From f2ca56990630c7a60c6e53f7bc63cd42f8d86ac3 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Sun, 5 Jul 2026 18:31:51 -0500 Subject: [PATCH 1/4] =?UTF-8?q?feat(ci):=20deploy-rc.yml=20=E2=80=94=20aut?= =?UTF-8?q?o-deploy=20the=20rc=20branch=20to=20the=20RC=20environment?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a custom deploy workflow that builds and deploys the release candidate to rc.git.mokoconsulting.tech (mokogitea-rc container, port 3110, DB mokogitea_rc) on push to the rc branch — the branch promote-rc creates when a PR to main is opened. Mirrors the fixed deploy-dev.yml: env-var image tag (MOKOGITEA_RC_TAG) driving the shared compose file (no sed), rm -f before force-recreate, quoted-heredoc remote expansion, health check + external verify. Gives a real release-candidate environment to validate before prod. Intended to move to Template-Go as the canonical synced source once validated (kept in custom/ for now so it isn't overwritten by workflow sync). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT --- .mokogitea/workflows/custom/deploy-rc.yml | 126 ++++++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 .mokogitea/workflows/custom/deploy-rc.yml diff --git a/.mokogitea/workflows/custom/deploy-rc.yml b/.mokogitea/workflows/custom/deploy-rc.yml new file mode 100644 index 0000000000..194feb97b5 --- /dev/null +++ b/.mokogitea/workflows/custom/deploy-rc.yml @@ -0,0 +1,126 @@ +# Copyright (C) 2026 Moko Consulting +# SPDX-License-Identifier: GPL-3.0-or-later +# BRIEF: Build and deploy MokoGitea to the RC environment on push to the rc branch. +# The rc branch is created by promote-rc when a PR to main is opened, so this +# deploys the exact release candidate to rc.git.mokoconsulting.tech for final +# validation before the stable/prod deploy. +# NOTE: Custom workflow (not synced). Intended to move to Template-Go as the canonical +# source once validated — see MokoConsulting/Template-Go. + +name: Deploy MokoGitea (RC) + +on: + push: + branches: + - rc + +concurrency: + group: deploy-mokogitea-rc + cancel-in-progress: true + +env: + REGISTRY: git.mokoconsulting.tech + IMAGE: mokoconsulting/mokogitea + DEPLOY_HOST: git.mokoconsulting.tech + DEPLOY_PORT: 2918 + DEPLOY_USER: mokoconsulting + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + +jobs: + deploy-rc: + name: "Build & Deploy to RC" + runs-on: ubuntu-latest + steps: + - name: Checkout source + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Determine version + id: config + run: | + VERSION=$(git describe --tags --always 2>/dev/null || echo "rc-$(git rev-parse --short HEAD)") + echo "tag=${VERSION}-rc" >> $GITHUB_OUTPUT + echo "Version: ${VERSION}-rc" + + - name: Write deploy key + env: + DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }} + run: | + mkdir -p ~/.ssh + echo "$DEPLOY_KEY" > ~/.ssh/deploy_key + chmod 600 ~/.ssh/deploy_key + + - name: Build and deploy to RC via SSH + env: + REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }} + TAG: ${{ steps.config.outputs.tag }} + run: | + # Inject runner-side values (TAG, REGISTRY_TOKEN) into the remote shell's + # environment via a command prefix, then use a *quoted* heredoc so every + # $var below expands in exactly one place: the remote host. + ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} \ + -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \ + -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \ + ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \ + "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF' + set -e + echo 'SSH connected to RC environment' + + if [ -z "$TAG" ]; then + echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2 + exit 1 + fi + + HEALTH_FMT='{{.State.Health.Status}}' + + echo 'Cleaning Docker build cache...' + docker builder prune -af 2>/dev/null || true + docker image prune -af 2>/dev/null || true + + echo 'Pulling source...' + SOURCE_DIR=/opt/gitea-dev/rc.git/source + if [ ! -d "$SOURCE_DIR/.git" ]; then + git clone -b rc https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git "$SOURCE_DIR" + fi + cd "$SOURCE_DIR" + git remote set-url origin https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git 2>/dev/null || true + git fetch origin rc + git reset --hard