Merge pull request #19 from alvin000009238/codex/add-do-not-button #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Dev to VPS | |
| on: | |
| push: | |
| branches: [ "dev" ] | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| build_and_deploy: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Basic Syntax Check | |
| run: | | |
| python -m py_compile server.py | |
| python -m py_compile fetcher.py | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=raw,value=dev-latest | |
| type=sha,format=long,prefix=dev-sha- | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| provenance: false | |
| - name: Deploy to VPS via SSH | |
| uses: appleboy/ssh-action@master | |
| with: | |
| host: ${{ secrets.VPS_HOST }} | |
| username: ${{ secrets.VPS_USERNAME }} | |
| key: ${{ secrets.VPS_SSH_KEY }} | |
| port: ${{ secrets.VPS_PORT }} | |
| script: | | |
| # 登入 GHCR | |
| echo "${{ secrets.GHCR_PAT }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin | |
| # 確保 overlay 網路存在 | |
| docker network create -d overlay app_network || true | |
| # 使用明確 SHA tag 更新應用程式服務 (避免 latest 不觸發更新的問題) | |
| if docker service inspect app_dev > /dev/null 2>&1; then | |
| docker service update \ | |
| --with-registry-auth \ | |
| --image ghcr.io/${{ github.repository }}:dev-sha-${{ github.sha }} \ | |
| --env-add REDIS_URL=redis://redis:6379/0 \ | |
| --env-add SECRET_KEY=${{ secrets.SECRET_KEY }} \ | |
| --env-add CORS_ORIGINS=${{ secrets.CORS_ORIGINS }} \ | |
| --env-add TURNSTILE_SITE_KEY=${{ secrets.TURNSTILE_SITE_KEY }} \ | |
| --env-add TURNSTILE_SECRET_KEY=${{ secrets.TURNSTILE_SECRET_KEY }} \ | |
| app_dev | |
| else | |
| docker service create \ | |
| --with-registry-auth \ | |
| --name app_dev \ | |
| --network app_network \ | |
| --env REDIS_URL=redis://redis:6379/0 \ | |
| --env SECRET_KEY=${{ secrets.SECRET_KEY }} \ | |
| --env CORS_ORIGINS=${{ secrets.CORS_ORIGINS }} \ | |
| --env TURNSTILE_SITE_KEY=${{ secrets.TURNSTILE_SITE_KEY }} \ | |
| --env TURNSTILE_SECRET_KEY=${{ secrets.TURNSTILE_SECRET_KEY }} \ | |
| ghcr.io/${{ github.repository }}:dev-sha-${{ github.sha }} | |
| fi | |
| # 確保 Redis 服務啟動並加入網路 (依賴與正式環境共同的 redis 服務) | |
| if docker service inspect redis > /dev/null 2>&1; then | |
| docker service update \ | |
| --image redis:7-alpine \ | |
| redis | |
| else | |
| docker service create \ | |
| --name redis \ | |
| --network app_network \ | |
| redis:7-alpine | |
| fi | |
| # 確保 Dev 的 Cloudflare Tunnel 服務啟動並加入此網路 | |
| if docker service inspect school_grades_tunnel_dev > /dev/null 2>&1; then | |
| docker service update \ | |
| --env-add TUNNEL_TOKEN=${{ secrets.TUNNEL_TOKEN_DEV }} \ | |
| --network-add app_network school_grades_tunnel_dev > /dev/null 2>&1 || true | |
| else | |
| docker service create \ | |
| --name school_grades_tunnel_dev \ | |
| --network app_network \ | |
| --env TUNNEL_TOKEN=${{ secrets.TUNNEL_TOKEN_DEV }} \ | |
| cloudflare/cloudflared:latest tunnel run | |
| fi | |
| # 等待更新完成並檢查狀態 | |
| docker service ps app_dev --no-trunc --format "{{.CurrentState}}" | head -1 |