Deploy site: publish to the registry only; the s1 steps go
Deploy test site / deploy (push) Successful in 28s
Deploy test site / deploy (push) Successful in 28s
cnxvinyl.lol resolves to bkk01 since Nov 4, 2026 (cnx-network-clan PR #49), which serves the releases from the B4L package registry. The SSH setup, rsync and swap on s1 are removed; the URL check now waits up to two minutes for bkk01 to fetch the new release. The VPS_* secrets are no longer read, and the job token only reads the repository.
This commit is contained in:
grabowski committed
1 parent
9b0c7b42f5
commit
380629e382
1 file changed
+28
-102
@@ -1,15 +1,15 @@
|
||||
name: Deploy test site
|
||||
|
||||
# Builds site/dist (site/public/ plus demo pages copied out of docs/, see
|
||||
# site/build.sh) and publishes it to https://cnxvinyl.lol/ on the
|
||||
# buildfor.life web server (s1), the same Caddy that serves the blog.
|
||||
# One-time setup (DNS, Caddy vhost, secrets, deploy key): site/README.md.
|
||||
# site/build.sh) and publishes it to the B4L package registry as the generic
|
||||
# package B4L/cnxvinyl.lol. bkk01 serves https://cnxvinyl.lol/ from those
|
||||
# releases (cnx-network-clan, docs/src/s1-migration.md): the registry's
|
||||
# package event makes it fetch a new version within seconds, and a timer
|
||||
# there fetches every 15 minutes as a backstop.
|
||||
#
|
||||
# Secrets (repo or user level):
|
||||
# VPS_HOST, VPS_USER, VPS_SSH_KEY required; same server as the blog
|
||||
# VPS_PORT optional, default 22
|
||||
# VPS_KNOWN_HOSTS optional pinned host key line(s);
|
||||
# without it the key is scanned per run
|
||||
# Secrets (organization level): REGISTRY_USER, REGISTRY_TOKEN, an account with
|
||||
# a write:package token in a B4L team that may write packages (b4l-ci). The
|
||||
# job's own token only reads the repository: the registry refuses it.
|
||||
|
||||
on:
|
||||
push:
|
||||
@@ -21,20 +21,19 @@ on:
|
||||
- ".gitea/workflows/deploy-site.yml"
|
||||
workflow_dispatch:
|
||||
|
||||
# A newer push supersedes a running deploy. Safe to cancel mid-run: rsync
|
||||
# writes the non-live directory and the rename swap happens last.
|
||||
# A newer push supersedes a running deploy; bkk01 serves whichever version
|
||||
# the registry lists as the latest.
|
||||
concurrency:
|
||||
group: deploy-cnxvinyl-lol
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
VPS_HOST: ${{ secrets.VPS_HOST }}
|
||||
VPS_USER: ${{ secrets.VPS_USER }}
|
||||
VPS_PORT: ${{ secrets.VPS_PORT }}
|
||||
SITE_DIR: /var/www/cnxvinyl.lol
|
||||
SITE_URL: https://cnxvinyl.lol
|
||||
steps:
|
||||
- name: Checkout
|
||||
@@ -43,14 +42,9 @@ jobs:
|
||||
- name: Build site/dist
|
||||
run: bash site/build.sh
|
||||
|
||||
- name: Publish to the package registry (bkk01)
|
||||
# bkk01 serves cnxvinyl.lol from releases in the B4L package registry
|
||||
# (cnx-network-clan, docs/src/s1-migration.md): the package event
|
||||
# makes it fetch this version within seconds. Until DNS moves to
|
||||
# bkk01, s1 below stays the live server and gets the same build.
|
||||
# First, so a failing s1 step cannot hold back bkk01's release.
|
||||
# REGISTRY_USER / REGISTRY_TOKEN: organization secrets, an account
|
||||
# with a write:package token in a B4L team that may write packages.
|
||||
- name: Publish to the package registry
|
||||
# The version joins the UTC time and the commit, so versions never
|
||||
# collide. The archive holds the site's root itself.
|
||||
env:
|
||||
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
||||
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
||||
@@ -65,86 +59,18 @@ jobs:
|
||||
"${{ github.server_url }}/api/packages/${{ github.repository_owner }}/generic/cnxvinyl.lol/$version/site.tar.gz"
|
||||
echo "published cnxvinyl.lol $version ($(du -h site.tar.gz | cut -f1))"
|
||||
|
||||
- name: Set up SSH
|
||||
env:
|
||||
VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
|
||||
VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
|
||||
run: |
|
||||
if [ -z "$VPS_HOST" ] || [ -z "$VPS_USER" ] || [ -z "$VPS_SSH_KEY" ]; then
|
||||
echo "::error::VPS_HOST, VPS_USER and VPS_SSH_KEY must be set as Actions secrets (see site/README.md)"
