HIS/.gitea/workflows/pipeline.yml

# .gitea/workflows/cicd.yaml
name: Build and Deploy Angular App (Artifacts, Gitea-safe)
on:
  push:
    branches: [ main ]
jobs:
  # ---------- TEST ----------
  test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Install dependencies
        run: npm ci
      - name: Run tests
        run: npx ng test --watch=false
  # ---------- BUILD ----------
  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Build Docker image
        run: docker build -t niayesh-hospital:latest .
      - name: Save Docker image to tar
        run: docker save niayesh-hospital:latest > niayesh-hospital.tar
      # IMPORTANT: use v3 on Gitea
      - name: Upload image artifact
        uses: actions/upload-artifact@v3
        with:
          name: app-image
          path: niayesh-hospital.tar
          if-no-files-found: error
  # ---------- SCAN ----------
  scan:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      # IMPORTANT: use v3 on Gitea
      - name: Download image artifact
        uses: actions/download-artifact@v3
        with:
          name: app-image
          path: . # place niayesh-hospital.tar in the workspace root
      - name: Load Docker image from artifact
        run: docker load -i niayesh-hospital.tar
      - name: Scan image with Trivy
        run: |
          docker run --rm \
            -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy:latest \
            image --exit-code 1 --severity CRITICAL,HIGH --no-progress niayesh-hospital:latest
  # ---------- DEPLOY ----------
  deploy:
    needs: [build, scan]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      # IMPORTANT: use v3 on Gitea
      - name: Download image artifact
        uses: actions/download-artifact@v3
        with:
          name: app-image
          path: .
      - name: Set up SSH
        run: |
          apt update && apt install -y openssh-client
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          eval "$(ssh-agent -s)"
          ssh-add ~/.ssh/id_ed25519
          ssh-keyscan -p ${{ secrets.SERVER_PORT }} ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts
      - name: Copy files to server
        run: |
          scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} \
            niayesh-hospital.tar \
            ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:"${{ secrets.DEPLOY_PATH }}/niayesh-hospital.tar"
          scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} \
            docker-compose.yml \
            ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:"${{ secrets.DEPLOY_PATH }}/docker-compose.yml"
      - name: Deploy on server
        run: |
          ssh -o StrictHostKeyChecking=no -p ${{ secrets.SERVER_PORT }} \
            ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }} << 'EOF'
            set -e
            cd "${{ secrets.DEPLOY_PATH }}"
            # Load image and restart stack
            docker load -i niayesh-hospital.tar
            if [ ! -f docker-compose.yml ]; then
              echo "ERROR: docker-compose.yml not found in $(pwd)" >&2
              ls -la
              exit 1
            fi
            docker compose -f docker-compose.yml down
            docker compose -f docker-compose.yml up -d --remove-orphans
            rm -f niayesh-hospital.tar
          EOF