pehoen/Goldebek
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit
Deploy / validate-dispatch (push) Successful in 43s
Details
Deploy / scheduled-rebuild-dev (push) Skipped
Details
Deploy / scheduled-rebuild-master (push) Skipped
Details
Deploy / rollback-dev (push) Skipped
Details
Deploy / rollback-master (push) Skipped
Details
Deploy / changes (push) Successful in 13s
Details
Deploy / secret-scan (push) Successful in 9s
Details
Deploy / app-quality (push) Successful in 11m21s
Details
Deploy / security-deps (push) Successful in 14s
Details
Deploy / context (push) Failing after 1s
Details
Deploy / app-image (push) Skipped
Details
Deploy / deploy-dev (push) Skipped
Details
Deploy / deploy-master (push) Skipped
Details

Browse Source
This commit is contained in:
Per Hoener
2026-09-18 23:37:19 +02:00
commit 0d45331f5c
135 changed files with 20651 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yml
+627
View File
@@ -0,0 +1,627 @@
name: Deploy
permissions:
contents: read
concurrency:
group: website-starter-deploy-${{ github.event_name == 'schedule' && 'scheduled' || github.event.inputs.rollback_target || github.ref_name }}
cancel-in-progress: false
on:
push:
branches:
- dev
- master
workflow_dispatch:
inputs:
rollback_target:
description: "Rollback target: dev or master. Leave empty for a normal manual deploy."
required: false
app_image_tag:
description: "Next app image tag for rollback."
required: false
schedule:
- cron: "17 3 * * 1"
env:
DOCKER_BUILDKIT: 1
NODE_VERSION_FILE: .node-version
TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
REGISTRY: ${{ vars.CONTAINER_REGISTRY }}
APP_IMAGE_REPOSITORY: ${{ vars.APP_IMAGE_REPOSITORY }}
APP_NAME: ${{ vars.APP_NAME }}
COMPANY_NAME: ${{ vars.COMPANY_NAME }}
CONTACT_EMAIL: ${{ vars.CONTACT_EMAIL }}
CONTACT_PHONE: ${{ vars.CONTACT_PHONE }}
CONTACT_ADDRESS: ${{ vars.CONTACT_ADDRESS }}
jobs:
validate-dispatch:
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 5
steps:
- name: Validate workflow dispatch inputs
env:
EVENT_NAME: ${{ github.event_name }}
REF_NAME: ${{ github.ref_name }}
ROLLBACK_TARGET: ${{ github.event.inputs.rollback_target }}
APP_IMAGE_TAG: ${{ github.event.inputs.app_image_tag }}
run: |
set -eu
if [ "$EVENT_NAME" != "workflow_dispatch" ]; then
exit 0
fi
fail() {
echo "$1" >&2
exit 1
}
validate_tag() {
key="$1"
value="$2"
case "$value" in
[A-Za-z0-9_]* ) ;;
*) fail "Invalid Docker image tag for $key." ;;
esac
case "$value" in
*[!A-Za-z0-9_.-]* ) fail "Invalid Docker image tag for $key." ;;
esac
if [ "${#value}" -gt 128 ]; then
fail "Docker image tag for $key exceeds 128 characters."
fi
}
case "$REF_NAME" in
dev|master) ;;
*) fail "Manual deployments must be dispatched from dev or master." ;;
esac
if [ -z "$ROLLBACK_TARGET" ]; then
if [ -n "$APP_IMAGE_TAG" ]; then
fail "Image tags require rollback_target."
fi
exit 0
fi
case "$ROLLBACK_TARGET" in
dev|master) ;;
*) fail "rollback_target must be dev or master." ;;
esac
if [ "$ROLLBACK_TARGET" != "$REF_NAME" ]; then
fail "rollback_target must match the dispatched branch."
