Deploy to testing.openelis-global.org #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to testing.openelis-global.org | |
| # WHAT IT DOES | |
| # SSHes into the testing VM and (re)deploys THIS repo's docker-compose stack | |
| # (the published :develop images). On the server it: pulls the latest repo state, | |
| # applies the testing-server cert overrides to .env, then `docker compose pull` | |
| # + `up -d`. The deploy target dir defaults to /home/ubuntu/openelis-docker | |
| # (override with the DEPLOY_PATH repo variable). | |
| # | |
| # NOTE: OpenELIS-Global-2 has its OWN "Deploy / Testing VM" workflow that runs a | |
| # dev WAR-mounted stack on the same host. Both bind 80/443 -- only one stack can | |
| # own the VM at a time. Make sure this repo's stack is the intended one before use. | |
| # | |
| # HOW IT RUNS | |
| # 1. Manually -> "Run workflow" button (workflow_dispatch) | |
| # 2. Reused by another workflow -> called with `uses:` (workflow_call) | |
| # | |
| # To auto-deploy after the image build (DIGI-UW/OpenELIS-Global-2 publish-images.yml), | |
| # add a job to that workflow that reuses this one: | |
| # | |
| # deploy-testing: | |
| # needs: publish-images | |
| # uses: DIGI-UW/openelis-docker/.github/workflows/deploy-testing.yml@main | |
| # secrets: inherit | |
| # | |
| # CREDENTIALS (reused from OpenELIS-Global-2's deploy workflow) | |
| # secret TESTING_VM_SSH_KEY DIGI-UW org-level secret (the VM's SSH key) | |
| # var TESTING_VM_USER SSH user, falls back to 'ubuntu' | |
| # Via the `uses:` path, `secrets: inherit` forwards them from the caller. For a | |
| # standalone run IN THIS REPO, the org secret's "Repository access" must include | |
| # openelis-docker (a DIGI-UW org admin can confirm/extend it). | |
| on: | |
| workflow_dispatch: | |
| workflow_call: | |
| # Never run two deploys against the server at the same time. | |
| concurrency: | |
| group: deploy-testing | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Deploy over SSH | |
| uses: appleboy/ssh-action@v1.0.3 | |
| with: | |
| host: ${{ vars.DEPLOY_HOST || 'testing.openelis-global.org' }} | |
| username: ${{ vars.TESTING_VM_USER || 'ubuntu' }} | |
| port: ${{ vars.DEPLOY_PORT || 22 }} | |
| key: ${{ secrets.TESTING_VM_SSH_KEY }} | |
| script_stop: true | |
| envs: DEPLOY_PATH | |
| script: | | |
| set -euo pipefail | |
| APP_DIR="${DEPLOY_PATH:-/home/ubuntu/openelis-docker}" | |
| REPO_URL="https://github.com/DIGI-UW/openelis-docker.git" | |
| # --- fetch the latest deployment definition ----------------------- | |
| if [ ! -d "$APP_DIR/.git" ]; then | |
| git clone "$REPO_URL" "$APP_DIR" | |
| fi | |
| cd "$APP_DIR" | |
| git fetch origin main | |
| git reset --hard origin/main | |
| # --- apply the testing-server env overrides ----------------------- | |
| # set_env KEY VALUE : replace the line if the key exists, else append it | |
| set_env() { | |
| key="$1"; val="$2" | |
| if grep -qE "^${key}=" .env; then | |
| sed -i "s|^${key}=.*|${key}=${val}|" .env | |
| else | |
| printf '%s=%s\n' "$key" "$val" >> .env | |
| fi | |
| } | |
| set_env OE_NGINX_CERT cert.crt | |
| set_env OE_NGINX_KEY cert.key | |
| set_env OE_CERTS_PATH /home/ubuntu/certs2026 | |
| set_env OE_KEYS_PATH /home/ubuntu/certs2026 | |
| # --- pull new images and restart ---------------------------------- | |
| docker compose pull | |
| docker compose up -d --remove-orphans | |
| docker image prune -f | |
| env: | |
| DEPLOY_PATH: ${{ vars.DEPLOY_PATH }} |