CD #92
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD | |
| on: | |
| workflow_run: | |
| workflows: ["CI"] | |
| branches: [main] | |
| types: [completed] | |
| concurrency: | |
| group: cd-main | |
| cancel-in-progress: false | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| deploy-api: | |
| name: Build & push API image | |
| runs-on: ubuntu-latest | |
| # Only deploy when ALL CI jobs (lint, test-unit, test-e2e, build, docker-build) pass. | |
| if: ${{ github.event.workflow_run.conclusion == 'success' }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| image: ${{ steps.meta.outputs.tags }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.workflow_run.head_sha }} | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/${{ github.repository }}/api | |
| tags: | | |
| type=sha,prefix=sha- | |
| type=raw,value=latest | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Trigger Render Deploy Hook | |
| env: | |
| RENDER_DEPLOY_HOOK_URL: ${{ secrets.RENDER_DEPLOY_HOOK_URL }} | |
| if: env.RENDER_DEPLOY_HOOK_URL != '' | |
| run: | | |
| echo "Triggering Render deployment via Deploy Hook..." | |
| curl -s -f -X POST "${{ env.RENDER_DEPLOY_HOOK_URL }}" | |
| - name: Trigger Render API Rollout | |
| env: | |
| RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }} | |
| RENDER_SERVICE_ID: ${{ secrets.RENDER_SERVICE_ID }} | |
| if: env.RENDER_API_KEY != '' && env.RENDER_SERVICE_ID != '' | |
| run: | | |
| echo "Triggering Render deployment via API key..." | |
| curl -s -f -X POST "https://api.render.com/v1/services/${{ env.RENDER_SERVICE_ID }}/deploys" \ | |
| -H "Authorization: Bearer ${{ env.RENDER_API_KEY }}" \ | |
| -H "Accept: application/json" \ | |
| -H "Content-Type: application/json" | |
| # NOTE: The web frontend is deployed by the Vercel GitHub integration, not | |
| # this workflow. A previous `deploy-web` job ran `vercel pull/build/deploy` | |
| # via the Vercel CLI, but it failed at `vercel pull` (VERCEL_TOKEN lacked | |
| # access to the project) and was redundant with the integration, so it was | |
| # removed. If you ever want CLI-driven prebuilt prod deploys instead of the | |
| # integration, restore it and ensure VERCEL_TOKEN can access the project in | |
| # .vercel/project.json. |