Merge pull request #23 from mtlaso/dependabot/go_modules/golang.org/x… #55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test, Format, Build, Push to GHCR, and Deploy to VPS | |
| on: | |
| push: | |
| branches: | |
| - "master" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| APP_IMAGE_NAME: ${{ github.repository_owner }}/bocal-smtpd | |
| CERT_FETCHER_IMAGE_NAME: ${{ github.repository_owner }}/bocal-cert-fetcher | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint_and_test: | |
| name: Lint and Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.24.2" | |
| - name: Set up golangci-lint | |
| uses: golangci/golangci-lint-action@v8 | |
| - name: Run Tests | |
| run: make bootstrap-tests | |
| build_and_push_images: | |
| name: Build and Push Docker Images | |
| runs-on: ubuntu-latest | |
| needs: lint_and_test | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| app_image_tag: ${{ steps.push_app.outputs.digest }} | |
| cert_fetcher_image_tag: ${{ steps.push_cert_fetcher.outputs.digest }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and Push bocal-smtpd Image | |
| id: push_app | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| target: prod | |
| push: true | |
| tags: ghcr.io/${{ env.APP_IMAGE_NAME }}:latest, ghcr.io/${{ env.APP_IMAGE_NAME }}:${{ github.sha }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Build and Push cert-fetcher Image | |
| id: push_cert_fetcher | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: ./Dockerfile.cert-fetcher | |
| push: true | |
| tags: ghcr.io/${{ env.CERT_FETCHER_IMAGE_NAME }}:latest, ghcr.io/${{ env.CERT_FETCHER_IMAGE_NAME }}:${{ github.sha }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| deploy_to_vps: | |
| name: Deploy to VPS | |
| runs-on: ubuntu-latest | |
| needs: build_and_push_images | |
| environment: production | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Create .env file | |
| # Pass secrets. | |
| # https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#example-using-bash | |
| env: | |
| BWS_ACCESS_TOKEN: ${{ secrets.BWS_ACCESS_TOKEN }} | |
| BWS_PROJECT_ID: ${{ secrets.BWS_PROJECT_ID }} | |
| BWS_PRIVATEKEY_ID: ${{ secrets.BWS_PRIVATEKEY_ID }} | |
| BWS_FULLCHAIN_ID: ${{ secrets.BWS_FULLCHAIN_ID }} | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| run: | | |
| mkdir ../vps-deploy-files | |
| touch ../vps-deploy-files/.env | |
| # Create .env file. | |
| cat <<EOF > ../vps-deploy-files/.env | |
| BWS_ACCESS_TOKEN=$BWS_ACCESS_TOKEN | |
| BWS_PROJECT_ID=$BWS_PROJECT_ID | |
| BWS_PRIVATEKEY_ID=$BWS_PRIVATEKEY_ID | |
| BWS_FULLCHAIN_ID=$BWS_FULLCHAIN_ID | |
| DATABASE_URL=$DATABASE_URL | |
| APP_IMAGE_WITH_TAG=ghcr.io/${{ env.APP_IMAGE_NAME }}@${{ needs.build_and_push_images.outputs.app_image_tag }} | |
| CERT_FETCHER_IMAGE_WITH_TAG=ghcr.io/${{ env.CERT_FETCHER_IMAGE_NAME }}@${{ needs.build_and_push_images.outputs.cert_fetcher_image_tag }} | |
| EOF | |
| cp docker-compose.prod.yml ../vps-deploy-files/ | |
| cp cert-fetcher.sh ../vps-deploy-files/ | |
| cp haproxy.prod.cfg ../vps-deploy-files/ | |
| tar -cvf vps-deploy-files.tar ../vps-deploy-files/ | |
| - name: Copy files to VPS | |
| uses: appleboy/scp-action@v1.0.0 | |
| with: | |
| host: ${{ secrets.SSH_HOST }} | |
| username: ${{ secrets.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| port: ${{ secrets.SSH_PORT }} | |
| passphrase: ${{ secrets.SSH_PASSPHRASE }} | |
| source: "vps-deploy-files.tar" | |
| target: "/tmp" | |
| overwrite: true | |
| - name: Extract archive and run deployment on VPS | |
| uses: appleboy/ssh-action@v1.2.2 | |
| with: | |
| host: ${{ secrets.SSH_HOST }} | |
| username: ${{ secrets.SSH_USERNAME }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| port: ${{ secrets.SSH_PORT }} | |
| passphrase: ${{ secrets.SSH_PASSPHRASE }} | |
| script: | | |
| set -e # Exit on any error | |
| APP_DIR="/opt/bocal-smtpd" | |
| ARCHIVE_PATH="/tmp/vps-deploy-files.tar" | |
| echo "Ensuring application directory $APP_DIR exists..." | |
| sudo mkdir -p "$APP_DIR" | |
| echo "Extracting deployment archive to $APP_DIR..." | |
| sudo tar -xvf "$ARCHIVE_PATH" -C "$APP_DIR" | |
| echo "Archive extracted." | |
| echo "Setting permissions for cert-fetcher.sh..." | |
| sudo chmod +x "$APP_DIR/vps-deploy-files/cert-fetcher.sh" | |
| echo "Cleaning up deployment archive from /tmp..." | |
| rm "$ARCHIVE_PATH" | |
| echo "Starting application with Docker Compose in $APP_DIR..." | |
| cd "$APP_DIR/vps-deploy-files" | |
| pwd | |
| # Doesn't work for some reason if it has a custom name, even with '-f' flag (docker compose -f ...) | |
| sudo mv docker-compose.prod.yml docker-compose.yml | |
| docker compose down | |
| docker compose -f docker-compose.yml up -d --force-recreate | |
| echo "Deployment complete." |