add :deploy-dev.yml

Author: alvin000009238

.github/workflows/deploy-dev.yml

@@ -0,0 +1,120 @@
+name: Deploy Dev to VPS
+
+on:
+  push:
+    branches: [ "dev" ]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build_and_deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          
+      - name: Basic Syntax Check
+        run: |
+          python -m py_compile server.py
+          python -m py_compile fetcher.py
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=dev-latest
+            type=sha,format=long,prefix=dev-sha-
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+
+      - name: Deploy to VPS via SSH
+        uses: appleboy/ssh-action@master
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USERNAME }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          port: ${{ secrets.VPS_PORT }}
+          script: |
+            # 登入 GHCR
+            echo "${{ secrets.GHCR_PAT }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+            
+            # 確保 overlay 網路存在
+            docker network create -d overlay app_network || true
+            
+            # 使用明確 SHA tag 更新應用程式服務 (避免 latest 不觸發更新的問題)
+            if docker service inspect app_dev > /dev/null 2>&1; then
+              docker service update \
+                --with-registry-auth \
+                --image ghcr.io/${{ github.repository }}:dev-sha-${{ github.sha }} \
+                --env-add REDIS_URL=redis://redis:6379/0 \
+                --env-add SECRET_KEY=${{ secrets.SECRET_KEY }} \
+                --env-add CORS_ORIGINS=${{ secrets.CORS_ORIGINS }} \
+                --env-add TURNSTILE_SITE_KEY=${{ secrets.TURNSTILE_SITE_KEY }} \
+                --env-add TURNSTILE_SECRET_KEY=${{ secrets.TURNSTILE_SECRET_KEY }} \
+                app_dev
+            else
+              docker service create \
+                --with-registry-auth \
+                --name app_dev \
+                --network app_network \
+                --env REDIS_URL=redis://redis:6379/0 \
+                --env SECRET_KEY=${{ secrets.SECRET_KEY }} \
+                --env CORS_ORIGINS=${{ secrets.CORS_ORIGINS }} \
+                --env TURNSTILE_SITE_KEY=${{ secrets.TURNSTILE_SITE_KEY }} \
+                --env TURNSTILE_SECRET_KEY=${{ secrets.TURNSTILE_SECRET_KEY }} \
+                ghcr.io/${{ github.repository }}:dev-sha-${{ github.sha }}
+            fi
+              
+            # 確保 Redis 服務啟動並加入網路 (依賴與正式環境共同的 redis 服務)
+            if docker service inspect redis > /dev/null 2>&1; then
+              docker service update \
+                --image redis:7-alpine \
+                redis
+            else
+              docker service create \
+                --name redis \
+                --network app_network \
+                redis:7-alpine
+            fi
+            
+            # 確保 Dev 的 Cloudflare Tunnel 服務啟動並加入此網路
+            if docker service inspect school_grades_tunnel_dev > /dev/null 2>&1; then
+              docker service update \
+                --env-add TUNNEL_TOKEN=${{ secrets.TUNNEL_TOKEN_DEV }} \
+                --network-add app_network school_grades_tunnel_dev > /dev/null 2>&1 || true
+            else
+              docker service create \
+                --name school_grades_tunnel_dev \
+                --network app_network \
+                --env TUNNEL_TOKEN=${{ secrets.TUNNEL_TOKEN_DEV }} \
+                cloudflare/cloudflared:latest tunnel run
+            fi            
+            # 等待更新完成並檢查狀態
+            docker service ps app_dev --no-trunc --format "{{.CurrentState}}" | head -1