Rafael Lopes
cefeb3ea25
O head fecha o pipe apos ler a primeira linha, o rsync recebe broken pipe e sai com codigo de erro, e o pipefail propaga isso como falha do step inteiro - mesmo a versao ja tendo sido impressa com sucesso. Confirmado no primeiro run real do workflow em producao: Preflight falhou logo depois de imprimir as versoes, todos os steps seguintes (secrets, validacao, deploy) ficaram pulados, sem tocar na VM.
108 lines
2.9 KiB
YAML
108 lines
2.9 KiB
YAML
name: Deploy production
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
name: Deploy to production VM
|
|
runs-on: vm-prod
|
|
env:
|
|
PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Preflight
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
echo "Runner: $(hostname)"
|
|
node --version
|
|
npm --version
|
|
pm2 --version
|
|
rsync --version | head -n 1 || true
|
|
|
|
- name: Check required secrets
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${{ secrets.ENV_PRODUCTION }}" ]; then
|
|
echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate JavaScript
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
|
|
|
|
- name: Write .env.production from secret
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
|
|
mkdir -p "$DEPLOY_PATH"
|
|
printf '%s\n' "${{ secrets.ENV_PRODUCTION }}" > "$DEPLOY_PATH/.env.production"
|
|
chmod 600 "$DEPLOY_PATH/.env.production"
|
|
|
|
- name: Deploy files and restart PM2
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
|
|
LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"
|
|
|
|
mkdir -p "$DEPLOY_PATH"
|
|
|
|
(
|
|
flock -n 9 || {
|
|
echo "Another deploy is already running."
|
|
exit 1
|
|
}
|
|
|
|
if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
|
|
rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
|
|
fi
|
|
|
|
rsync -az --delete \
|
|
--exclude='.git/' \
|
|
--exclude='.gitea/' \
|
|
--exclude='.env*' \
|
|
--exclude='node_modules/' \
|
|
--exclude='logs/' \
|
|
./ "$DEPLOY_PATH"/
|
|
|
|
cd "$DEPLOY_PATH"
|
|
|
|
test -f .env.production || {
|
|
echo "Missing $DEPLOY_PATH/.env.production"
|
|
exit 1
|
|
}
|
|
|
|
grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
|
|
echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
|
|
exit 1
|
|
}
|
|
|
|
npm ci --omit=dev
|
|
|
|
find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
|
|
|
|
pm2 startOrRestart ecosystem.config.js --env production
|
|
pm2 save
|
|
pm2 list
|
|
) 9>"$LOCK_FILE"
|
|
|
|
- name: Show sync logs
|
|
if: always()
|
|
shell: bash
|
|
run: |
|
|
pm2 logs sn-glpi-sync-cron --nostream --lines 80 || true
|