71 lines
2.4 KiB
YAML
71 lines
2.4 KiB
YAML
name: Deploy production
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
mode:
|
|
description: 'Release mode'
|
|
required: true
|
|
type: choice
|
|
default: new
|
|
options:
|
|
- new
|
|
- retry
|
|
increment:
|
|
description: 'New release only: semantic version increment (first release is v1.0.0)'
|
|
required: true
|
|
type: choice
|
|
default: patch
|
|
options:
|
|
- patch
|
|
- minor
|
|
- major
|
|
version:
|
|
description: 'Retry only: existing version tag, e.g. v1.2.3; leave empty for new release'
|
|
required: false
|
|
type: string
|
|
|
|
# Gitea 1.25 ignores concurrency. The helper acquires a NAS-wide mkdir lock.
|
|
jobs:
|
|
deploy:
|
|
if: gitea.ref == 'refs/heads/main'
|
|
runs-on: @RUNNER@
|
|
env:
|
|
CI: 'true'
|
|
GITEA_SERVER_URL: ${{ gitea.server_url }}
|
|
CI_REPOSITORY: ${{ gitea.repository }}
|
|
CI_COMMIT: ${{ gitea.sha }}
|
|
CI_REF: ${{ gitea.ref }}
|
|
CI_EVENT: ${{ gitea.event_name }}
|
|
CI_RUN_ID: ${{ gitea.run_id }}
|
|
steps:
|
|
- name: Check out trusted main workflow revision
|
|
uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
|
with:
|
|
persist-credentials: false
|
|
- name: Verify pinned engineering resources
|
|
run: python3 scripts/engineering.py --check
|
|
- name: Identify workflow attempt
|
|
run: java generated/ci/Ci.java attempt
|
|
- name: Release verified images
|
|
env:
|
|
RELEASE_MODE: ${{ inputs.mode }}
|
|
RELEASE_INCREMENT: ${{ inputs.increment }}
|
|
RELEASE_VERSION: ${{ inputs.version }}
|
|
RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
|
|
DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
|
|
DEPLOY_USER: ${{ vars.DEPLOY_USER }}
|
|
DEPLOY_SSH_PORT: ${{ vars.DEPLOY_SSH_PORT }}
|
|
DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
|
|
DEPLOY_REGISTRY: ${{ vars.DEPLOY_REGISTRY }}
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
|
run: java generated/ci/Ci.java deploy
|
|
- name: Retain deployment diagnostics for fourteen days
|
|
if: always()
|
|
uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
|
|
with:
|
|
name: deployment-${{ gitea.run_id }}-${{ env.CI_RUN_ATTEMPT }}
|
|
path: ci/artifacts/deployment/
|
|
if-no-files-found: warn
|
|
retention-days: 14
|