7b2db07722
One root workflow set replaces the four repos' copies (deleted -- root-only is where Forgejo reads them, and dead copies are a trap): per-domain build-push with explicit image paths (emi/thermograph/backend|frontend; the old github.repository-derived path collides in a monorepo), path-filtered per-domain beta/prod/dev deploys, a domain-input reusable build check, a single always-reporting PR gate (path-filtered required checks deadlock auto-merge), a new infra-sync pipeline (host checkout + secrets render on infra/** pushes), and ports of secrets-guard / ops-cron / observability-validate to monorepo paths.
73 lines
2.7 KiB
YAML
73 lines
2.7 KiB
YAML
name: Sync infra to hosts
|
|
|
|
# The infra DOMAIN's own pipeline (new with the monorepo -- the split era had
|
|
# no infra deploy workflow at all; infra changes rode along lazily with the
|
|
# next app deploy's `git reset`). On a push to `main` touching infra/**, SSH
|
|
# to beta AND prod, fast-forward the host's /opt/thermograph monorepo checkout
|
|
# and re-render /etc/thermograph.env from the SOPS vault -- so a compose edit
|
|
# or a secret rotation lands push-button instead of waiting for the next app
|
|
# deploy.
|
|
#
|
|
# Deliberately does NOT roll any service: image tags are the app domains'
|
|
# axis, not infra's. A compose change that must recreate containers takes
|
|
# effect on the next app deploy, or a by-hand
|
|
# `SERVICE=all ... infra/deploy/deploy.sh` run (see that script's header).
|
|
#
|
|
# Both hosts track infra via `main` (the split-era model, unchanged): prod's
|
|
# *app images* are staged by the `release` branch, but its checkout follows
|
|
# main -- deploy.sh's own BRANCH default encodes the same thing.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths: ['infra/**']
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
sync-beta:
|
|
runs-on: docker
|
|
concurrency:
|
|
group: infra-sync-beta
|
|
cancel-in-progress: false
|
|
steps:
|
|
- name: Sync beta checkout + re-render secrets
|
|
uses: https://github.com/appleboy/ssh-action@v1.2.0
|
|
with:
|
|
host: ${{ secrets.SSH_HOST }}
|
|
username: ${{ secrets.SSH_USER }}
|
|
key: ${{ secrets.SSH_KEY }}
|
|
port: ${{ secrets.SSH_PORT }}
|
|
script: |
|
|
set -euo pipefail
|
|
cd /opt/thermograph
|
|
git fetch --prune origin main
|
|
git reset --hard origin/main
|
|
if [ -f infra/deploy/render-secrets.sh ]; then
|
|
. infra/deploy/render-secrets.sh
|
|
render_thermograph_secrets /opt/thermograph/infra
|
|
fi
|
|
echo "synced to $(git log --oneline -1)"
|
|
|
|
sync-prod:
|
|
runs-on: docker
|
|
concurrency:
|
|
group: infra-sync-prod
|
|
cancel-in-progress: false
|
|
steps:
|
|
- name: Sync prod checkout + re-render secrets
|
|
uses: https://github.com/appleboy/ssh-action@v1.2.0
|
|
with:
|
|
host: ${{ secrets.PROD_SSH_HOST }}
|
|
username: ${{ secrets.PROD_SSH_USER }}
|
|
key: ${{ secrets.PROD_SSH_KEY }}
|
|
port: ${{ secrets.PROD_SSH_PORT }}
|
|
script: |
|
|
set -euo pipefail
|
|
cd /opt/thermograph
|
|
git fetch --prune origin main
|
|
git reset --hard origin/main
|
|
if [ -f infra/deploy/render-secrets.sh ]; then
|
|
. infra/deploy/render-secrets.sh
|
|
render_thermograph_secrets /opt/thermograph/infra
|
|
fi
|
|
echo "synced to $(git log --oneline -1)"
|