tripoli.cloud/.forgejo/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # rustup plutôt que le paquet apt de l'image : l'image du job
      # (node:20-bookworm, Debian stable) embarque un rustc trop ancien
      # pour ce code (async fn dans les traits, édition 2021 récente).
      - name: Installer Rust
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Dépendances système (sqlx/rustls)
        run: apt-get update && apt-get install -y pkg-config libssl-dev build-essential

      - name: cargo build (workspace)
        run: cargo build --workspace

      - name: cargo test (workspace)
        run: cargo test --workspace

      - name: npm build (app/)
        working-directory: app
        run: |
          npm ci
          npm run build

  deploy:
    needs: build-and-test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Installer Rust
        run: |
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      - name: Dépendances système
        run: apt-get update && apt-get install -y pkg-config libssl-dev build-essential openssh-client rsync

      - name: Build release (workspace)
        run: cargo build --release --workspace

      - name: npm build (app/)
        working-directory: app
        run: |
          npm ci
          npm run build

      # Identité de déploiement dédiée, sans privilège : `deploy` ne peut
      # que déposer des fichiers dans /opt/deploy-staging et lancer les
      # scripts sudo tripoli-deploy*.sh, qui installent exactement ce
      # qui est attendu (binaire + redémarrage du service nommé, ou
      # synchronisation du frontend statique) - rien de plus. Pas de clé
      # root dans ce pipeline.
      - name: Déployer tripoli-edge et tripoli-api
        env:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: 65.109.142.188
        run: |
          mkdir -p ~/.ssh
          echo "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null

          for service in tripoli-edge tripoli-api; do
            scp -i ~/.ssh/deploy_key "target/release/$service" "deploy@$DEPLOY_HOST:/opt/deploy-staging/$service"
            ssh -i ~/.ssh/deploy_key "deploy@$DEPLOY_HOST" sudo /usr/local/sbin/tripoli-deploy.sh "$service"
          done

          rsync -az -e "ssh -i ~/.ssh/deploy_key" --delete app/dist/ "deploy@$DEPLOY_HOST:/opt/deploy-staging/frontend/"
          ssh -i ~/.ssh/deploy_key "deploy@$DEPLOY_HOST" sudo /usr/local/sbin/tripoli-deploy-frontend.sh