origin/rc + + echo "Building Docker image: ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG" + docker build --no-cache --build-arg GOFLAGS='-p 1' \ + --tag "${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG" \ + -f Dockerfile . + + echo 'Pushing to registry...' + echo "$REGISTRY_TOKEN" | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin + docker push "${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG" + + echo 'Restarting RC container...' + cd /opt/gitea-dev + # The rc service in the shared compose file reads its image tag from + # ${MOKOGITEA_RC_TAG}; drive it from the freshly built tag (env-var only + # affects the rc service — no sed on the shared file). Remove any lingering + # fixed-name container first so the recreate can't hit a name conflict. + docker rm -f mokogitea-rc 2>/dev/null || true + MOKOGITEA_RC_TAG="$TAG" docker compose -p gitea-dev up -d --force-recreate mokogitea-rc + + echo 'Health check...' + for i in 1 2 3 4 5 6 7 8; do + sleep 15 + if docker inspect --format="$HEALTH_FMT" mokogitea-rc 2>/dev/null | grep -q healthy; then + echo 'RC container healthy!' + exit 0 + fi + echo "Waiting... (attempt $i/8)" + done + echo 'Health check failed' + docker logs mokogitea-rc --tail 20 + exit 1 + DEPLOY_EOF + + - name: Verify RC instance + run: | + sleep 5 + curl -sf https://rc.git.mokoconsulting.tech/api/healthz && echo " RC API healthy" -- 2.52.0 From 5c62cefcd307bddf7bf5ab574c3274b9e020bc23 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Sun, 5 Jul 2026 18:37:33 -0500 Subject: [PATCH 2/4] refactor(ci): deploy-rc.yml -> root workflows, fully parameterized via repo vars/secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Moved from custom/ to the root .mokogitea/workflows/ (synced/template-owned area). - All deployment config now comes from repo Actions variables (DEPLOY_HOST/PORT/USER, DEPLOY_REGISTRY/IMAGE, RC_CONTAINER/COMPOSE_PROJECT/COMPOSE_DIR/SOURCE_DIR/TAG_ENV/ HEALTH_URL) and secrets (DEPLOY_SSH_KEY, DEPLOY_REGISTRY_TOKEN) — nothing hardcoded, so it works across Go server repos. Clone URL derived from github.server_url/repository. - To become Template-Go-owned (Template-Go#3). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT --- .mokogitea/workflows/custom/deploy-rc.yml | 126 --------------------- .mokogitea/workflows/deploy-rc.yml | 130 ++++++++++++++++++++++ 2 files changed, 130 insertions(+), 126 deletions(-) delete mode 100644 .mokogitea/workflows/custom/deploy-rc.yml create mode 100644 .mokogitea/workflows/deploy-rc.yml diff --git a/.mokogitea/workflows/custom/deploy-rc.yml b/.mokogitea/workflows/custom/deploy-rc.yml deleted file mode 100644 index 194feb97b5..0000000000 --- a/.mokogitea/workflows/custom/deploy-rc.yml +++ /dev/null @@ -1,126 +0,0 @@ -# Copyright (C) 2026 Moko Consulting -# SPDX-License-Identifier: GPL-3.0-or-later -# BRIEF: Build and deploy MokoGitea to the RC environment on push to the rc branch. -# The rc branch is created by promote-rc when a PR to main is opened, so this -# deploys the exact release candidate to rc.git.mokoconsulting.tech for final -# validation before the stable/prod deploy. -# NOTE: Custom workflow (not synced). Intended to move to Template-Go as the canonical -# source once validated — see MokoConsulting/Template-Go. - -name: Deploy MokoGitea (RC) - -on: - push: - branches: - - rc - -concurrency: - group: deploy-mokogitea-rc - cancel-in-progress: true - -env: - REGISTRY: git.mokoconsulting.tech - IMAGE: mokoconsulting/mokogitea - DEPLOY_HOST: git.mokoconsulting.tech - DEPLOY_PORT: 2918 - DEPLOY_USER: mokoconsulting - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - -jobs: - deploy-rc: - name: "Build & Deploy to RC" - runs-on: ubuntu-latest - steps: - - name: Checkout source - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Determine version - id: config - run: | - VERSION=$(git describe --tags --always 2>/dev/null || echo "rc-$(git rev-parse --short HEAD)") - echo "tag=${VERSION}-rc" >> $GITHUB_OUTPUT - echo "Version: ${VERSION}-rc" - - - name: Write deploy key - env: - DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }} - run: | - mkdir -p ~/.ssh - echo "$DEPLOY_KEY" > ~/.ssh/deploy_key - chmod 600 ~/.ssh/deploy_key - - - name: Build and deploy to RC via