PATH must be absolute" >&2; exit 1; }
|
|
[[ "$DEPLOY_PATH" == /* ]] || { echo "DEPLOY_PATH must be absolute" >&2; exit 1; }
|
|
|
|
quote_for_shell() {
|
|
printf '%q' "$1"
|
|
}
|
|
|
|
build_ssh_options=(
|
|
-i "$HOME/.ssh/build_key"
|
|
-o StrictHostKeyChecking=accept-new
|
|
-o BatchMode=yes
|
|
)
|
|
if [[ -n "${BUILD_PORT:-}" ]]; then
|
|
build_ssh_options+=( -p "$BUILD_PORT" )
|
|
fi
|
|
|
|
build_state_path="$BUILD_PATH/.ci"
|
|
database_file="$build_state_path/database_url"
|
|
target_key_file="$build_state_path/target_key"
|
|
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
|
"umask 077; mkdir -p $(quote_for_shell "$build_state_path"); cat > $(quote_for_shell "$database_file")" <<< "$DATABASE_URL"
|
|
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
|
"umask 077; cat > $(quote_for_shell "$target_key_file")" <<< "$DEPLOY_SSH_KEY"
|
|
|
|
build_env="BUILD_PATH=$(quote_for_shell "$BUILD_PATH") SOURCE_TAG=$(quote_for_shell "$SOURCE_TAG") IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") HOST=$(quote_for_shell "$HOST") PORT=$(quote_for_shell "$PORT") DEPLOY_HOST=$(quote_for_shell "$DEPLOY_HOST") DEPLOY_PORT=$(quote_for_shell "${DEPLOY_PORT:-}") DEPLOY_USER=$(quote_for_shell "$DEPLOY_USER") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") DATABASE_FILE=$(quote_for_shell "$database_file") TARGET_KEY_FILE=$(quote_for_shell "$target_key_file")"
|
|
ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
|
|
"$build_env bash -s" <<'BUILD_SCRIPT'
|
|
set -euo pipefail
|
|
cleanup() {
|
|
rm -f "$DATABASE_FILE" "$TARGET_KEY_FILE"
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
if [[ ! -d "$BUILD_PATH/.git" ]]; then
|
|
echo "BUILD_PATH must contain a pre-cloned repository" >&2
|
|
exit 1
|
|
fi
|
|
git -C "$BUILD_PATH" fetch --force --tags origin "refs/tags/$SOURCE_TAG:refs/tags/$SOURCE_TAG"
|
|
git -C "$BUILD_PATH" checkout --detach --force "refs/tags/$SOURCE_TAG"
|
|
|
|
image="$IMAGE_NAME:$IMAGE_TAG"
|
|
docker build \
|
|
--file "$BUILD_PATH/Dockerfile.server" \
|
|
--build-arg "HOST=$HOST" \
|
|
--build-arg "PORT=$PORT" \
|
|
--secret "id=database_url,src=$DATABASE_FILE" \
|
|
--tag "$image" \
|
|
"$BUILD_PATH"
|
|
|
|
target_ssh_options=(
|
|
-i "$TARGET_KEY_FILE"
|
|
-o StrictHostKeyChecking=accept-new
|
|
-o BatchMode=yes
|
|
)
|
|
if [[ -n "${DEPLOY_PORT:-}" ]]; then
|
|
target_ssh_options+=( -p "$DEPLOY_PORT" )
|
|
fi
|
|
|
|
docker save "$image" | gzip -1 | ssh "${target_ssh_options[@]}" \
|
|
"$DEPLOY_USER@$DEPLOY_HOST" "gzip -d | docker load"
|
|
|
|
target_env="IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") CONTAINER_PORT=$(quote_for_shell "$PORT")"
|
|
ssh "${target_ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
|
"$target_env bash -s" <<'TARGET_SCRIPT'
|
|
set -euo pipefail
|
|
image="$IMAGE_NAME:$IMAGE_TAG"
|
|
mkdir -p "$DEPLOY_PATH"
|
|
previous_image="$(docker inspect --format '{{.Config.Image}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)"
|
|
migration_container="${DEPLOY_CONTAINER_NAME}-migration"
|
|
docker rm -f "$migration_container" 2>/dev/null || true
|
|
docker run --rm \
|
|
--name "$migration_container" \
|
|
"$image" \
|
|
node dist/src/database/migrate.js
|
|
printf '%s\n' "$image" > "$DEPLOY_PATH/current-image"
|
|
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
|
docker run -d \
|
|
--name "$DEPLOY_CONTAINER_NAME" \
|
|
--restart unless-stopped \
|
|
--publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
|
|
"$image"
|
|
for attempt in {1..30}; do
|
|
status="$(docker inspect --format '{{.State.Health.Status}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)"
|
|
if [[ "$status" == "healthy" ]]; then
|
|
docker image prune -f
|
|
exit 0
|
|
fi
|
|
if [[ "$status" == "unhealthy" || "$status" == "exited" ]]; then
|
|
docker logs "$DEPLOY_CONTAINER_NAME" || true
|
|
if [[ -n "$previous_image" ]]; then
|
|
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
|
docker run -d \
|
|
--name "$DEPLOY_CONTAINER_NAME" \
|
|
--restart unless-stopped \
|
|
--publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
|
|
"$previous_image"
|
|
else
|
|
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
|
fi
|
|
exit 1
|
|
fi
|
|
sleep 2
|
|
done
|
|
docker logs "$DEPLOY_CONTAINER_NAME" || true
|
|
if [[ -n "$previous_image" ]]; then
|
|
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
|
docker run -d \
|
|
--name "$DEPLOY_CONTAINER_NAME" \
|
|
--restart unless-stopped \
|
|
--publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
|
|
"$previous_image"
|
|
else
|
|
docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
|
|
fi
|
|
exit 1
|
|
TARGET_SCRIPT
|