|
||||
exit 1
|
||||
fi
|
||||
port=${VPS_PORT:-22}
|
||||
# ssh refuses a config that is group/world-writable or owned by
|
||||
# another user ("Bad owner or permissions on ~/.ssh/config"), which
|
||||
# a runner with a loose umask or a reused HOME produces: create every
|
||||
# file here private and fresh.
|
||||
umask 077
|
||||
mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
||||
rm -f ~/.ssh/config
|
||||
printf '%s\n' "$VPS_SSH_KEY" | tr -d '\r' > ~/.ssh/deploy_key
|
||||
chmod 600 ~/.ssh/deploy_key
|
||||
# Fail here, not at the server, when the secret is not a usable key,
|
||||
# and log its fingerprint (public) so it can be compared with
|
||||
# `ssh-keygen -lf ~deploy/.ssh/authorized_keys` on the server.
|
||||
if ! ssh-keygen -y -P "" -f ~/.ssh/deploy_key > ~/.ssh/deploy_key.pub 2>/dev/null; then
|
||||
echo "::error::VPS_SSH_KEY does not load as an unencrypted private key; paste the whole OpenSSH-format key including the BEGIN/END lines"
|
||||
exit 1
|
||||
fi
|
||||
echo "key in VPS_SSH_KEY: $(ssh-keygen -lf ~/.ssh/deploy_key.pub)"
|
||||
if [ -n "$VPS_KNOWN_HOSTS" ]; then
|
||||
printf '%s\n' "$VPS_KNOWN_HOSTS" >> ~/.ssh/known_hosts
|
||||
else
|
||||
for i in 1 2 3; do
|
||||
ssh-keyscan -T 10 -p "$port" "$VPS_HOST" > ~/.ssh/keyscan.out && [ -s ~/.ssh/keyscan.out ] && break
|
||||
echo "ssh-keyscan attempt $i failed; retrying in 15 s" >&2
|
||||
sleep 15
|
||||
done
|
||||
if [ ! -s ~/.ssh/keyscan.out ]; then
|
||||
echo "::error::ssh-keyscan could not reach $VPS_HOST:$port (server down or runner IP blocked?)"
|
||||
exit 1
|
||||
fi
|
||||
cat ~/.ssh/keyscan.out >> ~/.ssh/known_hosts
|
||||
fi
|
||||
{
|
||||
echo "Host webhost"
|
||||
echo " HostName $VPS_HOST"
|
||||
echo " User $VPS_USER"
|
||||
echo " Port $port"
|
||||
echo " IdentityFile ~/.ssh/deploy_key"
|
||||
echo " IdentitiesOnly yes"
|
||||
echo " BatchMode yes"
|
||||
} > ~/.ssh/config
|
||||
chmod 600 ~/.ssh/config ~/.ssh/known_hosts
|
||||
|
||||
- name: Ensure rsync is available
|
||||
run: command -v rsync || (sudo apt-get update && sudo apt-get install -y rsync) || (apt-get update && apt-get install -y rsync)
|
||||
|
||||
- name: Deploy (rsync to the idle copy, then rename swap)
|
||||
# Two persistent directories alternate as live and previous, as for
|
||||
# the blog: rsync only ever writes the one that is not live, and the
|
||||
# swap is three same-filesystem renames, so Caddy never serves a
|
||||
# half-written tree. The previous build stays on disk for rollback.
|
||||
run: |
|
||||
# SC2029: the paths are meant to expand on the runner side
|
||||
# shellcheck disable=SC2029
|
||||
ssh webhost "mkdir -p '$SITE_DIR' '$SITE_DIR-prev' && rm -rf '$SITE_DIR-tmp'"
|
||||
rsync -az --delete site/dist/ "webhost:$SITE_DIR-prev/"
|
||||
# shellcheck disable=SC2029
|
||||
ssh webhost "mv '$SITE_DIR' '$SITE_DIR-tmp' && mv '$SITE_DIR-prev' '$SITE_DIR' && mv '$SITE_DIR-tmp' '$SITE_DIR-prev'"
|
||||
# shellcheck disable=SC2029
|
||||
live=$(ssh webhost "cat '$SITE_DIR/version.txt'")
|
||||
echo "live on server: $live"
|
||||
[ "$live" = "$(cat site/dist/version.txt)" ] || { echo "::error::server holds $live, expected $(cat site/dist/version.txt)"; exit 1; }
|
||||
|
||||
- name: Check the public URL
|
||||
# Warning only: DNS or a basic_auth login can make this
|
||||
# fail while the files on the server are already correct.
|
||||
# bkk01 fetches the release a few seconds after the upload; give it up
|
||||
# to two minutes. Warning only: the release is in the registry either
|
||||
# way, and the timer on bkk01 picks it up.
|
||||
run: |
|
||||
expected=$(cat site/dist/version.txt)
|
||||
got=$(curl -sS --max-time 20 "$SITE_URL/version.txt?nocache=$expected" || true)
|
||||
if [ "$got" = "$expected" ]; then
|
||||
echo "$SITE_URL serves $expected"
|
||||
else
|
||||
echo "::warning::$SITE_URL/version.txt returned '${got:0:80}', expected $expected"
|
||||
fi
|
||||
for i in $(seq 1 24); do
|
||||
got=$(curl -sS --max-time 20 "$SITE_URL/version.txt?nocache=$expected" || true)
|
||||
if [ "$got" = "$expected" ]; then
|
||||
echo "$SITE_URL serves $expected"
|
||||
exit 0
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
echo "::warning::$SITE_URL/version.txt returned '${got:0:80}', expected $expected"
|
||||
Reference in new issue
Block a user