Rafael Lopes
2cf6e9f2fb
Adiciona um step que escreve o .env.production a partir do secret ENV_PRODUCTION do Gitea Actions (com chmod 600), eliminando o modelo anterior de manter esse arquivo manualmente na VM sem nenhuma copia de seguranca. Um step anterior falha cedo e com mensagem clara se o secret nao estiver configurado. Antes de sincronizar o codigo novo, guarda a versao anterior em $DEPLOY_PATH.previous, permitindo rollback manual rapido caso o deploy suba algo quebrado (o node --check so pega erro de sintaxe, nao de logica). Troca a lista fixa de arquivos validados por node --check (que ja estava desatualizada, sem cobrir arquivos tocados em mudancas recentes) por uma varredura em todo .js do projeto.
108 lines
2.9 KiB
YAML
108 lines
2.9 KiB
YAML
name: Deploy production
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
name: Deploy to production VM
|
|
runs-on: vm-prod
|
|
env:
|
|
PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Preflight
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
echo "Runner: $(hostname)"
|
|
node --version
|
|
npm --version
|
|
pm2 --version
|
|
rsync --version | head -n 1
|
|
|
|
- name: Check required secrets
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
if [ -z "${{ secrets.ENV_PRODUCTION }}" ]; then
|
|
echo "Missing secret ENV_PRODUCTION. Configure it in Settings > Actions > Secrets before deploying."
|
|
exit 1
|
|
fi
|
|
|
|
- name: Validate JavaScript
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
|
|
|
|
- name: Write .env.production from secret
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
|
|
mkdir -p "$DEPLOY_PATH"
|
|
printf '%s\n' "${{ secrets.ENV_PRODUCTION }}" > "$DEPLOY_PATH/.env.production"
|
|
chmod 600 "$DEPLOY_PATH/.env.production"
|
|
|
|
- name: Deploy files and restart PM2
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
DEPLOY_PATH="${PROD_DEPLOY_PATH:-/opt/sn-glpi-sync-new}"
|
|
LOCK_FILE="/tmp/sn-glpi-sync-new.deploy.lock"
|
|
|
|
mkdir -p "$DEPLOY_PATH"
|
|
|
|
(
|
|
flock -n 9 || {
|
|
echo "Another deploy is already running."
|
|
exit 1
|
|
}
|
|
|
|
if [ -d "$DEPLOY_PATH" ] && [ -n "$(ls -A "$DEPLOY_PATH" 2>/dev/null)" ]; then
|
|
rsync -a --delete "$DEPLOY_PATH"/ "$DEPLOY_PATH.previous"/
|
|
fi
|
|
|
|
rsync -az --delete \
|
|
--exclude='.git/' \
|
|
--exclude='.gitea/' \
|
|
--exclude='.env*' \
|
|
--exclude='node_modules/' \
|
|
--exclude='logs/' \
|
|
./ "$DEPLOY_PATH"/
|
|
|
|
cd "$DEPLOY_PATH"
|
|
|
|
test -f .env.production || {
|
|
echo "Missing $DEPLOY_PATH/.env.production"
|
|
exit 1
|
|
}
|
|
|
|
grep -q '^SERVICENOW_CAOA_TI_GROUP_ID=.\+' .env.production || {
|
|
echo "SERVICENOW_CAOA_TI_GROUP_ID must be set in $DEPLOY_PATH/.env.production"
|
|
exit 1
|
|
}
|
|
|
|
npm ci --omit=dev
|
|
|
|
find . -path ./node_modules -prune -o -name '*.js' -print | xargs -n1 node --check
|
|
|
|
pm2 startOrRestart ecosystem.config.js --env production
|
|
pm2 save
|
|
pm2 list
|
|
) 9>"$LOCK_FILE"
|
|
|
|
- name: Show sync logs
|
|
if: always()
|
|
shell: bash
|
|
run: |
|
|
pm2 logs sn-glpi-sync-cron --nostream --lines 80 || true
|