Josh Bairstow
b643c0be3e
All checks were successful
deploy / build-and-deploy (push) Successful in 24s
The desktop runner's ~/.docker/config.json uses credsStore: pass, which isn't initialised, so docker login failed to store creds. Use a throwaway DOCKER_CONFIG under RUNNER_TEMP (outside the build context) for the job. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
70 lines
2.7 KiB
YAML
70 lines
2.7 KiB
YAML
# ----------------------------------------------------------------------------
|
|
# Build + deploy jb-website.
|
|
#
|
|
# Runs on the home-desktop host runner (label `desktop`): builds the image,
|
|
# pushes it to the Forgejo container registry, then SSHes to the VPS to pull
|
|
# and restart. The VPS never builds — it only runs the prebuilt image.
|
|
#
|
|
# Required Forgejo settings (Repo > Settings > Actions):
|
|
# Variables:
|
|
# REGISTRY_OWNER lowercase Forgejo user/org that owns the package
|
|
# Secrets:
|
|
# REGISTRY_USER Forgejo username for `docker login`
|
|
# REGISTRY_TOKEN Forgejo PAT with write:package scope
|
|
# DEPLOY_HOST VPS host/IP
|
|
# DEPLOY_USER SSH user on the VPS (deploy account)
|
|
# DEPLOY_SSH_KEY private key whose public half is in the VPS authorized_keys
|
|
# ----------------------------------------------------------------------------
|
|
|
|
name: deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: git.joshbairstow.com
|
|
IMAGE_NAME: jb-website
|
|
|
|
jobs:
|
|
build-and-deploy:
|
|
runs-on: desktop
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Resolve image reference
|
|
run: |
|
|
IMAGE="${REGISTRY}/${{ vars.REGISTRY_OWNER }}/${IMAGE_NAME}"
|
|
echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
|
|
echo "Building ${IMAGE}:${{ github.sha }}"
|
|
|
|
- name: Log in to the Forgejo registry
|
|
run: |
|
|
# Isolate Docker's config in a throwaway dir (outside the build context)
|
|
# so login doesn't use the desktop's credential helper (credsStore: pass,
|
|
# uninitialised on the runner). Exported so build/push see it too.
|
|
export DOCKER_CONFIG="${RUNNER_TEMP}/docker"
|
|
echo "DOCKER_CONFIG=${DOCKER_CONFIG}" >> "$GITHUB_ENV"
|
|
mkdir -p "${DOCKER_CONFIG}"
|
|
echo "${{ secrets.REGISTRY_TOKEN }}" \
|
|
| docker login "${REGISTRY}" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build and push image
|
|
run: |
|
|
docker build -t "${IMAGE}:${{ github.sha }}" -t "${IMAGE}:latest" .
|
|
docker push "${IMAGE}:${{ github.sha }}"
|
|
docker push "${IMAGE}:latest"
|
|
|
|
- name: Deploy to VPS over SSH
|
|
run: |
|
|
install -m 600 /dev/null deploy_key
|
|
printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > deploy_key
|
|
ssh -i deploy_key -o StrictHostKeyChecking=accept-new \
|
|
"${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
|
|
"export REGISTRY_OWNER='${{ vars.REGISTRY_OWNER }}' TAG='${{ github.sha }}'; \
|
|
cd /opt/jb-website && \
|
|
docker compose -f compose.yml pull && \
|
|
docker compose -f compose.yml up -d && \
|
|
docker image prune -f"
|
|
rm -f deploy_key
|