forked from baron/baron-sso
Merge branch 'dev' into feature/staging-healthcheck-monitoring
This commit is contained in:
83
.gitea/workflows/staging_build_check.yml
Normal file
83
.gitea/workflows/staging_build_check.yml
Normal file
@@ -0,0 +1,83 @@
|
||||
name: Staging Build Check
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
paths:
|
||||
- ".gitea/workflows/staging_build_check.yml"
|
||||
- "docker/staging_pull_compose.template.yaml"
|
||||
- "adminfront/**"
|
||||
- "devfront/**"
|
||||
- "userfront/**"
|
||||
- "backend/**"
|
||||
- "common/**"
|
||||
- "scripts/**"
|
||||
- "locales/**"
|
||||
- "package.json"
|
||||
- "pnpm-lock.yaml"
|
||||
- "pnpm-workspace.yaml"
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
build-check:
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- service: adminfront
|
||||
- service: devfront
|
||||
- service: userfront
|
||||
- service: backend
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Prepare staging build inputs
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
cat <<'EOF' > .env
|
||||
APP_ENV=stage
|
||||
TZ=Asia/Seoul
|
||||
IDP_PROVIDER=ory
|
||||
ADMINFRONT_URL=https://adminfront.staging.example.com
|
||||
DEVFRONT_URL=https://devfront.staging.example.com
|
||||
USERFRONT_URL=https://userfront.staging.example.com
|
||||
ORGFRONT_URL=https://orgfront.staging.example.com
|
||||
BACKEND_URL=https://backend.staging.example.com
|
||||
BACKEND_PUBLIC_URL=https://backend.staging.example.com
|
||||
VITE_OIDC_AUTHORITY=https://sso.staging.example.com/oidc
|
||||
WORKS_ADMIN_API_BASE_URL=https://works-admin.staging.example.com/api
|
||||
WORKS_ADMIN_OAUTH_TOKEN_URL=https://works-admin.staging.example.com/oauth/token
|
||||
ORY_POSTGRES_USER=ory
|
||||
ORY_POSTGRES_PASSWORD=ory-password
|
||||
COOKIE_SECRET=staging-build-cookie-secret
|
||||
JWT_SECRET=staging-build-jwt-secret
|
||||
NAVER_CLOUD_ACCESS_KEY=dummy
|
||||
NAVER_CLOUD_SECRET_KEY=dummy
|
||||
NAVER_CLOUD_SERVICE_ID=dummy
|
||||
NAVER_SENDER_PHONE_NUMBER=00000000000
|
||||
AWS_REGION=ap-northeast-2
|
||||
AWS_ACCESS_KEY_ID=dummy
|
||||
AWS_SECRET_ACCESS_KEY=dummy
|
||||
AWS_SES_SENDER=dummy@example.com
|
||||
REDIS_ADDR=redis:6389
|
||||
CLICKHOUSE_PORT_NATIVE=9000
|
||||
CLICKHOUSE_USER=baron
|
||||
CLICKHOUSE_PASSWORD=password
|
||||
HYDRA_PUBLIC_URL=https://hydra.staging.example.com
|
||||
KRATOS_BROWSER_URL=https://sso.staging.example.com
|
||||
KRATOS_ADMIN_URL=http://kratos:4434
|
||||
KRATOS_UI_URL=https://sso.staging.example.com
|
||||
EOF
|
||||
|
||||
cp docker/staging_pull_compose.template.yaml staging_pull_compose.yaml
|
||||
|
||||
- name: Build ${{ matrix.service }} with staging compose
|
||||
env:
|
||||
DOCKER_BUILDKIT: "1"
|
||||
COMPOSE_DOCKER_CLI_BUILD: "1"
|
||||
run: |
|
||||
set -euo pipefail
|
||||
docker compose -f staging_pull_compose.yaml build --pull --progress=plain "${{ matrix.service }}"
|
||||
@@ -133,6 +133,8 @@ jobs:
|
||||
ORGFRONT_CALLBACK_URLS=${{ vars.ORGFRONT_CALLBACK_URLS }}
|
||||
KRATOS_ALLOWED_RETURN_URLS_JSON=${{ vars.KRATOS_ALLOWED_RETURN_URLS_JSON }}
|
||||
KRATOS_ALLOWED_RETURN_URLS_EXTRA=${{ vars.KRATOS_ALLOWED_RETURN_URLS_EXTRA }}
