root
0d9b1fd703
Map staging Secrets and Variables exclusively from STG names, validate explicit API and SSO settings, and pass them to the staging Worker. Preserve production settings and document the variable registration and Secret migration. Validation: source checks and 113 tests pass. Gitea STG Variables were created and verified; Secret registration remains with the user.
74 lines
2.5 KiB
YAML
74 lines
2.5 KiB
YAML
name: Deploy EG-BIM QA Gateway
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
CLOUDFLARE_API_TOKEN: ${{ secrets.STG_CLOUDFLARE_API_TOKEN }}
|
|
SESSION_SECRET: ${{ secrets.STG_SESSION_SECRET }}
|
|
ABC_API_KEY: ${{ secrets.STG_ABC_API_KEY }}
|
|
AUTH_CLIENT_ID: ${{ vars.STG_AUTH_CLIENT_ID }}
|
|
AUTH_ISSUER: ${{ vars.STG_AUTH_ISSUER }}
|
|
ABC_API_BASE_URL: ${{ vars.STG_ABC_API_BASE_URL }}
|
|
ABC_PROJECT_ID: ${{ vars.STG_ABC_PROJECT_ID }}
|
|
ABC_CHANNEL_ID: ${{ vars.STG_ABC_CHANNEL_ID }}
|
|
ORG_CONTEXT_ENABLED: ${{ vars.STG_ORG_CONTEXT_ENABLED }}
|
|
ORG_CONTEXT_API_URL: ${{ vars.STG_ORG_CONTEXT_API_URL }}
|
|
ORG_CONTEXT_SCOPE_MODE: ${{ vars.STG_ORG_CONTEXT_SCOPE_MODE }}
|
|
ORG_CONTEXT_EXPOSURE: ${{ vars.STG_ORG_CONTEXT_EXPOSURE }}
|
|
ORG_CONTEXT_TENANT_IDS: ${{ vars.STG_ORG_CONTEXT_TENANT_IDS }}
|
|
ORG_CONTEXT_CACHE_TTL_SECONDS: ${{ vars.STG_ORG_CONTEXT_CACHE_TTL_SECONDS }}
|
|
ORG_CONTEXT_KEY_ID: ${{ secrets.STG_ORG_CONTEXT_KEY_ID }}
|
|
ORG_CONTEXT_KEY_SECRET: ${{ secrets.STG_ORG_CONTEXT_KEY_SECRET }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
|
|
- name: Validate required secrets
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
test -n "$CLOUDFLARE_API_TOKEN" || { echo "STG_CLOUDFLARE_API_TOKEN is missing"; exit 1; }
|
|
test -n "$SESSION_SECRET" || { echo "STG_SESSION_SECRET is missing"; exit 1; }
|
|
test -n "$ABC_API_KEY" || { echo "STG_ABC_API_KEY is missing"; exit 1; }
|
|
node scripts/deploy-worker.mjs --validate-only
|
|
|
|
- name: Install dependencies
|
|
run: npm ci --no-fund --no-audit
|
|
|
|
- name: Check source
|
|
run: npm run check && npm test
|
|
|
|
- name: Verify organization integration settings
|
|
run: npm run org:verify
|
|
|
|
- name: Register Worker session secret
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
printf '%s' "$SESSION_SECRET" | npx wrangler secret put SESSION_SECRET --name baron-qa-gateway-test
|
|
|
|
- name: Register ABC API secret
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
printf '%s' "$ABC_API_KEY" | npx wrangler secret put ABC_API_KEY --name baron-qa-gateway-test
|
|
|
|
- name: Upload static files to R2
|
|
run: npm run r2:upload
|
|
|
|
- name: Deploy Worker
|
|
run: node scripts/deploy-worker.mjs
|