fi
validate_tag APP_IMAGE_TAG "$APP_IMAGE_TAG"
changes:
if: github.event_name != 'schedule' && (github.event_name != 'workflow_dispatch' || github.event.inputs.rollback_target == '')
needs: [validate-dispatch]
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 5
outputs:
deploy: ${{ steps.detect.outputs.deploy }}
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
fetch-depth: 0
- name: Detect changed areas
id: detect
env:
CHANGESET_BEFORE: ${{ github.event.before }}
run: sh scripts/detect-ci-changes.sh
app-quality:
if: github.event_name != 'schedule' && needs.changes.outputs.deploy == 'true'
needs: [changes]
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 30
env:
APP_URL: https://example.com
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version-file: ${{ env.NODE_VERSION_FILE }}
cache: npm
cache-dependency-path: package-lock.json
- name: Install dependencies
run: npm ci
- name: Restore and update image cache
env:
IMAGE_CACHE_NAMESPACE: ${{ github.ref_name }}
run: sh scripts/prepare-image-cache.sh
- name: Lint
run: npm run lint
- name: Test
run: npm run test
- name: Type check
run: npm run typecheck
- name: Build
env:
SKIP_IMAGE_OPTIMIZATION: true
run: npm run build
- name: E2E smoke test
env:
SKIP_IMAGE_OPTIMIZATION: true
run: npm run test:e2e
secret-scan:
if: github.event_name != 'schedule' && needs.changes.outputs.deploy == 'true'
needs: [changes]
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 15
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
- name: Scan repository for committed secrets
run: sh scripts/trivy-scan.sh secret-fs .
security-deps:
if: github.event_name != 'schedule' && needs.changes.outputs.deploy == 'true'
needs: [changes]
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 30
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
- name: Report app dependency vulnerabilities
run: sh scripts/trivy-scan.sh vuln-fs .
- name: Block high and critical app dependency vulnerabilities
env:
TRIVY_SEVERITY: HIGH,CRITICAL
TRIVY_EXIT_CODE: 1
run: sh scripts/trivy-scan.sh vuln-fs .
context:
if: >
needs.changes.outputs.deploy == 'true' &&
(
(github.event_name == 'push' &&
github.event.pull_request == null &&
(github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/master')) ||
(github.event_name == 'workflow_dispatch' &&
github.event.pull_request == null &&
(github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/master'))
)
needs: [changes]
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 5
outputs:
environment_name: ${{ steps.resolve.outputs.environment_name }}
primary_domain: ${{ steps.resolve.outputs.primary_domain }}
app_url: ${{ steps.resolve.outputs.app_url }}
cors_origin: ${{ steps.resolve.outputs.cors_origin }}
deploy_stack_name: ${{ steps.resolve.outputs.deploy_stack_name }}
traefik_certresolver: ${{ steps.resolve.outputs.traefik_certresolver }}
traefik_network_name: ${{ steps.resolve.outputs.traefik_network_name }}
steps:
- name: Resolve deployment target
id: resolve
env:
REF_NAME: ${{ github.ref_name }}
DEV_PRIMARY_DOMAIN: ${{ vars.DEV_PRIMARY_DOMAIN }}
DEV_APP_URL: ${{ vars.DEV_APP_URL }}
DEV_CORS_ORIGIN: ${{ vars.DEV_CORS_ORIGIN }}
DEV_DEPLOY_STACK_NAME: ${{ vars.DEV_DEPLOY_STACK_NAME }}
DEV_TRAEFIK_CERTRESOLVER: ${{ secrets.DEV_TRAEFIK_CERTRESOLVER }}
DEV_TRAEFIK_NETWORK_NAME: ${{ vars.DEV_TRAEFIK_NETWORK_NAME }}
PROD_PRIMARY_DOMAIN: ${{ vars.PROD_PRIMARY_DOMAIN }}
PROD_APP_URL: ${{ vars.PROD_APP_URL }}
