81 lines
2.7 KiB
YAML
81 lines
2.7 KiB
YAML
name: CI
|
|
|
|
# Tests and prek on every push and pull request. Pushes to main deploy to lynx while DEPLOY_LYNX is true.
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
tests:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install mise
|
|
run: |
|
|
curl -fsSL https://mise.run | sh
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Install pinned tools
|
|
run: mise install
|
|
|
|
# The prod group needs MySQL headers; tests run on SQLite.
|
|
- name: Install Python dependencies
|
|
run: mise exec -- uv sync --locked --no-group prod
|
|
|
|
- name: Unit tests
|
|
run: mise exec -- uv run --no-sync pytest
|
|
|
|
# The hooks in prek.toml.
|
|
prek:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: j178/prek-action@v1
|
|
|
|
# kaniko: the runner has no docker socket
|
|
image:
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_LYNX == 'true'
|
|
runs-on: ubuntu-latest
|
|
needs:
|
|
- tests
|
|
- prek
|
|
container: ghcr.io/osscontainertools/kaniko:v1.28.6-debug
|
|
defaults:
|
|
run:
|
|
shell: sh
|
|
steps:
|
|
- name: Build and push
|
|
env:
|
|
GIT_USERNAME: ${{ github.actor }}
|
|
GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
auth=$(printf '%s:%s' "$REGISTRY_USER" "$REGISTRY_TOKEN" | base64 | tr -d '\n')
|
|
printf '{"auths":{"git.neuf.no":{"auth":"%s"}}}' "$auth" > /kaniko/.docker/config.json
|
|
/kaniko/executor \
|
|
--context "git://git.neuf.no/${{ github.repository }}.git#${{ github.ref }}#${{ github.sha }}" \
|
|
--destination "git.neuf.no/edb/django-postfix-dovecot-api:${{ github.sha }}" \
|
|
--build-arg "SENTRY_RELEASE=${{ github.sha }}" \
|
|
--cache=true --cache-repo git.neuf.no/edb/django-postfix-dovecot-api-cache \
|
|
--snapshot-mode=redo --use-new-run \
|
|
--reproducible
|
|
|
|
# The key's forced command deploys the sha it is given
|
|
deploy-lynx:
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_LYNX == 'true'
|
|
runs-on: ubuntu-latest
|
|
needs:
|
|
- image
|
|
steps:
|
|
- name: Deploy
|
|
run: |
|
|
command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y )
|
|
eval $(ssh-agent -s)
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add -
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
|
|
ssh mxapi-deploy@lynx.neuf.no "${{ github.sha }}"
|