SSH - env: - REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }} - TAG: ${{ steps.config.outputs.tag }} - run: | - # Inject runner-side values (TAG, REGISTRY_TOKEN) into the remote shell's - # environment via a command prefix, then use a *quoted* heredoc so every - # $var below expands in exactly one place: the remote host. - ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} \ - -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \ - -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \ - ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \ - "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF' - set -e - echo 'SSH connected to RC environment' - - if [ -z "$TAG" ]; then - echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2 - exit 1 - fi - - HEALTH_FMT='{{.State.Health.Status}}' - - echo 'Cleaning Docker build cache...' - docker builder prune -af 2>/dev/null || true - docker image prune -af 2>/dev/null || true - - echo 'Pulling source...' - SOURCE_DIR=/opt/gitea-dev/rc.git/source - if [ ! -d "$SOURCE_DIR/.git" ]; then - git clone -b rc https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git "$SOURCE_DIR" - fi - cd "$SOURCE_DIR" - git remote set-url origin https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git 2>/dev/null || true - git fetch origin rc - git reset --hard origin/rc - - echo "Building Docker image: ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG" - docker build --no-cache --build-arg GOFLAGS='-p 1' \ - --tag "${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG" \ - -f Dockerfile . - - echo 'Pushing to registry...' - echo "$REGISTRY_TOKEN" | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin - docker push "${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG" - - echo 'Restarting RC container...' - cd /opt/gitea-dev - # The rc service in the shared compose file reads its image tag from - # ${MOKOGITEA_RC_TAG}; drive it from the freshly built tag (env-var only - # affects the rc service — no sed on the shared file). Remove any lingering - # fixed-name container first so the recreate can't hit a name conflict. - docker rm -f mokogitea-rc 2>/dev/null || true - MOKOGITEA_RC_TAG="$TAG" docker compose -p gitea-dev up -d --force-recreate mokogitea-rc - - echo 'Health check...' - for i in 1 2 3 4 5 6 7 8; do - sleep 15 - if docker inspect --format="$HEALTH_FMT" mokogitea-rc 2>/dev/null | grep -q healthy; then - echo 'RC container healthy!' - exit 0 - fi - echo "Waiting... (attempt $i/8)" - done - echo 'Health check failed' - docker logs mokogitea-rc --tail 20 - exit 1 - DEPLOY_EOF - - - name: Verify RC instance - run: | - sleep 5 - curl -sf https://rc.git.mokoconsulting.tech/api/healthz && echo " RC API healthy" diff --git a/.mokogitea/workflows/deploy-rc.yml b/.mokogitea/workflows/deploy-rc.yml new file mode 100644 index 0000000000..364629d5bc --- /dev/null +++ b/.mokogitea/workflows/deploy-rc.yml @@ -0,0 +1,130 @@ +# Copyright (C) 2026 Moko Consulting +# SPDX-License-Identifier: GPL-3.0-or-later +# BRIEF: Build and deploy to the RC environment on push to the rc branch. +# Portable across Go server repos: ALL deployment config comes from repo +# Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded. +# The rc branch is created by promote-rc when a PR to main opens. +# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3. +# +# Required repo VARIABLES: +# DEPLOY_HOST, DEPLOY_PORT, DEPLOY_USER - SSH deploy target +# DEPLOY_REGISTRY, DEPLOY_IMAGE - container registry + image name +# RC_CONTAINER - compose service/container to recreate +# RC_COMPOSE_PROJECT - docker compose -p project name +# RC_COMPOSE_DIR - dir containing docker-compose.yml on host +# RC_SOURCE_DIR - build source checkout on host +# RC_TAG_ENV - compose env-var name that pins the image tag +# RC_HEALTH_URL - external URL to verify after deploy +# Required repo SECRETS: +# DEPLOY_SSH_KEY, DEPLOY_REGISTRY_TOKEN + +name: Deploy (RC) + +on: + push: + branches: + - rc + +concurrency: + group: deploy-rc + cancel-in-progress: true + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + +jobs: + deploy-rc: + name: "Build & Deploy to RC" + runs-on: ubuntu-latest + steps: + - name: Checkout source + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Determine