PROD_CORS_ORIGIN: ${{ vars.PROD_CORS_ORIGIN }}
PROD_DEPLOY_STACK_NAME: ${{ vars.PROD_DEPLOY_STACK_NAME }}
PROD_TRAEFIK_CERTRESOLVER: ${{ secrets.PROD_TRAEFIK_CERTRESOLVER }}
PROD_TRAEFIK_NETWORK_NAME: ${{ vars.PROD_TRAEFIK_NETWORK_NAME }}
run: |
set -eu
set_output() {
printf '%s=%s\n' "$1" "$2" >> "$GITHUB_OUTPUT"
}
require_value() {
key="$1"
value="$2"
if [ -z "$value" ]; then
echo "Missing required workflow configuration: $key" >&2
exit 1
fi
}
case "$REF_NAME" in
dev)
config_prefix="DEV"
environment_name="dev"
primary_domain="$DEV_PRIMARY_DOMAIN"
app_url="${DEV_APP_URL:-}"
cors_origin="${DEV_CORS_ORIGIN:-}"
deploy_stack_name="${DEV_DEPLOY_STACK_NAME:-website-starter-dev}"
traefik_certresolver="$DEV_TRAEFIK_CERTRESOLVER"
traefik_network_name="${DEV_TRAEFIK_NETWORK_NAME:-traefik-external}"
;;
master)
config_prefix="PROD"
environment_name="production"
primary_domain="$PROD_PRIMARY_DOMAIN"
app_url="${PROD_APP_URL:-}"
cors_origin="${PROD_CORS_ORIGIN:-}"
deploy_stack_name="${PROD_DEPLOY_STACK_NAME:-website-starter-prod}"
traefik_certresolver="$PROD_TRAEFIK_CERTRESOLVER"
traefik_network_name="${PROD_TRAEFIK_NETWORK_NAME:-traefik}"
;;
*)
echo "Branch $REF_NAME is not configured for deployment." >&2
exit 1
;;
esac
require_value "${config_prefix}_PRIMARY_DOMAIN" "$primary_domain"
require_value "${config_prefix}_TRAEFIK_CERTRESOLVER" "$traefik_certresolver"
if [ -z "$app_url" ]; then
app_url="https://$primary_domain"
fi
if [ -z "$cors_origin" ]; then
cors_origin="$app_url"
fi
set_output "environment_name" "$environment_name"
set_output "primary_domain" "$primary_domain"
set_output "app_url" "$app_url"
set_output "cors_origin" "$cors_origin"
set_output "deploy_stack_name" "$deploy_stack_name"
set_output "traefik_certresolver" "$traefik_certresolver"
set_output "traefik_network_name" "$traefik_network_name"
app-image:
if: github.event_name != 'schedule' && needs.changes.outputs.deploy == 'true'
needs: [changes, context, app-quality, secret-scan, security-deps]
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 30
env:
APP_URL: ${{ needs.context.outputs.app_url }}
APP_IMAGE_NAME: ${{ env.APP_IMAGE_REPOSITORY }}:${{ github.ref_name }}-${{ github.sha }}-${{ github.run_id }}
APP_BRANCH_IMAGE_NAME: ${{ env.APP_IMAGE_REPOSITORY }}:${{ github.ref_name }}
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
- name: Setup Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version-file: ${{ env.NODE_VERSION_FILE }}
cache: npm
cache-dependency-path: package-lock.json
- name: Install dependencies
run: npm ci
- name: Restore and update image cache
env:
IMAGE_CACHE_NAMESPACE: ${{ github.ref_name }}
run: sh scripts/prepare-image-cache.sh
- name: Build app runtime image
run: |
docker build --pull \
--build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
--build-arg VCS_REF="${{ github.sha }}" \
--build-arg APP_URL="$APP_URL" \
--build-arg APP_NAME="${APP_NAME:-Example Website}" \
--build-arg COMPANY_NAME="${COMPANY_NAME:-Example Company}" \
--build-arg CONTACT_EMAIL="${CONTACT_EMAIL:-info@example.com}" \
--build-arg CONTACT_PHONE="${CONTACT_PHONE:-+49 000 000000}" \
--build-arg CONTACT_ADDRESS="${CONTACT_ADDRESS:-Example Street 1, 12345 Example City}" \
--build-arg SOURCE_URL="${{ github.server_url }}/${{ github.repository }}" \
--build-arg SKIP_IMAGE_OPTIMIZATION=true \
--build-arg IMAGE_CACHE_NAMESPACE="${{ github.ref_name }}" \
-f Dockerfile \
-t "$APP_IMAGE_NAME" \
-t "$APP_BRANCH_IMAGE_NAME" \
.
