|
| 1 | +name: Deploy to testing.openelis-global.org |
| 2 | + |
| 3 | +# WHAT IT DOES |
| 4 | +# SSHes into the testing VM and (re)deploys THIS repo's docker-compose stack |
| 5 | +# (the published :develop images). On the server it: pulls the latest repo state, |
| 6 | +# applies the testing-server cert overrides to .env, then `docker compose pull` |
| 7 | +# + `up -d`. The deploy target dir defaults to /home/ubuntu/openelis-docker |
| 8 | +# (override with the DEPLOY_PATH repo variable). |
| 9 | +# |
| 10 | +# NOTE: OpenELIS-Global-2 has its OWN "Deploy / Testing VM" workflow that runs a |
| 11 | +# dev WAR-mounted stack on the same host. Both bind 80/443 -- only one stack can |
| 12 | +# own the VM at a time. Make sure this repo's stack is the intended one before use. |
| 13 | +# |
| 14 | +# HOW IT RUNS |
| 15 | +# 1. Manually -> "Run workflow" button (workflow_dispatch) |
| 16 | +# 2. Reused by another workflow -> called with `uses:` (workflow_call) |
| 17 | +# |
| 18 | +# To auto-deploy after the image build (DIGI-UW/OpenELIS-Global-2 publish-images.yml), |
| 19 | +# add a job to that workflow that reuses this one: |
| 20 | +# |
| 21 | +# deploy-testing: |
| 22 | +# needs: publish-images |
| 23 | +# uses: DIGI-UW/openelis-docker/.github/workflows/deploy-testing.yml@main |
| 24 | +# secrets: inherit |
| 25 | +# |
| 26 | +# CREDENTIALS (reused from OpenELIS-Global-2's deploy workflow) |
| 27 | +# secret TESTING_VM_SSH_KEY DIGI-UW org-level secret (the VM's SSH key) |
| 28 | +# var TESTING_VM_USER SSH user, falls back to 'ubuntu' |
| 29 | +# Via the `uses:` path, `secrets: inherit` forwards them from the caller. For a |
| 30 | +# standalone run IN THIS REPO, the org secret's "Repository access" must include |
| 31 | +# openelis-docker (a DIGI-UW org admin can confirm/extend it). |
| 32 | + |
| 33 | +on: |
| 34 | + workflow_dispatch: |
| 35 | + workflow_call: |
| 36 | + |
| 37 | +# Never run two deploys against the server at the same time. |
| 38 | +concurrency: |
| 39 | + group: deploy-testing |
| 40 | + cancel-in-progress: false |
| 41 | + |
| 42 | +jobs: |
| 43 | + deploy: |
| 44 | + runs-on: ubuntu-latest |
| 45 | + steps: |
| 46 | + - name: Deploy over SSH |
| 47 | + uses: appleboy/ssh-action@v1.0.3 |
| 48 | + with: |
| 49 | + host: ${{ vars.DEPLOY_HOST || 'testing.openelis-global.org' }} |
| 50 | + username: ${{ vars.TESTING_VM_USER || 'ubuntu' }} |
| 51 | + port: ${{ vars.DEPLOY_PORT || 22 }} |
| 52 | + key: ${{ secrets.TESTING_VM_SSH_KEY }} |
| 53 | + script_stop: true |
| 54 | + envs: DEPLOY_PATH |
| 55 | + script: | |
| 56 | + set -euo pipefail |
| 57 | +
|
| 58 | + APP_DIR="${DEPLOY_PATH:-/home/ubuntu/openelis-docker}" |
| 59 | + REPO_URL="https://github.com/DIGI-UW/openelis-docker.git" |
| 60 | +
|
| 61 | + # --- fetch the latest deployment definition ----------------------- |
| 62 | + if [ ! -d "$APP_DIR/.git" ]; then |
| 63 | + git clone "$REPO_URL" "$APP_DIR" |
| 64 | + fi |
| 65 | + cd "$APP_DIR" |
| 66 | + git fetch origin main |
| 67 | + git reset --hard origin/main |
| 68 | +
|
| 69 | + # --- apply the testing-server env overrides ----------------------- |
| 70 | + # set_env KEY VALUE : replace the line if the key exists, else append it |
| 71 | + set_env() { |
| 72 | + key="$1"; val="$2" |
| 73 | + if grep -qE "^${key}=" .env; then |
| 74 | + sed -i "s|^${key}=.*|${key}=${val}|" .env |
| 75 | + else |
| 76 | + printf '%s=%s\n' "$key" "$val" >> .env |
| 77 | + fi |
| 78 | + } |
| 79 | + set_env OE_NGINX_CERT cert.crt |
| 80 | + set_env OE_NGINX_KEY cert.key |
| 81 | + set_env OE_CERTS_PATH /home/ubuntu/certs2026 |
| 82 | + set_env OE_KEYS_PATH /home/ubuntu/certs2026 |
| 83 | +
|
| 84 | + # --- pull new images and restart ---------------------------------- |
| 85 | + docker compose pull |
| 86 | + docker compose up -d --remove-orphans |
| 87 | + docker image prune -f |
| 88 | + env: |
| 89 | + DEPLOY_PATH: ${{ vars.DEPLOY_PATH }} |
0 commit comments