version + id: config + run: | + VERSION=$(git describe --tags --always 2>/dev/null || echo "rc-$(git rev-parse --short HEAD)") + echo "tag=${VERSION}-rc" >> $GITHUB_OUTPUT + echo "Version: ${VERSION}-rc" + + - name: Write deploy key + env: + DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }} + run: | + mkdir -p ~/.ssh + echo "$DEPLOY_KEY" > ~/.ssh/deploy_key + chmod 600 ~/.ssh/deploy_key + + - name: Build and deploy to RC via SSH + env: + REGISTRY_TOKEN: ${{ secrets.DEPLOY_REGISTRY_TOKEN }} + TAG: ${{ steps.config.outputs.tag }} + run: | + # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell + # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the + # remote. Repo variables (vars.*) are substituted inline by Actions before ssh. + ssh -i ~/.ssh/deploy_key -p ${{ vars.DEPLOY_PORT }} \ + -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \ + -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \ + ${{ vars.DEPLOY_USER }}@${{ vars.DEPLOY_HOST }} \ + "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF' + set -e + echo 'SSH connected to RC environment' + + if [ -z "$TAG" ]; then + echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2 + exit 1 + fi + + HEALTH_FMT='{{.State.Health.Status}}' + + echo 'Cleaning Docker build cache...' + docker builder prune -af 2>/dev/null || true + docker image prune -af 2>/dev/null || true + + echo 'Pulling source...' + SOURCE_DIR='${{ vars.RC_SOURCE_DIR }}' + if [ ! -d "$SOURCE_DIR/.git" ]; then + git clone -b rc ${{ github.server_url }}/${{ github.repository }}.git "$SOURCE_DIR" + fi + cd "$SOURCE_DIR" + git remote set-url origin ${{ github.server_url }}/${{ github.repository }}.git 2>/dev/null || true + git fetch origin rc + git reset --hard origin/rc + + echo "Building image: ${{ vars.DEPLOY_REGISTRY }}/${{ vars.DEPLOY_IMAGE }}:$TAG" + docker build --no-cache --build-arg GOFLAGS='-p 1' \ + --tag "${{ vars.DEPLOY_REGISTRY }}/${{ vars.DEPLOY_IMAGE }}:$TAG" \ + -f Dockerfile . + + echo 'Pushing to registry...' + echo "$REGISTRY_TOKEN" | docker login ${{ vars.DEPLOY_REGISTRY }} -u ${{ vars.DEPLOY_USER }} --password-stdin + docker push "${{ vars.DEPLOY_REGISTRY }}/${{ vars.DEPLOY_IMAGE }}:$TAG" + + echo 'Restarting RC container...' + cd '${{ vars.RC_COMPOSE_DIR }}' + # Drive the rc service image tag via its compose env-var (no sed on the shared + # file); remove any lingering fixed-name container first, then force-recreate. + docker rm -f '${{ vars.RC_CONTAINER }}' 2>/dev/null || true + ${{ vars.RC_TAG_ENV }}="$TAG" docker compose -p '${{ vars.RC_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.RC_CONTAINER }}' + + echo 'Health check...' + for i in 1 2 3 4 5 6 7 8; do + sleep 15 + if docker inspect --format="$HEALTH_FMT" '${{ vars.RC_CONTAINER }}' 2>/dev/null | grep -q healthy; then + echo 'RC container healthy!' + exit 0 + fi + echo "Waiting... (attempt $i/8)" + done + echo 'Health check failed' + docker logs '${{ vars.RC_CONTAINER }}' --tail 20 + exit 1 + DEPLOY_EOF + + - name: Verify RC instance + run: | + sleep 5 + curl -sf "${{ vars.RC_HEALTH_URL }}" && echo " RC API healthy" -- 2.52.0 From 6634b049abeb3942263dc5864fd5c35fa7047e66 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Sun, 5 Jul 2026 18:54:27 -0500 Subject: [PATCH 3/4] fix(ci): deploy-rc reuses existing DEPLOY_SSH_KEY + MOKOGITEA_TOKEN secrets The registry token is the org-wide MOKOGITEA_TOKEN secret (already configured, used by deploy-dev/deploy-mokogitea), not a new DEPLOY_REGISTRY_TOKEN. Reuse the existing secret names so no new secret values are needed; only the non-sensitive tier variables get set per-repo. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT --- .mokogitea/workflows/deploy-rc.