72 lines
2.5 KiB
YAML
72 lines
2.5 KiB
YAML
name: Deploy EG-BIM QA Production
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: qa-production
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy-production:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
DEPLOY_REF: ${{ gitea.ref }}
|
|
DEPLOY_COMMIT_SHA: ${{ gitea.sha }}
|
|
CLOUDFLARE_API_TOKEN: ${{ secrets.PROD_CLOUDFLARE_API_TOKEN }}
|
|
SESSION_SECRET: ${{ secrets.PROD_SESSION_SECRET }}
|
|
ABC_API_KEY: ${{ secrets.PROD_ABC_API_KEY }}
|
|
AUTH_CLIENT_ID: ${{ vars.PROD_AUTH_CLIENT_ID }}
|
|
ABC_API_BASE_URL: ${{ vars.PROD_ABC_API_BASE_URL }}
|
|
ABC_PROJECT_ID: ${{ vars.PROD_ABC_PROJECT_ID }}
|
|
ABC_CHANNEL_ID: ${{ vars.PROD_ABC_CHANNEL_ID }}
|
|
ORG_CONTEXT_ENABLED: ${{ vars.PROD_ORG_CONTEXT_ENABLED }}
|
|
ORG_CONTEXT_API_URL: ${{ vars.PROD_ORG_CONTEXT_API_URL }}
|
|
ORG_CONTEXT_SCOPE_MODE: ${{ vars.PROD_ORG_CONTEXT_SCOPE_MODE }}
|
|
ORG_CONTEXT_EXPOSURE: ${{ vars.PROD_ORG_CONTEXT_EXPOSURE }}
|
|
ORG_CONTEXT_TENANT_IDS: ${{ vars.PROD_ORG_CONTEXT_TENANT_IDS }}
|
|
ORG_CONTEXT_CACHE_TTL_SECONDS: ${{ vars.PROD_ORG_CONTEXT_CACHE_TTL_SECONDS }}
|
|
ORG_CONTEXT_KEY_ID: ${{ secrets.PROD_ORG_CONTEXT_KEY_ID }}
|
|
ORG_CONTEXT_KEY_SECRET: ${{ secrets.PROD_ORG_CONTEXT_KEY_SECRET }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Require main and the selected commit
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
test "$DEPLOY_REF" = "refs/heads/main" || { echo "Production must be deployed from main"; exit 1; }
|
|
test "$(git rev-parse HEAD)" = "$DEPLOY_COMMIT_SHA" || { echo "Checkout does not match the selected commit"; exit 1; }
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Validate production settings
|
|
run: node scripts/deploy-production.mjs --validate-only
|
|
|
|
- name: Install dependencies
|
|
run: npm ci --no-fund --no-audit
|
|
|
|
- name: Check source and tests
|
|
run: npm run check && npm test
|
|
|
|
- name: Verify production organization API
|
|
run: npm run org:verify
|
|
|
|
- name: Build production Worker without deploying
|
|
run: npm run deploy:production -- --dry-run
|
|
|
|
- name: Upload this commit's static files
|
|
shell: bash
|
|
run: bash scripts/upload-r2.sh baron-qa-write wrangler.production.toml "releases/$DEPLOY_COMMIT_SHA"
|
|
|
|
- name: Deploy production Worker and secrets
|
|
run: npm run deploy:production
|
|
|
|
- name: Verify production HTTP endpoints
|
|
run: npm run production:verify
|