.gitea/workflows/deploy-production.yml

@@ -54,22 +54,27 @@ jobs:
           mkdir -p "$DEPLOY_PATH"
           printf '%s\n' "$ENV_PRODUCTION" > "$DEPLOY_PATH/.env.production"
           chmod 600 "$DEPLOY_PATH/.env.production"
+          chown desenvolvimento:desenvolvimento "$DEPLOY_PATH/.env.production"
 
       - name: Deploy files and restart PM2
         shell: bash
         run: |
           set -euo pipefail
 
+          # O runner roda como root (compartilhado com outras automacoes deste servidor), mas o
+          # app deve rodar como 'desenvolvimento' - e o dono do PM2/logs/.env.production hoje.
+          # Em vez de mudar o usuario do runner (afetaria outras automacoes), so essa etapa troca
+          # de usuario via sudo -u, escrevendo o script num arquivo temporario pra evitar qualquer
+          # ambiguidade de escaping de aspas dentro do 'run:' do workflow.
           DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
           LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"
+          DEPLOY_SCRIPT="/tmp/sn-glpi-sync-new.deploy.sh"
 
           mkdir -p "$DEPLOY_PATH"
 
-          (
-            flock -n 9 || {
-              echo "Another deploy is already running."
-              exit 1
-            }
+          cat > "$DEPLOY_SCRIPT" <<'DEPLOY_EOF'
+          #!/usr/bin/env bash
+          set -euo pipefail
 
           if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
             rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
@@ -81,7 +86,7 @@ jobs:
             --exclude='.env*' \
             --exclude='node_modules/' \
             --exclude='logs/' \
-              ./ "$DEPLOY_PATH"/
+            "$SRC_DIR"/ "$DEPLOY_PATH"/
 
           cd "$DEPLOY_PATH"
 
@@ -102,8 +107,19 @@ jobs:
           pm2 startOrRestart ecosystem.config.js --env production
           pm2 save
           pm2 list
+          DEPLOY_EOF
+          chmod +x "$DEPLOY_SCRIPT"
+
+          (
+            flock -n 9 || {
+              echo "Another deploy is already running."
+              exit 1
+            }
+            sudo -u desenvolvimento -H DEPLOY_PATH="$DEPLOY_PATH" SRC_DIR="$PWD" bash "$DEPLOY_SCRIPT"
           ) 9>"$LOCK_FILE"
 
+          rm -f "$DEPLOY_SCRIPT"
+
       - name: Show sync logs
         if: always()
         shell: bash