- name: Report app runtime image vulnerabilities
run: sh scripts/trivy-scan.sh vuln-image "$APP_IMAGE_NAME"
- name: Block high and critical app runtime vulnerabilities
env:
TRIVY_SEVERITY: HIGH,CRITICAL
TRIVY_EXIT_CODE: 1
run: sh scripts/trivy-scan.sh vuln-image "$APP_IMAGE_NAME"
- name: Push app runtime image
env:
REGISTRY_USERNAME: ${{ secrets.PACKAGES_USERNAME }}
REGISTRY_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
run: |
set -eu
if [ -z "${REGISTRY_USERNAME:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
echo "Missing required secrets: PACKAGES_USERNAME and PACKAGES_TOKEN" >&2
exit 1
fi
docker_config="$(mktemp -d)"
cleanup() {
DOCKER_CONFIG="$docker_config" docker logout "$REGISTRY" >/dev/null 2>&1 || true
rm -rf "$docker_config"
}
trap cleanup EXIT
trap 'exit 1' HUP INT TERM
export DOCKER_CONFIG="$docker_config"
echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USERNAME" --password-stdin
docker push "$APP_IMAGE_NAME"
docker push "$APP_BRANCH_IMAGE_NAME"
deploy-dev:
if: github.event_name != 'schedule' && needs.changes.outputs.deploy == 'true' && github.ref == 'refs/heads/dev'
needs: [changes, context, app-quality, app-image, secret-scan, security-deps]
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 30
env:
CALENDAR_URL: ${{ secrets.CALENDAR_URL }}
PRIMARY_DOMAIN: ${{ needs.context.outputs.primary_domain }}
APP_URL: ${{ needs.context.outputs.app_url }}
CORS_ORIGIN: ${{ needs.context.outputs.cors_origin }}
COMPOSE_PROJECT_NAME: ${{ needs.context.outputs.deploy_stack_name }}
TRAEFIK_STACK_NAME: ${{ needs.context.outputs.deploy_stack_name }}
TRAEFIK_CERTRESOLVER: ${{ needs.context.outputs.traefik_certresolver }}
TRAEFIK_NETWORK_NAME: ${{ needs.context.outputs.traefik_network_name }}
DEPLOY_TARGET: dev
APP_IMAGE_NAME: ${{ env.APP_IMAGE_REPOSITORY }}:dev-${{ github.sha }}-${{ github.run_id }}
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
- name: Pull app runtime image
env:
REGISTRY_USERNAME: ${{ secrets.PACKAGES_USERNAME }}
REGISTRY_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
run: |
set -eu
if [ -z "${REGISTRY_USERNAME:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
echo "Missing required secrets: PACKAGES_USERNAME and PACKAGES_TOKEN" >&2
exit 1
fi
docker_config="$(mktemp -d)"
cleanup() {
DOCKER_CONFIG="$docker_config" docker logout "$REGISTRY" >/dev/null 2>&1 || true
rm -rf "$docker_config"
}
trap cleanup EXIT
trap 'exit 1' HUP INT TERM
export DOCKER_CONFIG="$docker_config"
echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USERNAME" --password-stdin
docker pull "$APP_IMAGE_NAME"
- name: Validate runtime configuration
run: |
if [ -z "${CALENDAR_URL:-}" ]; then
echo "Missing required secret: CALENDAR_URL" >&2
exit 1
fi
- name: Print deployment target
run: |
echo "Environment: ${{ needs.context.outputs.environment_name }}"
echo "Site host: $PRIMARY_DOMAIN"
echo "Compose project: $COMPOSE_PROJECT_NAME"
- name: Deploy and verify app
run: sh scripts/deploy-and-verify.sh
deploy-master:
