812028e50d
release.yaml:
- Build and push kalekber/libnovel-pocketbase image on every release tag
- Add deploy job (runs after docker): copies docker-compose.yml from the
tagged commit to /opt/libnovel on prod, pulls new images, restarts
changed services with --remove-orphans (cleans up removed pb-init)
ci.yaml:
- Validate cmd/pocketbase builds on every branch push
Required new Gitea secrets: PROD_HOST, PROD_USER, PROD_SSH_KEY,
PROD_SSH_KNOWN_HOSTS (see deploy job comments for instructions).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
374 lines
14 KiB
YAML
374 lines
14 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*" # e.g. v1.0.0, v1.2.3
|
|
|
|
concurrency:
|
|
group: ${{ gitea.workflow }}-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# ── backend: vet & test ───────────────────────────────────────────────────────
|
|
test-backend:
|
|
name: Test backend
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: backend/go.mod
|
|
cache-dependency-path: backend/go.sum
|
|
|
|
- name: go vet
|
|
working-directory: backend
|
|
run: go vet ./...
|
|
|
|
- name: Run tests
|
|
working-directory: backend
|
|
run: go test -short -race -count=1 -timeout=60s ./...
|
|
|
|
# ── ui: type-check & build ────────────────────────────────────────────────────
|
|
check-ui:
|
|
name: Check ui
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: ui
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: npm
|
|
cache-dependency-path: ui/package-lock.json
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Type check
|
|
run: npm run check
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
- name: Upload build artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ui-build
