94 lines
3.5 KiB
YAML
94 lines
3.5 KiB
YAML
# .gitea/workflows/cicd.yaml
|
|
name: Build and Deploy Angular App HIS
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
jobs:
|
|
# ---------- BUILD ---------- (skipped test for simplicity; add back when ready)
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
- name: Build Docker image
|
|
run: docker build -t niayesh-hospital:latest .
|
|
- name: Save Docker image to tar
|
|
run: docker save niayesh-hospital:latest > niayesh-hospital.tar
|
|
# IMPORTANT: use v3 on Gitea
|
|
- name: Upload image artifact
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: app-image
|
|
path: niayesh-hospital.tar
|
|
if-no-files-found: error
|
|
# ---------- SCAN ----------
|
|
scan:
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
# IMPORTANT: use v3 on Gitea
|
|
- name: Download image artifact
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: app-image
|
|
path: . # place niayesh-hospital.tar in the workspace root
|
|
- name: Load Docker image from artifact
|
|
run: docker load -i niayesh-hospital.tar
|
|
- name: Scan image with Trivy
|
|
run: |
|
|
docker run --rm \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
aquasec/trivy:latest \
|
|
image --exit-code 1 --severity CRITICAL,HIGH --no-progress niayesh-hospital:latest
|
|
# ---------- DEPLOY ----------
|
|
deploy:
|
|
needs: [build, scan]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
# IMPORTANT: use v3 on Gitea
|
|
- name: Download image artifact
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: app-image
|
|
path: .
|
|
- name: Set up SSH
|
|
run: |
|
|
apt update && apt install -y openssh-client
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
eval "$(ssh-agent -s)"
|
|
ssh-add ~/.ssh/id_ed25519
|
|
ssh-keyscan -p ${{ secrets.SERVER_PORT }} ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts
|
|
- name: Copy files to server
|
|
run: |
|
|
scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} \
|
|
niayesh-hospital.tar \
|
|
${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:"${{ secrets.HIS_PATH }}/niayesh-hospital.tar"
|
|
scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} \
|
|
docker-compose.yml \
|
|
${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:"${{ secrets.HIS_PATH }}/docker-compose.yml"
|
|
scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} -r \
|
|
nginx_user_conf.d \
|
|
${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:"${{ secrets.HIS_PATH }}/nginx_user_conf.d"
|
|
- name: Deploy on server
|
|
run: |
|
|
ssh -o StrictHostKeyChecking=no -p ${{ secrets.SERVER_PORT }} \
|
|
${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }} << 'EOF'
|
|
set -e
|
|
cd "${{ secrets.HIS_PATH }}"
|
|
# Load image and restart stack
|
|
docker load -i niayesh-hospital.tar
|
|
if [ ! -f docker-compose.yml ]; then
|
|
echo "ERROR: docker-compose.yml not found in $(pwd)" >&2
|
|
ls -la
|
|
exit 1
|
|
fi
|
|
docker compose -f docker-compose.yml down
|
|
docker compose -f docker-compose.yml up -d --remove-orphans
|
|
rm -f niayesh-hospital.tar
|
|
EOF |