if: github.event_name != 'schedule' && needs.changes.outputs.deploy == 'true' && github.ref == 'refs/heads/master'
needs: [changes, context, app-quality, app-image, secret-scan, security-deps]
runs-on: ${{ vars.PROD_RUNNER || vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 30
env:
CALENDAR_URL: ${{ secrets.CALENDAR_URL }}
PRIMARY_DOMAIN: ${{ needs.context.outputs.primary_domain }}
APP_URL: ${{ needs.context.outputs.app_url }}
CORS_ORIGIN: ${{ needs.context.outputs.cors_origin }}
COMPOSE_PROJECT_NAME: ${{ needs.context.outputs.deploy_stack_name }}
TRAEFIK_STACK_NAME: ${{ needs.context.outputs.deploy_stack_name }}
TRAEFIK_CERTRESOLVER: ${{ needs.context.outputs.traefik_certresolver }}
TRAEFIK_NETWORK_NAME: ${{ needs.context.outputs.traefik_network_name }}
DEPLOY_TARGET: master
APP_IMAGE_NAME: ${{ env.APP_IMAGE_REPOSITORY }}:master-${{ github.sha }}-${{ github.run_id }}
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
- name: Pull app runtime image
env:
REGISTRY_USERNAME: ${{ secrets.PACKAGES_USERNAME }}
REGISTRY_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
run: |
set -eu
if [ -z "${REGISTRY_USERNAME:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
echo "Missing required secrets: PACKAGES_USERNAME and PACKAGES_TOKEN" >&2
exit 1
fi
docker_config="$(mktemp -d)"
cleanup() {
DOCKER_CONFIG="$docker_config" docker logout "$REGISTRY" >/dev/null 2>&1 || true
rm -rf "$docker_config"
}
trap cleanup EXIT
trap 'exit 1' HUP INT TERM
export DOCKER_CONFIG="$docker_config"
echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USERNAME" --password-stdin
docker pull "$APP_IMAGE_NAME"
- name: Validate runtime configuration
run: |
if [ -z "${CALENDAR_URL:-}" ]; then
echo "Missing required secret: CALENDAR_URL" >&2
exit 1
fi
- name: Print deployment target
run: |
echo "Environment: ${{ needs.context.outputs.environment_name }}"
echo "Site host: $PRIMARY_DOMAIN"
echo "Compose project: $COMPOSE_PROJECT_NAME"
- name: Deploy and verify app
run: sh scripts/deploy-and-verify.sh
scheduled-rebuild-dev:
if: github.event_name == 'schedule'
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 45
env:
DEPLOY_TARGET: dev
CALENDAR_URL: ${{ secrets.CALENDAR_URL }}
PRIMARY_DOMAIN: ${{ vars.DEV_PRIMARY_DOMAIN }}
APP_URL: ${{ vars.DEV_APP_URL }}
CORS_ORIGIN: ${{ vars.DEV_CORS_ORIGIN }}
COMPOSE_PROJECT_NAME: ${{ vars.DEV_DEPLOY_STACK_NAME }}
TRAEFIK_STACK_NAME: ${{ vars.DEV_DEPLOY_STACK_NAME }}
TRAEFIK_CERTRESOLVER: ${{ secrets.DEV_TRAEFIK_CERTRESOLVER }}
TRAEFIK_NETWORK_NAME: ${{ vars.DEV_TRAEFIK_NETWORK_NAME }}
steps:
- name: Checkout dev branch
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
ref: dev
lfs: true
- name: Scan repository for committed secrets
run: sh scripts/trivy-scan.sh secret-fs .
- name: Report app dependency vulnerabilities
run: sh scripts/trivy-scan.sh vuln-fs .
- name: Block high and critical app dependency vulnerabilities
env:
TRIVY_SEVERITY: HIGH,CRITICAL
TRIVY_EXIT_CODE: 1
run: sh scripts/trivy-scan.sh vuln-fs .
