74 lines
2.4 KiB
YAML
74 lines
2.4 KiB
YAML
|
name: CI
|
||
|
|
|
||
|
|
on:
|
||
|
|
push:
|
||
|
|
branches: [main]
|
||
|
|
pull_request:
|
||
|
|
|
||
|
|
jobs:
|
||
|
|
build-and-test:
|
||
|
|
runs-on: ubuntu-latest
|
||
|
|
steps:
|
||
|
|
- uses: actions/checkout@v4
|
||
|
|
|
||
|
|
# rustup plutôt que le paquet apt de l'image : l'image du job
|
||
|
|
# (node:20-bookworm, Debian stable) embarque un rustc trop ancien
|
||
|
|
# pour ce code (async fn dans les traits, édition 2021 récente).
|
||
|
|
- name: Installer Rust
|
||
|
|
run: |
|
||
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
|
||
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
||
|
|
|
||
|
|
- name: Dépendances système (sqlx/rustls)
|
||
|
|
run: apt-get update && apt-get install -y pkg-config libssl-dev build-essential
|
||
|
|
|
||
|
|
- name: cargo build (workspace)
|
||
|
|
run: cargo build --workspace
|
||
|
|
|
||
|
|
- name: cargo test (workspace)
|
||
|
|
run: cargo test --workspace
|
||
|
|
|
||
|
|
- name: npm build (app/)
|
||
|
|
working-directory: app
|
||
|
|
run: |
|
||
|
|
npm ci
|
||
|
|
npm run build
|
||
|
|
|
||
|
|
deploy:
|
||
|
|
needs: build-and-test
|
||
|
|
if: github.ref == 'refs/heads/main'
|
||
|
|
runs-on: ubuntu-latest
|
||
|
|
steps:
|
||
|
|
- uses: actions/checkout@v4
|
||
|
|
|
||
|
|
- name: Installer Rust
|
||
|
|
run: |
|
||
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
|
||
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
||
|
|
|
||
|
|
- name: Dépendances système
|
||
|
|
run: apt-get update && apt-get install -y pkg-config libssl-dev build-essential openssh-client rsync
|
||
|
|
|
||
|
|
- name: Build release (workspace)
|
||
|
|
run: cargo build --release --workspace
|
||
|
|
|
||
|
|
# Identité de déploiement dédiée, sans privilège : `deploy` ne peut
|
||
|
|
# que déposer un fichier dans /opt/deploy-staging et lancer le
|
||
|
|
# script sudo tripoli-deploy.sh, qui installe le binaire et
|
||
|
|
# redémarre EXACTEMENT le service nommé - rien de plus. Pas de clé
|
||
|
|
# root dans ce pipeline.
|
||
|
|
- name: Déployer tripoli-edge et tripoli-api
|
||
|
|
env:
|
||
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||
|
|
DEPLOY_HOST: 65.109.142.188
|
||
|
|
run: |
|
||
|
|
mkdir -p ~/.ssh
|
||
|
|
echo "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
|
||
|
|
chmod 600 ~/.ssh/deploy_key
|
||
|
|
ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
||
|
|
|
||
|
|
for service in tripoli-edge tripoli-api; do
|
||
|
|
scp -i ~/.ssh/deploy_key "target/release/$service" "deploy@$DEPLOY_HOST:/opt/deploy-staging/$service"
|
||
|
|
ssh -i ~/.ssh/deploy_key "deploy@$DEPLOY_HOST" sudo /usr/local/sbin/tripoli-deploy.sh "$service"
|
||
|
|
done
|