.gitea/workflows/deploy-production.yml

@@ -54,56 +54,72 @@ jobs:
           mkdir -p "$DEPLOY_PATH"
           printf '%s\n' "$ENV_PRODUCTION" > "$DEPLOY_PATH/.env.production"
           chmod 600 "$DEPLOY_PATH/.env.production"
+          chown desenvolvimento:desenvolvimento "$DEPLOY_PATH/.env.production"
 
       - name: Deploy files and restart PM2
         shell: bash
         run: |
           set -euo pipefail
 
+          # O runner roda como root (compartilhado com outras automacoes deste servidor), mas o
+          # app deve rodar como 'desenvolvimento' - e o dono do PM2/logs/.env.production hoje.
+          # Em vez de mudar o usuario do runner (afetaria outras automacoes), so essa etapa troca
+          # de usuario via sudo -u, escrevendo o script num arquivo temporario pra evitar qualquer
+          # ambiguidade de escaping de aspas dentro do 'run:' do workflow.
           DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
           LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"
+          DEPLOY_SCRIPT="/tmp/sn-glpi-sync-new.deploy.sh"
 
           mkdir -p "$DEPLOY_PATH"
 
+          cat > "$DEPLOY_SCRIPT" <<'DEPLOY_EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
+
+          if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
+            rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
+          fi
+
+          rsync -az --delete \
+            --exclude='.git/' \
+            --exclude='.gitea/' \
+            --exclude='.env*' \
+            --exclude='node_modules/' \
+            --exclude='logs/' \
+            "$SRC_DIR"/ "$DEPLOY_PATH"/
+
+          cd "$DEPLOY_PATH"
+
+          test -f .env.production || {
+            echo "Missing $DEPLOY_PATH/.env.production"
+            exit 1
+          }
+
+          grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
+            echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
+            exit 1
+          }
+
+          npm ci --omit=dev
+
+          find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
+
+          pm2 startOrRestart ecosystem.config.js --env production
+          pm2 save
+          pm2 list
+          DEPLOY_EOF
+          chmod +x "$DEPLOY_SCRIPT"
+
           (
             flock -n 9 || {
               echo "Another deploy is already running."
               exit 1
             }
-
+            sudo -u desenvolvimento -H DEPLOY_PATH="$DEPLOY_PATH" SRC_DIR="$PWD" bash "$DEPLOY_SCRIPT"
-            if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
-              rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
-            fi
-
-            rsync -az --delete \
-              --exclude='.git/' \
-              --exclude='.gitea/' \
-              --exclude='.env*' \
-              --exclude='node_modules/' \
-              --exclude='logs/' \
-              ./ "$DEPLOY_PATH"/
-
-            cd "$DEPLOY_PATH"
-
-            test -f .env.production || {
-              echo "Missing $DEPLOY_PATH/.env.production"
-              exit 1
-            }
-
-            grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
-              echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
-              exit 1
-            }
-
-            npm ci --omit=dev
-
-            find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
-
-            pm2 startOrRestart ecosystem.config.js --env production
-            pm2 save
-            pm2 list
           ) 9>"$LOCK_FILE"
 
+          rm -f "$DEPLOY_SCRIPT"
+
       - name: Show sync logs
         if: always()
         shell: bash