82 lines
3 KiB
YAML
82 lines
3 KiB
YAML
name: TheCr3w Docker Build and Deploy Pipeline
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
tags: [ 'v*.*.*' ]
|
|
|
|
jobs:
|
|
build-and-package:
|
|
runs-on: docker
|
|
steps:
|
|
- name: Checkout Source Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup .NET SDK
|
|
uses: actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
|
|
- name: Restore and Build
|
|
run: dotnet build TheCr3w.slnx -c Release
|
|
|
|
- name: Run Unit and Security Tests
|
|
run: dotnet test TheCr3w.slnx -c Release --no-build
|
|
|
|
- name: Log in to Forgejo OCI Container Registry
|
|
run: echo "${{ secrets.FORGEJO_REGISTRY_TOKEN }}" | docker login git.thecr3wnet.com -u "${{ secrets.FORGEJO_REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build and Push OCI Image
|
|
id: docker_build
|
|
run: |
|
|
IMAGE_TAG="git.thecr3wnet.com/thecr3w/backend:${{ github.sha }}"
|
|
docker build -t "$IMAGE_TAG" -f infrastructure/docker/Dockerfile.backend .
|
|
docker push "$IMAGE_TAG"
|
|
|
|
# Pobranie niezmiennego skrótu (Immutable Digest)
|
|
DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_TAG" | cut -d'@' -f2)
|
|
echo "IMMUTABLE_DIGEST=$DIGEST" >> $GITHUB_ENV
|
|
echo "Wygenerowany niezmienny digest OCI: $DIGEST"
|
|
|
|
- name: Create and Sign Deployment Manifest
|
|
id: create_manifest
|
|
env:
|
|
SIGNING_KEY_HEX: ${{ secrets.ED25519_SIGNING_PRIVATE_KEY }}
|
|
run: |
|
|
MANIFEST_ID=$(uuidgen || cat /proc/sys/kernel/random/uuid)
|
|
echo "Tworzenie manifestu wdrożeniowego $MANIFEST_ID..."
|
|
|
|
# Generowanie kanonicznego JSON manifestu
|
|
cat <<EOF > manifest.json
|
|
{
|
|
"manifest_id": "$MANIFEST_ID",
|
|
"project": "thecr3w-backend",
|
|
"environment": "production",
|
|
"service_name": "backend",
|
|
"image": "git.thecr3wnet.com/thecr3w/backend",
|
|
"immutable_digest": "$IMMUTABLE_DIGEST",
|
|
"config_hash": "${{ github.sha }}",
|
|
"secrets_references": ["ConnectionStrings__DefaultConnection", "Keycloak__Authority"],
|
|
"required_migrations": ["01-init-schema"],
|
|
"healthcheck": {
|
|
"path": "/health",
|
|
"port": 5000,
|
|
"interval_seconds": 10,
|
|
"timeout_seconds": 5,
|
|
"retries": 3
|
|
},
|
|
"rollback_strategy": {
|
|
"mode": "automatic_on_health_failure",
|
|
"target_immutable_digest": "none"
|
|
},
|
|
"created_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
|
|
"created_by": "forgejo-ci-${{ github.actor }}"
|
|
}
|
|
EOF
|
|
|
|
- name: Submit Manifest to Deployment Control API
|
|
run: |
|
|
curl -f -X POST "https://app.thecr3wnet.com/control/api/v1/deployments/manifests" \
|
|
-H "Content-Type: application/json" \
|
|
-H "Authorization: Bearer ${{ secrets.THECR3W_API_TOKEN }}" \
|
|
-d @manifest.json
|