Sergei Poljanski
428df5896d
Some checks failed
deploy / ansible (push) Failing after 17m57s
Floating tags (17-alpine, 3.4-slim, nginx:alpine, :latest, :debug, @v7) change under a deploy without anyone deciding it: the storage deploy moved Postgres to 17.12 on its own because of postgres:17-alpine. Pin every image and action to its exact current version, so each change arrives as a reviewed Renovate PR and a rollback is a revert. Assisted-by: Claude:opus-5-5
63 lines
2.1 KiB
YAML
63 lines
2.1 KiB
YAML
name: deploy
|
|
|
|
# main: dry run, then apply ansible/site.yaml to both servers
|
|
# other branches: dry run only
|
|
#
|
|
# Secrets: SSH_DEPLOY_KEY (user deploy on both servers) and
|
|
# ANSIBLE_VAULT_PASSWORD (decrypts inventory/group_vars/all/vault.yaml).
|
|
|
|
run-name: "${{ github.ref == 'refs/heads/main' && 'apply' || 'dry run' }}: ${{ github.ref_name }}"
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- 'ansible/**'
|
|
- '.forgejo/workflows/deploy.yaml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
ansible:
|
|
runs-on: nix-latest
|
|
env:
|
|
NIX_CONFIG: |
|
|
experimental-features = nix-command flakes
|
|
build-users-group =
|
|
sandbox = false
|
|
# Pinned so CI runs the same Ansible on every run
|
|
NIXPKGS: github:NixOS/nixpkgs/0bb2eedc20e4739f29e8045034f2828ad7054f8f
|
|
ANSIBLE_HOST_KEY_CHECKING: "True"
|
|
ANSIBLE_FORCE_COLOR: "1"
|
|
steps:
|
|
- name: Prepare container for actions
|
|
run: nix-env -iA nixpkgs.nodejs_22
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v7.0.1
|
|
|
|
- name: Set up credentials
|
|
env:
|
|
SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
|
|
ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
|
|
run: |
|
|
if [ -z "$SSH_DEPLOY_KEY" ] || [ -z "$ANSIBLE_VAULT_PASSWORD" ]; then
|
|
echo "SSH_DEPLOY_KEY and ANSIBLE_VAULT_PASSWORD must be set as repository secrets" >&2
|
|
exit 1
|
|
fi
|
|
umask 077
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$SSH_DEPLOY_KEY" > ~/.ssh/id_ed25519
|
|
cp ansible/known_hosts ~/.ssh/known_hosts
|
|
printf '%s\n' "$ANSIBLE_VAULT_PASSWORD" > ansible/.vault_pass
|
|
|
|
- name: Dry run
|
|
working-directory: ansible
|
|
run: nix shell "$NIXPKGS#ansible" "$NIXPKGS#openssh" -c ansible-playbook -i inventory/ci.yaml site.yaml --check
|
|
|
|
- name: Apply
|
|
if: github.ref == 'refs/heads/main'
|
|
working-directory: ansible
|
|
run: nix shell "$NIXPKGS#ansible" "$NIXPKGS#openssh" -c ansible-playbook -i inventory/ci.yaml site.yaml
|
|
|
|
- name: Remove credentials
|
|
if: always()
|
|
run: rm -f ~/.ssh/id_ed25519 ansible/.vault_pass
|