enricobuehler
9b0aac4b5c
ci / web (pull_request) Successful in 51s
ci / docs-site (pull_request) Successful in 1m6s
apple / swift (pull_request) Successful in 4m31s
apple / screenshots (pull_request) Has been skipped
ci / bench (pull_request) Successful in 6m36s
android / android (pull_request) Successful in 11m4s
ci / rust (pull_request) Failing after 14m45s
98 lines
4.3 KiB
YAML
98 lines
4.3 KiB
YAML
# Deploy-only: bring up the two unom-1 pieces that live in THIS repo but whose normal
|
|
# deploys are coupled to heavy build workflows — docs to docker.yml's 5-image matrix,
|
|
# the flatpak server to flatpak.yml's full flatpak-builder run. This workflow does
|
|
# NEITHER build: it just (re)places the compose files and pulls the already-published
|
|
# images, so unom/infra's deploy-all can bring a fresh unom-1 fully up in a single
|
|
# dispatch without triggering those rebuilds.
|
|
#
|
|
# docs -> pulls git.unom.io/unom/punktfunk-docs:latest (built by docker.yml) and
|
|
# brings it up on :3220.
|
|
# flatpak -> brings up the caddy:2-alpine static server on :3230. The OSTree repo
|
|
# CONTENT (./site) is NOT shipped here — it is regenerated by flatpak.yml
|
|
# on the next client build, or restored from the unom-1 backup
|
|
# (unom/infra scripts/restore-unom-1.sh, `files` tag). A fresh box serves
|
|
# an empty repo until then; that is expected.
|
|
#
|
|
# Dispatched by unom/infra scripts/deploy-all.sh: `dispatch-and-wait.sh punktfunk
|
|
# deploy-services.yml`. Uses the same secret set docker.yml/flatpak.yml already rely on:
|
|
# DEPLOY_HOST/USER/PORT/SSH_KEY (the unom-ci-deploy key) + REGISTRY_TOKEN (docs pull).
|
|
name: deploy-services
|
|
run-name: ${{ gitea.actor }} deploy docs + flatpak server
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
docs:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Sync compose file
|
|
# SHA-pinned (receives DEPLOY_SSH_KEY): a moved tag would mean credential
|
|
# exfiltration. v0.1.7 = 917f8b8. Bump the SHA + trailing version together.
|
|
uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
|
|
with:
|
|
host: ${{ secrets.DEPLOY_HOST }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
port: ${{ secrets.DEPLOY_PORT }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
source: "compose.production.yml"
|
|
target: "~/punktfunk-docs"
|
|
overwrite: true
|
|
|
|
- name: Pull and start docs
|
|
# SHA-pinned: receives DEPLOY_SSH_KEY + REGISTRY_TOKEN. v1.2.5 = 0ff4204.
|
|
uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
|
|
env:
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
with:
|
|
host: ${{ secrets.DEPLOY_HOST }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
port: ${{ secrets.DEPLOY_PORT }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
# Token enters via env, never the script text (keeps it out of run logs).
|
|
envs: REGISTRY_TOKEN
|
|
script: |
|
|
set -euo pipefail
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login git.unom.io -u enricobuehler --password-stdin
|
|
cd ~/punktfunk-docs
|
|
docker compose -f compose.production.yml pull docs
|
|
docker compose -f compose.production.yml up -d --no-build docs
|
|
|
|
flatpak:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Sync flatpak server compose + Caddyfile
|
|
uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
|
|
with:
|
|
host: ${{ secrets.DEPLOY_HOST }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
port: ${{ secrets.DEPLOY_PORT }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
# Land both files flat in ~/unom-flatpak/ (drop the packaging/flatpak/server/ prefix).
|
|
source: "packaging/flatpak/server/compose.production.yml,packaging/flatpak/server/Caddyfile"
|
|
target: "~/unom-flatpak"
|
|
strip_components: 3
|
|
overwrite: true
|
|
|
|
- name: Start flatpak static server
|
|
uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
|
|
with:
|
|
host: ${{ secrets.DEPLOY_HOST }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
port: ${{ secrets.DEPLOY_PORT }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
script: |
|
|
set -euo pipefail
|
|
# ./site (the OSTree repo) is NOT shipped by this workflow. Ensure the
|
|
# bind-mount source exists so caddy starts; content is restored from the
|
|
# unom-1 backup or regenerated by flatpak.yml's next publish.
|
|
mkdir -p ~/unom-flatpak/site/repo
|
|
cd ~/unom-flatpak
|
|
docker compose -f compose.production.yml up -d
|