ci(medium): Implement PR-aware checkout for bot-triggered workflows (… #869
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Production | |
| on: | |
| push: | |
| branches: ['leader'] | |
| env: | |
| NODE_VERSION: '20' | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/leader' | |
| steps: | |
| - name: 🛑 Cancel Previous Runs | |
| uses: styfle/cancel-workflow-action@0.13.0 | |
| with: | |
| access_token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/checkout@v4 | |
| - name: 📦 Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| - name: 🟢 Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'pnpm' | |
| - name: 📥 Install Dependencies | |
| run: pnpm install | |
| - name: 🏗️ Build Standalone Artifact | |
| env: | |
| NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET_BUILD_PLACEHOLDER }} | |
| NEXTAUTH_URL: 'http://localhost:3000' | |
| IS_DEPLOYMENT: 'true' | |
| NEXT_PUBLIC_USE_NATIVE_TABLE: ${{ vars.NEXT_PUBLIC_USE_NATIVE_TABLE }} | |
| run: | | |
| # 1. Use production config with standalone output | |
| cp deploy/next.config.js next.config.js | |
| # 2. Build Next.js | |
| pnpm run build | |
| # 3. Package Artifact (Hybrid Strategy) | |
| ./scripts/package.sh | |
| - name: 📤 Upload Artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-artifact | |
| path: release.tar.gz | |
| deploy: | |
| runs-on: self-hosted | |
| needs: build | |
| if: github.ref == 'refs/heads/leader' | |
| steps: | |
| - name: 📥 Download Artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: release-artifact | |
| - name: 🚚 Transfer Artifact | |
| env: | |
| PROD_HOST: ${{ secrets.PROD_HOST }} | |
| PROD_USER: ${{ secrets.PROD_USER }} | |
| PROD_PATH: ${{ secrets.PROD_PATH }} | |
| run: | | |
| # Transfer the Release Archive (contains all scripts) | |
| scp release.tar.gz $PROD_USER@$PROD_HOST:$PROD_PATH/ | |
| - name: 🔒 Generate .env.production | |
| env: | |
| PROD_HOST: ${{ secrets.PROD_HOST }} | |
| PROD_USER: ${{ secrets.PROD_USER }} | |
| PROD_PATH: ${{ secrets.PROD_PATH }} | |
| run: | | |
| cat <<EOF | ssh $PROD_USER@$PROD_HOST "bash -l -c 'cd $PROD_PATH && cat > .env.production'" | |
| # Generated by GitHub Actions at $(date -u +"%Y-%m-%dT%H:%M:%SZ") | |
| NODE_ENV=production | |
| PORT=3000 | |
| HOST=127.0.0.1 | |
| NEXTAUTH_SECRET=${{ secrets.NEXTAUTH_SECRET }} | |
| NEXTAUTH_URL=${{ secrets.NEXTAUTH_URL }} | |
| BASE_URL=${{ secrets.BASE_URL }} | |
| SPOTIFY_CLIENT_ID=${{ secrets.SPOTIFY_CLIENT_ID }} | |
| SPOTIFY_CLIENT_SECRET=${{ secrets.SPOTIFY_CLIENT_SECRET }} | |
| SPOTIFY_CALLBACK_URL=${{ secrets.SPOTIFY_CALLBACK_URL }} | |
| INTERNAL_TOKEN_DELIVERY_SECRET=${{ secrets.INTERNAL_TOKEN_DELIVERY_SECRET }} | |
| ENCRYPTION_KEY=${{ secrets.ENCRYPTION_KEY }} | |
| GOOGLE_DOC_IFRAME_URL="${{ secrets.GOOGLE_DOC_IFRAME_URL }}" | |
| GOOGLE_DOC_WORKOUT_URL="${{ secrets.GOOGLE_DOC_WORKOUT_URL }}" | |
| SPOTIFY_DEBUG=false | |
| CI=false | |
| NEXT_PUBLIC_USE_NATIVE_TABLE=${{ vars.NEXT_PUBLIC_USE_NATIVE_TABLE }} | |
| NEXT_PUBLIC_API_URL= | |
| NEXT_PUBLIC_WS_URL= | |
| RATE_LIMIT_WINDOW_MS=60000 | |
| SPOTIFY_API_MAX_REQUESTS=30 | |
| INTERNAL_API_MAX_REQUESTS=100 | |
| GENERAL_API_MAX_REQUESTS=200 | |
| WS_MAX_CONNECTIONS=5 | |
| EOF | |
| - name: 🚀 Execute Deployment | |
| env: | |
| PROD_HOST: ${{ secrets.PROD_HOST }} | |
| PROD_USER: ${{ secrets.PROD_USER }} | |
| PROD_PATH: ${{ secrets.PROD_PATH }} | |
| run: | | |
| # Extract tarball and run deploy script (which it contains) | |
| ssh $PROD_USER@$PROD_HOST "bash -l -c 'cd $PROD_PATH && tar -xzf release.tar.gz --overwrite && ./scripts/deploy-artifact.sh'" |