From 8555e705a934de5b582c411c7ffe1c4108723609 Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Wed, 22 Jul 2026 12:18:15 -0700 Subject: [PATCH] Add dev-branch flow: build.yml workflow_call + pr-build.yml + deploy-dev.yml (LAN dev) --- .forgejo/workflows/build.yml | 10 +++- .forgejo/workflows/deploy-dev.yml | 83 +++++++++++++++++++++++++++++++ .forgejo/workflows/pr-build.yml | 30 +++++++++++ 3 files changed, 121 insertions(+), 2 deletions(-) create mode 100644 .forgejo/workflows/deploy-dev.yml create mode 100644 .forgejo/workflows/pr-build.yml diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml index 5471a59..6701686 100644 --- a/.forgejo/workflows/build.yml +++ b/.forgejo/workflows/build.yml @@ -14,10 +14,16 @@ name: Build check # thermograph-copy's deferred vendoring. on: + # Reusable (uses: ./.forgejo/workflows/build.yml) by pr-build.yml and + # deploy-dev.yml for the dev-branch flow, AND still directly triggered on + # push/PR to main (unchanged pre-existing behavior) plus dev (new -- so a + # direct push to dev or a PR into dev gets this same check without relying + # solely on the reusable call from the other two files). + workflow_call: {} push: - branches: [main] + branches: [main, dev] pull_request: - branches: [main] + branches: [main, dev] jobs: build: diff --git a/.forgejo/workflows/deploy-dev.yml b/.forgejo/workflows/deploy-dev.yml new file mode 100644 index 0000000..933f194 --- /dev/null +++ b/.forgejo/workflows/deploy-dev.yml @@ -0,0 +1,83 @@ +name: Deploy to LAN dev server + +# Fires on every push to `dev` -- a direct push, or the real merge commit a +# native "auto merge when checks succeed" produces (see pr-build.yml). Mirrors +# the monorepo's deploy-dev.yml shape: a `build` job (the build.yml sanity +# check, reused) followed by a `deploy` job that rolls the LAN dev box. +# +# Unlike the monorepo (a single repo, so deploy-dev.sh lived in the same +# checkout this workflow ran `actions/checkout` on), this repo publishes only +# an image (build-push.yml, already triggers on push to dev and tags it +# sha-<12hex> in the Forgejo registry) -- deploy-dev.sh itself now lives in +# the INFRA repo's checkout on the runner host, at ~/thermograph-dev (it +# self-updates there via its own `git reset` against thermograph-infra, same +# pattern deploy.sh/deploy-prod.sh already use for main/release). That means +# this job is INERT until the thermograph-lan box is reprovisioned from its +# current monorepo checkout to an infra checkout -- there is no +# ~/thermograph-dev/deploy/deploy-dev.sh on the box yet for this step to run. +# +# SERVICE=backend + BACKEND_IMAGE_TAG is the same env-var contract deploy.yml/ +# deploy-prod.yml use against thermograph-infra's deploy.sh, so a dev-only +# rollout never touches the frontend's running container or tag, exactly like +# the beta/prod paths. + +on: + push: + branches: [dev] + workflow_dispatch: {} + +jobs: + build: + name: build + # Fixed (unparameterized) group, same convention as the deploy job's + # below: if two pushes to dev land close together, the newer push's + # build cancels the older's still-running one rather than letting both + # run to completion on the single physical runner -- the older push's + # result would just be thrown away once needs:build gates its deploy + # against a stale build anyway. Safe to cancel mid-run: build.yml only + # runs a throwaway `docker build` sanity check, nothing persisted. + concurrency: + group: dev-push-build + cancel-in-progress: true + uses: ./.forgejo/workflows/build.yml + + deploy: + needs: build + # NOT [self-hosted, thermograph-lan] -- that's what the original GitHub + # version used, but GitHub implicitly tags every self-hosted runner with + # "self-hosted" automatically; Forgejo's runner has only the labels it + # was explicitly registered with ("docker" + "thermograph-lan", no + # "self-hosted"). The array form silently makes this job unschedulable on + # every push -- see the monorepo's deploy-dev.yml, which documents this + # same bug against its own history. + runs-on: thermograph-lan + # Only needs to read the repo to fetch it into the checkout that computes + # the tag below -- deploy-dev.sh itself lives in the separate INFRA + # checkout on this host, not this repo's checkout. + permissions: + contents: read + concurrency: + group: dev-lan-deploy + cancel-in-progress: false + steps: + - uses: actions/checkout@v4 + + - name: Compute image tag + id: tag + # Same 12-hex truncation deploy.yml/deploy-prod.yml use -- must match + # build-push.yml's `sha-${GITHUB_SHA:0:12}` tag exactly (Actions + # expressions have no substring function for the full 40-char SHA). + run: echo "tag=sha-${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT" + + - name: Deploy to the LAN dev server + # thermograph-lan is host-native (the runner job runs directly on the + # LAN box, not over SSH like beta/prod), so plain env vars on the + # command reach deploy-dev.sh directly -- no ssh-action needed here. + # + # INERT until thermograph-lan is reprovisioned: deploy-dev.sh doesn't + # exist yet at this path there (the box is currently a monorepo + # checkout, not an infra checkout) -- see the file-level comment + # above. Once reprovisioned, deploy-dev.sh self-updates via its own + # `git reset` against thermograph-infra before running, the same way + # deploy.sh/deploy-prod.sh already do for the beta/prod paths. + run: SERVICE=backend BACKEND_IMAGE_TAG=${{ steps.tag.outputs.tag }} bash "$HOME/thermograph-dev/deploy/deploy-dev.sh" diff --git a/.forgejo/workflows/pr-build.yml b/.forgejo/workflows/pr-build.yml new file mode 100644 index 0000000..0a47eff --- /dev/null +++ b/.forgejo/workflows/pr-build.yml @@ -0,0 +1,30 @@ +name: PR build (required check) + +# Every PR into `dev` runs the build check (build.yml's build-only `docker +# build` sanity check, reused via `uses:`). Mirrors the monorepo's +# pr-build.yml: no custom merge step here -- Forgejo has native branch +# protection + auto-merge, so this workflow's only job is to BE the required +# status check on PRs targeting `dev`. +# +# One-time web UI setup (not expressible in this file): +# Settings -> Branches -> add a protected-branch rule for `dev` +# -> enable "Enable Status Check", list this job's name ("build") +# -> merge style: squash +# Then on a ready PR: "Auto merge when checks succeed". +# +# A native auto-merge is a real git merge, so it fires deploy-dev.yml's push +# trigger naturally -- no separate deploy job needed here, and no "direct push +# vs PR merge" double-trigger to avoid. + +on: + pull_request: + branches: [dev] + +concurrency: + group: dev-pr-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + build: + name: build + uses: ./.forgejo/workflows/build.yml