|
|
path: ui/build
|
|
retention-days: 1
|
|
|
|
# ── ui: source map upload ─────────────────────────────────────────────────────
|
|
# Commented out — re-enable when GlitchTip source map uploads are needed again.
|
|
#
|
|
# upload-sourcemaps:
|
|
# name: Upload source maps
|
|
# runs-on: ubuntu-latest
|
|
# needs: [check-ui]
|
|
# steps:
|
|
# - name: Compute release version (strip leading v)
|
|
# id: ver
|
|
# run: |
|
|
# V="${{ gitea.ref_name }}"
|
|
# echo "version=${V#v}" >> "$GITHUB_OUTPUT"
|
|
#
|
|
# - name: Download build artifacts
|
|
# uses: actions/download-artifact@v3
|
|
# with:
|
|
# name: ui-build
|
|
# path: build
|
|
#
|
|
# - name: Install sentry-cli
|
|
# run: npm install -g @sentry/cli
|
|
#
|
|
# - name: Inject debug IDs into build artifacts
|
|
# run: sentry-cli sourcemaps inject ./build
|
|
# env:
|
|
# SENTRY_URL: https://errors.libnovel.cc/
|
|
# SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
|
|
# SENTRY_ORG: libnovel
|
|
# SENTRY_PROJECT: ui
|
|
#
|
|
# - name: Upload injected build (for docker-ui)
|
|
# uses: actions/upload-artifact@v3
|
|
# with:
|
|
# name: ui-build-injected
|
|
# path: build
|
|
# retention-days: 1
|
|
#
|
|
# - name: Create GlitchTip release
|
|
# run: sentry-cli releases new ${{ steps.ver.outputs.version }}
|
|
# env:
|
|
# SENTRY_URL: https://errors.libnovel.cc/
|
|
# SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
|
|
# SENTRY_ORG: libnovel
|
|
# SENTRY_PROJECT: ui
|
|
#
|
|
# - name: Upload source maps to GlitchTip
|
|
# run: sentry-cli sourcemaps upload ./build --release ${{ steps.ver.outputs.version }}
|
|
# env:
|
|
# SENTRY_URL: https://errors.libnovel.cc/
|
|
# SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
|
|
# SENTRY_ORG: libnovel
|
|
# SENTRY_PROJECT: ui
|
|
#
|
|
# - name: Finalize GlitchTip release
|
|
# run: sentry-cli releases finalize ${{ steps.ver.outputs.version }}
|
|
# env:
|
|
# SENTRY_URL: https://errors.libnovel.cc/
|
|
# SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
|
|
# SENTRY_ORG: libnovel
|
|
# SENTRY_PROJECT: ui
|
|
#
|
|
# - name: Prune old GlitchTip releases (keep latest 10)
|
|
# run: |
|
|
# set -euo pipefail
|
|
# KEEP=10
|
|
# OLD=$(curl -sf \
|
|
# -H "Authorization: Bearer $SENTRY_AUTH_TOKEN" \
|
|
# "$SENTRY_URL/api/0/organizations/$SENTRY_ORG/releases/?project=$SENTRY_PROJECT&per_page=100" \
|
|
# | python3 -c "
|
|
# import sys, json
|
|
# releases = json.load(sys.stdin)
|
|
# for r in releases[$KEEP:]:
|
|
# print(r['version'])
|
|
# " KEEP=$KEEP)
|
|
# for ver in $OLD; do
|
|
# echo "Deleting old release: $ver"
|
|
# sentry-cli releases delete "$ver" || true
|
|
# done
|
|
# env:
|
|
# SENTRY_URL: https://errors.libnovel.cc
|
|
# SENTRY_AUTH_TOKEN: ${{ secrets.GLITCHTIP_AUTH_TOKEN }}
|
|
# SENTRY_ORG: libnovel
|
|
# SENTRY_PROJECT: ui
|
|
|
|
# ── docker: all images in one job (single login) ──────────────────────────────
|
|
# backend, runner, ui, and caddy are built sequentially in one job so Docker
|
|
# Hub only needs to be authenticated once. This also eliminates 3 redundant
|
|
# checkout + setup-buildx + scheduler round-trips compared to separate jobs.
|
|
docker:
|
|
name: Docker
|
|
runs-on: ubuntu-latest
|
|
needs: [test-backend, check-ui]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
# Single login — credential is written to ~/.docker/config.json and
|
|
# reused by all subsequent build-push-action steps in this job.
|
|
- name: Log in to Docker Hub
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKER_USER }}
|
|
password: ${{ secrets.DOCKER_TOKEN }}
|
|
|
|
# ── backend ──────────────────────────────────────────────────────────────
|
|
- name: Docker meta / backend
|
|
id: meta-backend
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ secrets.DOCKER_USER }}/libnovel-backend
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=raw,value=latest
|
|
|
|
- name: Build and push / backend
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: backend
|
|
target: backend
|
|
push: true
|
|
tags: ${{ steps.meta-backend.outputs.tags }}
|
|
labels: ${{ steps.meta-backend.outputs.labels }}
|
|
build-args: |
|
|
VERSION=${{ steps.meta-backend.outputs.version }}
|
|
COMMIT=${{ gitea.sha }}
|
|
cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-backend:latest
|
|
cache-to: type=inline
|
|
|
|
# ── runner ───────────────────────────────────────────────────────────────
|
|
- name: Docker meta / runner
|
|
id: meta-runner
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ secrets.DOCKER_USER }}/libnovel-runner
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=raw,value=latest
|
|
|
|
- name: Build and push / runner
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: backend
|
|
target: runner
|
|
push: true
|
|
tags: ${{ steps.meta-runner.outputs.tags }}
|
|
labels: ${{ steps.meta-runner.outputs.labels }}
|
|
build-args: |
|
|
VERSION=${{ steps.meta-runner.outputs.version }}
|
|
COMMIT=${{ gitea.sha }}
|
|
cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-runner:latest
|
|
cache-to: type=inline
|
|
|
|
