Merge pull request #131 from makcimerrr/fix/pending-status-label #90
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| # Build l'image (GHCR) puis déploie sur le VPS par SSH. | |
| # main -> production : ghcr.io/makcimerrr/admin-dashboard:latest -> hub.zone01normandie.org | |
| # staging -> staging : ghcr.io/makcimerrr/admin-dashboard:staging -> staging-hub.zone01normandie.org | |
| # | |
| # Secrets requis (repo > Settings > Secrets and variables > Actions) : | |
| # VPS_HOST : hôte/IP du VPS | |
| # VPS_USER : z01 | |
| # VPS_SSH_KEY : clé privée correspondant à la clé "github@actions" déjà autorisée sur le VPS | |
| on: | |
| push: | |
| branches: [main, staging] | |
| workflow_dispatch: | |
| env: | |
| IMAGE: ghcr.io/makcimerrr/admin-dashboard | |
| VPS_HOST: ${{ secrets.VPS_HOST }} | |
| jobs: | |
| build-and-deploy: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Determine environment | |
| id: env | |
| run: | | |
| if [ "${{ github.ref_name }}" = "main" ]; then | |
| echo "tag=latest" >> "$GITHUB_OUTPUT" | |
| echo "site=hub.zone01normandie.org" >> "$GITHUB_OUTPUT" | |
| echo "compose=docker-compose.production.yml" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "tag=staging" >> "$GITHUB_OUTPUT" | |
| echo "site=staging-hub.zone01normandie.org" >> "$GITHUB_OUTPUT" | |
| echo "compose=docker-compose.staging.yml" >> "$GITHUB_OUTPUT" | |
| fi | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ env.IMAGE }}:${{ steps.env.outputs.tag }} | |
| build-args: | | |
| NEXT_PUBLIC_STACK_PROJECT_ID=${{ secrets.NEXT_PUBLIC_STACK_PROJECT_ID }} | |
| NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY=${{ secrets.NEXT_PUBLIC_STACK_PUBLISHABLE_CLIENT_KEY }} | |
| NEXT_PUBLIC_BASE_URL=${{ secrets.NEXT_PUBLIC_BASE_URL }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Deploy over SSH | |
| # Ne tente le déploiement SSH que si les secrets VPS_* sont configurés. | |
| if: ${{ env.VPS_HOST != '' }} | |
| uses: appleboy/ssh-action@v1 | |
| with: | |
| host: ${{ secrets.VPS_HOST }} | |
| username: ${{ secrets.VPS_USER }} | |
| port: ${{ secrets.VPS_PORT }} | |
| key: ${{ secrets.VPS_SSH_KEY }} | |
| script: | | |
| set -e | |
| cd ~/sites/${{ steps.env.outputs.site }} | |
| # Image GHCR publique : forcer le pull anonyme (un token ghcr périmé | |
| # stocké sur le VPS renverrait 'denied' et laisserait l'ancienne image). | |
| docker logout ghcr.io || true | |
| docker compose -f ${{ steps.env.outputs.compose }} pull | |
| # --force-recreate : 'up -d' seul ne recréait pas toujours le conteneur | |
| # après un nouveau digest 'latest' → déploiement "réussi" mais ancien code. | |
| docker compose -f ${{ steps.env.outputs.compose }} up -d --force-recreate | |
| docker image prune -f |