CD (EC2) #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD (EC2) | |
| on: | |
| workflow_run: | |
| workflows: ["CI"] | |
| types: | |
| - completed | |
| branches: | |
| - master | |
| workflow_dispatch: | |
| concurrency: | |
| group: deploy-production-ec2 | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: production | |
| steps: | |
| - name: Validate required secrets | |
| env: | |
| EC2_HOST: ${{ secrets.EC2_HOST }} | |
| EC2_USER: ${{ secrets.EC2_USER }} | |
| EC2_SSH_PRIVATE_KEY: ${{ secrets.EC2_SSH_PRIVATE_KEY }} | |
| EC2_DEPLOY_PATH: ${{ secrets.EC2_DEPLOY_PATH }} | |
| run: | | |
| set -euo pipefail | |
| for name in EC2_HOST EC2_USER EC2_SSH_PRIVATE_KEY EC2_DEPLOY_PATH; do | |
| if [ -z "${!name}" ]; then | |
| echo "Missing required secret: $name" | |
| exit 1 | |
| fi | |
| done | |
| - name: Configure SSH | |
| env: | |
| EC2_HOST: ${{ secrets.EC2_HOST }} | |
| EC2_PORT: ${{ secrets.EC2_PORT }} | |
| EC2_SSH_PRIVATE_KEY: ${{ secrets.EC2_SSH_PRIVATE_KEY }} | |
| run: | | |
| set -euo pipefail | |
| PORT="${EC2_PORT:-22}" | |
| mkdir -p "$HOME/.ssh" | |
| chmod 700 "$HOME/.ssh" | |
| printf "%s\n" "$EC2_SSH_PRIVATE_KEY" > "$HOME/.ssh/id_deploy" | |
| chmod 600 "$HOME/.ssh/id_deploy" | |
| ssh-keyscan -p "$PORT" -H "$EC2_HOST" >> "$HOME/.ssh/known_hosts" | |
| chmod 644 "$HOME/.ssh/known_hosts" | |
| - name: Deploy to EC2 | |
| env: | |
| EC2_HOST: ${{ secrets.EC2_HOST }} | |
| EC2_PORT: ${{ secrets.EC2_PORT }} | |
| EC2_USER: ${{ secrets.EC2_USER }} | |
| EC2_DEPLOY_PATH: ${{ secrets.EC2_DEPLOY_PATH }} | |
| run: | | |
| set -euo pipefail | |
| PORT="${EC2_PORT:-22}" | |
| ssh -i "$HOME/.ssh/id_deploy" -p "$PORT" -o StrictHostKeyChecking=yes "${EC2_USER}@${EC2_HOST}" "bash -s" <<EOF | |
| set -euo pipefail | |
| cd "${EC2_DEPLOY_PATH}" | |
| git fetch --prune origin | |
| git checkout master | |
| git pull --ff-only origin master | |
| docker compose -f docker-compose.prod.yml up -d --build redis web | |
| docker compose -f docker-compose.prod.yml exec -T web python manage.py migrate --noinput | |
| docker compose -f docker-compose.prod.yml ps | |
| EOF |