# ── ui ───────────────────────────────────────────────────────────────────
|
|
- name: Download ui build artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: ui-build
|
|
path: ui/build
|
|
|
|
- name: Allow build/ into Docker context (override .dockerignore)
|
|
run: |
|
|
grep -v '^build$' ui/.dockerignore > ui/.dockerignore.tmp
|
|
mv ui/.dockerignore.tmp ui/.dockerignore
|
|
|
|
- name: Docker meta / ui
|
|
id: meta-ui
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ secrets.DOCKER_USER }}/libnovel-ui
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=raw,value=latest
|
|
|
|
- name: Build and push / ui
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ui
|
|
push: true
|
|
tags: ${{ steps.meta-ui.outputs.tags }}
|
|
labels: ${{ steps.meta-ui.outputs.labels }}
|
|
build-args: |
|
|
BUILD_VERSION=${{ steps.meta-ui.outputs.version }}
|
|
BUILD_COMMIT=${{ gitea.sha }}
|
|
BUILD_TIME=${{ gitea.event.head_commit.timestamp }}
|
|
PREBUILT=1
|
|
cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-ui:latest
|
|
cache-to: type=inline
|
|
|
|
# ── caddy ────────────────────────────────────────────────────────────────
|
|
- name: Docker meta / caddy
|
|
id: meta-caddy
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ secrets.DOCKER_USER }}/libnovel-caddy
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=raw,value=latest
|
|
|
|
- name: Build and push / caddy
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: caddy
|
|
push: true
|
|
tags: ${{ steps.meta-caddy.outputs.tags }}
|
|
labels: ${{ steps.meta-caddy.outputs.labels }}
|
|
cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-caddy:latest
|
|
cache-to: type=inline
|
|
|
|
# ── pocketbase ───────────────────────────────────────────────────────────
|
|
- name: Docker meta / pocketbase
|
|
id: meta-pocketbase
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ secrets.DOCKER_USER }}/libnovel-pocketbase
|
|
tags: |
|
|
type=semver,pattern={{version}}
|
|
type=semver,pattern={{major}}.{{minor}}
|
|
type=raw,value=latest
|
|
|
|
- name: Build and push / pocketbase
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: backend
|
|
target: pocketbase
|
|
push: true
|
|
tags: ${{ steps.meta-pocketbase.outputs.tags }}
|
|
labels: ${{ steps.meta-pocketbase.outputs.labels }}
|
|
cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-pocketbase:latest
|
|
cache-to: type=inline
|
|
|
|
# ── deploy: sync docker-compose.yml + restart prod ───────────────────────────
|
|
# Runs after all images are pushed to Docker Hub.
|
|
# Copies the compose file from the tagged commit to the server, pulls the new
|
|
# images, and restarts only the services whose image or config changed.
|
|
# --remove-orphans cleans up containers no longer defined in the compose file
|
|
# (e.g. the now-removed pb-init container).
|
|
#
|
|
# Required Gitea secrets:
|
|
# PROD_HOST — prod server IP or hostname
|
|
# PROD_USER — SSH login user (typically root)
|
|
# PROD_SSH_KEY — private key whose public half is in authorized_keys
|
|
# PROD_SSH_KNOWN_HOSTS — output of: ssh-keyscan -H <PROD_HOST>
|
|
deploy:
|
|
name: Deploy to prod
|
|
runs-on: ubuntu-latest
|
|
needs: [docker]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install SSH key
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "${{ secrets.PROD_SSH_KEY }}" > ~/.ssh/deploy_key
|
|
chmod 600 ~/.ssh/deploy_key
|
|
printf '%s\n' "${{ secrets.PROD_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
|
|
|
|
- name: Copy docker-compose.yml to prod
|
|
run: |
|
|
scp -i ~/.ssh/deploy_key \
|
|
docker-compose.yml \
|
|
"${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}:/opt/libnovel/docker-compose.yml"
|
|
|
|
- name: Pull new images and restart changed services
|
|
run: |
|
|
ssh -i ~/.ssh/deploy_key \
|
|
"${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}" \
|
|
'set -euo pipefail
|
|
cd /opt/libnovel
|
|
doppler run -- docker compose pull
|
|
doppler run -- docker compose up -d --remove-orphans'
|
|
|
|
# ── Gitea release ─────────────────────────────────────────────────────────────
|
|
release:
|
|
name: Gitea Release
|
|
runs-on: ubuntu-latest
|
|
needs: [docker]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Extract release notes from tag commit
|
|
id: notes
|
|
run: |
|
|
set -euo pipefail
|
|
# Subject line (first line of commit message) → release title
|
|
SUBJECT=$(git log -1 --format="%s" "${{ gitea.sha }}")
|
|
# Body (everything after the blank line) → release body
|
|
BODY=$(git log -1 --format="%b" "${{ gitea.sha }}" | sed '/^Co-Authored-By:/d' | sed '/^[[:space:]]*$/{ N; /^\n$/d }' | sed 's/^[[:space:]]*$//' | awk 'NF || !p; {p = !NF}')
|
|
echo "title=${SUBJECT}" >> "$GITHUB_OUTPUT"
|
|
# Use a heredoc delimiter to safely handle multi-line body
|
|
{
|
|
echo "body<<RELEASE_BODY_EOF"
|
|
echo "${BODY}"
|
|
echo "RELEASE_BODY_EOF"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Create release
|
|
uses: https://gitea.com/actions/gitea-release-action@v1
|
|
with:
|
|
token: ${{ secrets.GITEA_TOKEN }}
|
|
title: ${{ steps.notes.outputs.title }}
|
|
body: ${{ steps.notes.outputs.body }}
|