- name: Rebuild latest base image and deploy dev
env:
REGISTRY_USERNAME: ${{ secrets.PACKAGES_USERNAME }}
REGISTRY_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
run: sh scripts/scheduled-rebuild-deploy.sh
scheduled-rebuild-master:
if: github.event_name == 'schedule'
runs-on: ${{ vars.PROD_RUNNER || vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 45
env:
DEPLOY_TARGET: master
CALENDAR_URL: ${{ secrets.CALENDAR_URL }}
PRIMARY_DOMAIN: ${{ vars.PROD_PRIMARY_DOMAIN }}
APP_URL: ${{ vars.PROD_APP_URL }}
CORS_ORIGIN: ${{ vars.PROD_CORS_ORIGIN }}
COMPOSE_PROJECT_NAME: ${{ vars.PROD_DEPLOY_STACK_NAME }}
TRAEFIK_STACK_NAME: ${{ vars.PROD_DEPLOY_STACK_NAME }}
TRAEFIK_CERTRESOLVER: ${{ secrets.PROD_TRAEFIK_CERTRESOLVER }}
TRAEFIK_NETWORK_NAME: ${{ vars.PROD_TRAEFIK_NETWORK_NAME }}
steps:
- name: Checkout master branch
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
ref: master
lfs: true
- name: Scan repository for committed secrets
run: sh scripts/trivy-scan.sh secret-fs .
- name: Report app dependency vulnerabilities
run: sh scripts/trivy-scan.sh vuln-fs .
- name: Block high and critical app dependency vulnerabilities
env:
TRIVY_SEVERITY: HIGH,CRITICAL
TRIVY_EXIT_CODE: 1
run: sh scripts/trivy-scan.sh vuln-fs .
- name: Rebuild latest base image and deploy master
env:
REGISTRY_USERNAME: ${{ secrets.PACKAGES_USERNAME }}
REGISTRY_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
run: sh scripts/scheduled-rebuild-deploy.sh
rollback-dev:
if: github.event_name == 'workflow_dispatch' && github.event.inputs.rollback_target == 'dev' && github.ref == 'refs/heads/dev'
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 30
env:
DEPLOY_TARGET: dev
CALENDAR_URL: ${{ secrets.CALENDAR_URL }}
PRIMARY_DOMAIN: ${{ vars.DEV_PRIMARY_DOMAIN }}
APP_URL: ${{ vars.DEV_APP_URL }}
CORS_ORIGIN: ${{ vars.DEV_CORS_ORIGIN }}
COMPOSE_PROJECT_NAME: ${{ vars.DEV_DEPLOY_STACK_NAME }}
TRAEFIK_STACK_NAME: ${{ vars.DEV_DEPLOY_STACK_NAME }}
TRAEFIK_CERTRESOLVER: ${{ secrets.DEV_TRAEFIK_CERTRESOLVER }}
TRAEFIK_NETWORK_NAME: ${{ vars.DEV_TRAEFIK_NETWORK_NAME }}
APP_IMAGE_TAG: ${{ github.event.inputs.app_image_tag }}
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
- name: Deploy rollback and verify app
env:
REGISTRY_USERNAME: ${{ secrets.PACKAGES_USERNAME }}
REGISTRY_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
run: sh scripts/manual-rollback-deploy.sh
rollback-master:
if: github.event_name == 'workflow_dispatch' && github.event.inputs.rollback_target == 'master' && github.ref == 'refs/heads/master'
runs-on: ${{ vars.PROD_RUNNER || vars.CI_RUNNER || 'ubuntu-latest' }}
timeout-minutes: 30
env:
DEPLOY_TARGET: master
CALENDAR_URL: ${{ secrets.CALENDAR_URL }}
PRIMARY_DOMAIN: ${{ vars.PROD_PRIMARY_DOMAIN }}
APP_URL: ${{ vars.PROD_APP_URL }}
CORS_ORIGIN: ${{ vars.PROD_CORS_ORIGIN }}
COMPOSE_PROJECT_NAME: ${{ vars.PROD_DEPLOY_STACK_NAME }}
TRAEFIK_STACK_NAME: ${{ vars.PROD_DEPLOY_STACK_NAME }}
TRAEFIK_CERTRESOLVER: ${{ secrets.PROD_TRAEFIK_CERTRESOLVER }}
TRAEFIK_NETWORK_NAME: ${{ vars.PROD_TRAEFIK_NETWORK_NAME }}
APP_IMAGE_TAG: ${{ github.event.inputs.app_image_tag }}
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
lfs: true
- name: Deploy rollback and verify app
env:
REGISTRY_USERNAME: ${{ secrets.PACKAGES_USERNAME }}
REGISTRY_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
run: sh scripts/manual-rollback-deploy.sh