From 284dfdbdf46214f7d53ff74c4172ee6627125fe3 Mon Sep 17 00:00:00 2001 From: Jonas Braathen Date: Mon, 2 Nov 2026 01:17:10 +0100 Subject: [PATCH] ci: one workflow for tests, prek and the deploy to sega --- .gitea/workflows/checks.yaml | 38 ---------------------- .gitea/workflows/ci.yaml | 61 ++++++++++++++++++++++++++++++++++++ .gitea/workflows/deploy.yaml | 33 ------------------- .gitea/workflows/prek.yaml | 14 --------- README.md | 4 +-- prek.toml | 2 +- 6 files changed, 64 insertions(+), 88 deletions(-) delete mode 100644 .gitea/workflows/checks.yaml create mode 100644 .gitea/workflows/ci.yaml delete mode 100644 .gitea/workflows/deploy.yaml delete mode 100644 .gitea/workflows/prek.yaml diff --git a/.gitea/workflows/checks.yaml b/.gitea/workflows/checks.yaml deleted file mode 100644 index d04edd5..0000000 --- a/.gitea/workflows/checks.yaml +++ /dev/null @@ -1,38 +0,0 @@ -name: checks - -# Checks only, nothing here deploys. deploy.yaml calls it before deploying. -on: - push: - pull_request: - workflow_call: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - checks: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - # bind9-utils provides named-checkzone, used by the zone sync tests. - - name: Install system dependencies - run: | - SUDO=$(command -v sudo || true) - $SUDO apt-get update - $SUDO apt-get install -y --no-install-recommends bind9-utils - - - name: Install mise - run: | - curl -fsSL https://mise.run | sh - echo "$HOME/.local/bin" >> "$GITHUB_PATH" - - - name: Install pinned tools - run: mise install - - - name: Install Python dependencies - run: mise exec -- uv sync --locked --no-group prod - - - name: Unit tests - run: mise exec -- uv run --no-sync pytest diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml new file mode 100644 index 0000000..71de22e --- /dev/null +++ b/.gitea/workflows/ci.yaml @@ -0,0 +1,61 @@ +name: CI + +# Tests and prek on every push and pull request. A push to main that passes both deploys +# to sega, while the repository variable DEPLOY_SEGA is true. +on: + push: + pull_request: + +jobs: + tests: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + # bind9-utils provides named-checkzone, used by the zone sync tests. + - name: Install system dependencies + run: | + SUDO=$(command -v sudo || true) + $SUDO apt-get update + $SUDO apt-get install -y --no-install-recommends bind9-utils + + - name: Install mise + run: | + curl -fsSL https://mise.run | sh + echo "$HOME/.local/bin" >> "$GITHUB_PATH" + + - name: Install pinned tools + run: mise install + + - name: Install Python dependencies + run: mise exec -- uv sync --locked --no-group prod + + - name: Unit tests + run: mise exec -- uv run --no-sync pytest + + # The hooks in prek.toml. + prek: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: j178/prek-action@v1 + + # sega's authorized_keys sends this key to mdb-deploy, which reads the sha from the ssh + # command line, builds that commit on the host and switches to it (edb-infra's + # roles/mdb.md). + deploy-sega: + if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_SEGA == 'true' + runs-on: ubuntu-latest + needs: + - tests + - prek + steps: + - name: Deploy + run: | + command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y ) + eval $(ssh-agent -s) + echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add - + mkdir -p ~/.ssh + chmod 700 ~/.ssh + echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts + ssh mdb-deploy@sega.neuf.no "${{ github.sha }}" diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml deleted file mode 100644 index c8df796..0000000 --- a/.gitea/workflows/deploy.yaml +++ /dev/null @@ -1,33 +0,0 @@ -name: deploy - -on: - push: - branches: [main] - -jobs: - checks: - if: vars.DEPLOY_SEGA == 'true' - uses: ./.gitea/workflows/checks.yaml - prek: - if: vars.DEPLOY_SEGA == 'true' - uses: ./.gitea/workflows/prek.yaml - - # sega's authorized_keys sends this key to mdb-deploy, which reads the sha from the ssh - # command line, builds that commit on the host and switches to it (edb-infra's - # roles/mdb.md). - deploy-sega: - if: vars.DEPLOY_SEGA == 'true' - runs-on: ubuntu-latest - needs: - - checks - - prek - steps: - - name: Deploy - run: | - command -v ssh-agent >/dev/null || ( apt-get update -y && apt-get install openssh-client -y ) - eval $(ssh-agent -s) - echo "${{ secrets.SSH_PRIVATE_KEY }}" | tr -d '\r' | ssh-add - - mkdir -p ~/.ssh - chmod 700 ~/.ssh - echo "${{ secrets.SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts - ssh mdb-deploy@sega.neuf.no "${{ github.sha }}" diff --git a/.gitea/workflows/prek.yaml b/.gitea/workflows/prek.yaml deleted file mode 100644 index e65beb8..0000000 --- a/.gitea/workflows/prek.yaml +++ /dev/null @@ -1,14 +0,0 @@ -name: prek - -# The hooks in prek.toml. deploy.yaml calls it before deploying. -on: - push: - pull_request: - workflow_call: - -jobs: - prek: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: j178/prek-action@v1 diff --git a/README.md b/README.md index cbfd352..5af73a4 100644 --- a/README.md +++ b/README.md @@ -28,8 +28,8 @@ Run migrations and start the development server: MDB runs on sega under edb-infra's `mdb` role (`roles/mdb.md` there): gunicorn from a release directory per commit, its settings in the file `MDB_SETTINGS` names (`/etc/mdb/settings.py`), which `mdbsite/settings.py` executes last. A push to `main` that -passes the checks deploys itself while the repository variable `DEPLOY_SEGA` is `true` -(`.gitea/workflows/deploy.yaml`). The DNS and DHCP sync runs as root on sega: +passes the tests and prek deploys itself while the repository variable `DEPLOY_SEGA` is `true` +(`.gitea/workflows/ci.yaml`). The DNS and DHCP sync runs as root on sega: `sudo mdb-sync`. ## Development tasks diff --git a/prek.toml b/prek.toml index aa62ced..ec04bb1 100644 --- a/prek.toml +++ b/prek.toml @@ -1,5 +1,5 @@ # Git hooks, run by prek (https://prek.j178.dev). `prek install` once per clone; CI runs -# them all (.gitea/workflows/prek.yaml). +# them all (.gitea/workflows/ci.yaml). [[repos]] repo = "https://github.com/astral-sh/ruff-pre-commit"