Improved Application/DB

.gitea/workflows/cicd.yaml

@@ -1,20 +1,67 @@
 name: Build and Deploy Demo App
+
 on:
   push:
     branches:
       - main
+
 jobs:
-  build-and-deploy:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install deps
+        run: pip install -r requirements.txt
+      - name: Run tests
+        run: pytest tests.py
+
+  build:
+    needs: test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
+      - name: Cache Docker layers
+        uses: actions/cache@v4
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ hashFiles('Dockerfile', 'requirements.txt') }}
+          restore-keys: ${{ runner.os }}-buildx-
       - name: Build Docker image
-        run: docker build -t demo-app:latest .
+        uses: docker/build-push-action@v6
+        with:
+          load: true
+          tags: demo-app:latest
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
       - name: Save Docker image to tar
         run: docker save demo-app:latest > demo-app.tar
+
+  scan:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Scan Image
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: demo-app:latest
+          format: table
+          exit-code: 1
+          severity: CRITICAL,HIGH
+
+  deploy:
+    needs: [build, scan]
+    runs-on: ubuntu-latest
+    steps:
       - name: Set up SSH
         run: |
           apt update && apt install -y openssh-client
@@ -24,41 +71,19 @@ jobs:
           eval "$(ssh-agent -s)"
           ssh-add ~/.ssh/id_ed25519
           ssh-keyscan -p ${{ secrets.SERVER_PORT }} ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts
-      - name: Copy files to server via SCP
-        run: |
-          scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} demo-app.tar ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:${{ secrets.DEPLOY_PATH }}demo-app.tar
-          scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} docker-compose.yml ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:${{ secrets.DEPLOY_PATH }}docker-compose.yml
-          scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} -r nginx_user_conf.d ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:${{ secrets.DEPLOY_PATH }}nginx_user_conf.d
-      - name: Deploy on server via SSH
+      - name: Copy tar to server
+        run: scp -o StrictHostKeyChecking=no -P ${{ secrets.SERVER_PORT }} demo-app.tar ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }}:${{ secrets.DEPLOY_PATH }}demo-app.tar
+      - name: Deploy on server
         run: |
           ssh -o StrictHostKeyChecking=no -p ${{ secrets.SERVER_PORT }} ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_HOST }} << EOF
             cd ${{ secrets.DEPLOY_PATH }}
-
-            # Check and install Docker if not present (Ubuntu/Debian assumed)
-            if ! command -v docker &> /dev/null; then
-              sudo apt update -y
-              sudo apt install -y ca-certificates curl
-              sudo install -m 0755 -d /etc/apt/keyrings
-              sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
-              sudo chmod a+r /etc/apt/keyrings/docker.asc
-              echo "deb [arch=\$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \$(. /etc/os-release && echo "\$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-              sudo apt update -y
-              sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
-              sudo systemctl start docker
-              sudo systemctl enable docker
-            fi
-
-            # Ensure docker-compose-plugin is installed (for 'docker compose' command)
-            if ! docker compose version &> /dev/null; then
-              sudo apt update -y
-              sudo apt install -y docker-compose-plugin
-            fi
-
-            # Load image and deploy with Compose
+            # Create/update .env with secrets
+            echo "DB_USER=${{ secrets.DB_USER }}" > .env
+            echo "DB_PASS=${{ secrets.DB_PASS }}" >> .env
+            echo "DB_NAME=${{ secrets.DB_NAME }}" >> .env
+            # Load and deploy
             docker load -i demo-app.tar
-            docker compose down --remove-orphans -v || true  # Graceful stop
-            docker compose up -d --force-recreate
-
-            # Cleanup
+            docker compose down
+            docker compose --env-file .env up -d --remove-orphans
             rm demo-app.tar
           EOF