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.mokogitea/workflows/deploy-rc.yml b/.mokogitea/workflows/deploy-rc.yml index 364629d5bc..35e955f1a5 100644 --- a/.mokogitea/workflows/deploy-rc.yml +++ b/.mokogitea/workflows/deploy-rc.yml @@ -15,8 +15,9 @@ # RC_SOURCE_DIR - build source checkout on host # RC_TAG_ENV - compose env-var name that pins the image tag # RC_HEALTH_URL - external URL to verify after deploy -# Required repo SECRETS: -# DEPLOY_SSH_KEY, DEPLOY_REGISTRY_TOKEN +# Required SECRETS (already configured org-wide; reused, not re-set): +# DEPLOY_SSH_KEY - deploy private key (repo/org secret) +# MOKOGITEA_TOKEN - registry/API token (org secret) name: Deploy (RC) @@ -59,7 +60,7 @@ jobs: - name: Build and deploy to RC via SSH env: - REGISTRY_TOKEN: ${{ secrets.DEPLOY_REGISTRY_TOKEN }} + REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }} TAG: ${{ steps.config.outputs.tag }} run: | # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell -- 2.52.0 From 7be712571c32c0c10a74dd672ad26198d4bd2363 Mon Sep 17 00:00:00 2001 From: Jonathan Miller Date: Sun, 5 Jul 2026 19:01:38 -0500 Subject: [PATCH 4/4] refactor(ci): tier-scope deploy-rc variables (RC_SSH_*, RC_REGISTRY*, RC_IMAGE) Shared DEPLOY_HOST/PORT/USER assumed all tiers live on one host. Scope every deploy variable to the rc tier (mirrors the org's DEV_SSH_* convention) so a repo inheriting this template can host rc/dev/prod on separate machines independently. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT --- .mokogitea/workflows/deploy-rc.yml | 31 +++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/.mokogitea/workflows/deploy-rc.yml b/.mokogitea/workflows/deploy-rc.yml index 35e955f1a5..2ad46f9cf4 100644 --- a/.mokogitea/workflows/deploy-rc.yml +++ b/.mokogitea/workflows/deploy-rc.yml @@ -6,15 +6,16 @@ # The rc branch is created by promote-rc when a PR to main opens. # OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3. # -# Required repo VARIABLES: -# DEPLOY_HOST, DEPLOY_PORT, DEPLOY_USER - SSH deploy target -# DEPLOY_REGISTRY, DEPLOY_IMAGE - container registry + image name -# RC_CONTAINER - compose service/container to recreate -# RC_COMPOSE_PROJECT - docker compose -p project name -# RC_COMPOSE_DIR - dir containing docker-compose.yml on host -# RC_SOURCE_DIR - build source checkout on host -# RC_TAG_ENV - compose env-var name that pins the image tag -# RC_HEALTH_URL - external URL to verify after deploy +# Required repo VARIABLES (all tier-scoped so each environment is independent — +# a repo may host its rc/dev/prod tiers on different machines): +# RC_SSH_HOST, RC_SSH_PORT, RC_SSH_USERNAME - SSH deploy target for the rc tier +# RC_REGISTRY, RC_REGISTRY_USER, RC_IMAGE - container registry + login user + image +# RC_CONTAINER - compose service/container to recreate +# RC_COMPOSE_PROJECT - docker compose -p project name +# RC_COMPOSE_DIR - dir containing docker-compose.yml on host +# RC_SOURCE_DIR - build source checkout on host +# RC_TAG_ENV - compose env-var name that pins the image tag +# RC_HEALTH_URL - external URL to verify after deploy # Required SECRETS (already configured org-wide; reused, not re-set): # DEPLOY_SSH_KEY - deploy private key (repo/org secret) # MOKOGITEA_TOKEN - registry/API token (org secret) @@ -66,10 +67,10 @@ jobs: # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the # remote. Repo variables (vars.*) are substituted inline by Actions before ssh. - ssh -i ~/.ssh/deploy_key -p ${{ vars.DEPLOY_PORT }} \ + ssh -i ~/.ssh/deploy_key -p ${{ vars.RC_SSH_PORT }} \ -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \ -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \ - ${{ vars.DEPLOY_USER }}@${{ vars.DEPLOY_HOST }} \ + ${{ vars.RC_SSH_USERNAME }}@${{ vars.RC_SSH_HOST }} \ "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF' set -e echo 'SSH connected to RC environment' @@ -95,14 +96,14 @@ jobs: git fetch origin rc git reset --hard origin/rc - echo "Building image: ${{ vars.DEPLOY_REGISTRY }}/${{ vars.DEPLOY_IMAGE }}:$TAG" + echo "Building image: ${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG" docker build --no-cache --build-arg GOFLAGS='-p 1' \ - --tag "${{ vars.DEPLOY_REGISTRY }}/${{ vars.DEPLOY_IMAGE }}:$TAG" \ + --tag "${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG" \ -f Dockerfile . echo 'Pushing to registry...' - echo "$REGISTRY_TOKEN" | docker login ${{ vars.DEPLOY_REGISTRY }} -u ${{ vars.DEPLOY_USER }} --password-stdin - docker push "${{ vars.DEPLOY_REGISTRY }}/${{ vars.DEPLOY_IMAGE }}:$TAG" + echo "$REGISTRY_TOKEN" | docker login ${{ vars.RC_REGISTRY }} -u ${{ vars.RC_REGISTRY_USER }} --password-stdin + docker push "${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG" echo 'Restarting RC container...' cd '${{ vars.RC_COMPOSE_DIR }}' -- 2.52.0