|
||||
STAGING_PUBLIC_HEALTH_URL=${{ vars.STAGING_PUBLIC_HEALTH_URL }}
|
||||
STAGING_PUBLIC_HEALTH_MAX_ATTEMPTS=${{ vars.STAGING_PUBLIC_HEALTH_MAX_ATTEMPTS }}
|
||||
# OATHKEEPER_INTROSPECT_CLIENT_ID=${{ vars.OATHKEEPER_INTROSPECT_CLIENT_ID }}
|
||||
# OATHKEEPER_INTROSPECT_CLIENT_SECRET=${{ secrets.STG_OATHKEEPER_INTROSPECT_CLIENT_SECRET }}
|
||||
|
||||
@@ -195,7 +197,7 @@ jobs:
|
||||
max="${FRONTEND_HEALTH_MAX_ATTEMPTS:-60}"
|
||||
i=1
|
||||
while [ "${i}" -le "${max}" ]; do
|
||||
if docker exec "${name}" node -e "fetch('http://127.0.0.1:${port}/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" >/dev/null 2>&1; then
|
||||
if docker exec "${name}" sh -c "if command -v wget >/dev/null 2>&1; then wget -qO- 'http://127.0.0.1:${port}/' >/dev/null; elif command -v node >/dev/null 2>&1; then node -e \"fetch('http://127.0.0.1:${port}/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"; else exit 127; fi" >/dev/null 2>&1; then
|
||||
echo "Frontend ready: ${name}:${port}"
|
||||
return 0
|
||||
fi
|
||||
@@ -208,9 +210,55 @@ jobs:
|
||||
return 1
|
||||
}
|
||||
|
||||
check_container_url() {
|
||||
name="$1"
|
||||
url="$2"
|
||||
max="${FRONTEND_HEALTH_MAX_ATTEMPTS:-60}"
|
||||
i=1
|
||||
while [ "${i}" -le "${max}" ]; do
|
||||
if docker exec "${name}" sh -c "if command -v wget >/dev/null 2>&1; then wget -qO- '${url}' >/dev/null; elif command -v node >/dev/null 2>&1; then node -e \"fetch('${url}').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"; else exit 127; fi" >/dev/null 2>&1; then
|
||||
echo "Container URL ready: ${name} ${url}"
|
||||
return 0
|
||||
fi
|
||||
echo "Waiting for container URL: ${name} ${url} (${i}/${max})"
|
||||
i=$((i + 1))
|
||||
sleep 2
|
||||
done
|
||||
echo "ERROR: container URL not ready: ${name} ${url}" >&2
|
||||
docker logs "${name}" --tail 200 >&2 || true
|
||||
return 1
|
||||
}
|
||||
|
||||
check_public_http() {
|
||||
url="$1"
|
||||
if [ -z "${url}" ]; then
|
||||
echo "ERROR: STAGING_PUBLIC_HEALTH_URL is required." >&2
|
||||
return 1
|
||||
fi
|
||||
max="${STAGING_PUBLIC_HEALTH_MAX_ATTEMPTS:-30}"
|
||||
i=1
|
||||
while [ "${i}" -le "${max}" ]; do
|
||||
if curl -fsS --max-time 10 "${url}" >/dev/null; then
|
||||
echo "Public staging URL ready: ${url}"
|
||||
return 0
|
||||
fi
|
||||
echo "Waiting for public staging URL: ${url} (${i}/${max})"
|
||||
i=$((i + 1))
|
||||
sleep 2
|
||||
done
|
||||
echo "ERROR: public staging URL not ready: ${url}" >&2
|
||||
docker compose -f staging_pull_compose.yaml ps >&2 || true
|
||||
docker logs baron_gateway --tail 200 >&2 || true
|
||||
return 1
|
||||
}
|
||||
|
||||
check_container_url baron_backend http://127.0.0.1:3000/health
|
||||
check_container_http baron_userfront 5000
|
||||
check_container_http baron_gateway 5000
|
||||
check_container_http baron_adminfront 5173
|
||||
check_container_http baron_devfront 5173
|
||||
check_container_http baron_orgfront 5175
|
||||
check_public_http "${STAGING_PUBLIC_HEALTH_URL}"
|
||||
|
||||
echo "===== INIT-RP LOGS ====="
|
||||
docker compose -f staging_pull_compose.yaml logs init-rp || true
|
||||
|
||||
Reference in New Issue
Block a user