Ilker ManapandClaude Opus 5.5
686bfecbee
install.sh installs rollcall-dnsmasq-reload.sh and the systemd units
from the deploy directory, but CD copied only five files: every deploy
since a549f01 reinstalled a stale, pre-security reload script on the
region from an old copy left in /opt/rollcall/deploy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
106 lines
4.0 KiB
YAML
106 lines
4.0 KiB
YAML
# Continuous deployment to the lab PXE server after CI passes on main.
|
|
#
|
|
# Secrets: PXE_SSH_KEY private key for the deploy user on the PXE server
|
|
# Variables: PXE_HOST e.g. 10.0.0.234 PXE_USER e.g. ilker (needs passwordless sudo)
|
|
# SITE_HOST / SITE_USER / SITE_PATH optional: rsync target for the website
|
|
#
|
|
# The image rebuild (agent/**) runs live-build on the PXE server itself (~8 min)
|
|
# and only when agent files changed, or when dispatched by hand.
|
|
name: deploy
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: [CI]
|
|
types: [completed]
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
inputs:
|
|
rebuild_image:
|
|
description: 'Rebuild the commissioning image too'
|
|
type: boolean
|
|
default: false
|
|
|
|
concurrency:
|
|
group: deploy
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
server:
|
|
if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: cmd/rollcall/go.mod
|
|
cache-dependency-path: cmd/rollcall/go.sum
|
|
|
|
- name: Build
|
|
working-directory: cmd/rollcall
|
|
run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w -X main.version=$(git describe --tags --always --dirty)" -o ../../deploy/rollcall .
|
|
|
|
- name: SSH setup
|
|
env:
|
|
KEY: ${{ secrets.PXE_SSH_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
printf '%s\n' "$KEY" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
|
|
printf 'Host *\n StrictHostKeyChecking accept-new\n' > ~/.ssh/config
|
|
|
|
- name: Ship binary + deploy files and restart
|
|
env:
|
|
HOST: ${{ vars.PXE_HOST }}
|
|
USER: ${{ vars.PXE_USER }}
|
|
run: |
|
|
set -eu
|
|
ssh "$USER@$HOST" 'sudo mkdir -p /opt/rollcall/deploy /opt/rollcall/agent && sudo chown -R "$USER" /opt/rollcall'
|
|
# all of deploy/ and agent/: install.sh installs scripts and units from there,
|
|
# and a file left out would be installed from a stale copy
|
|
scp -q -r deploy/* "$USER@$HOST:/opt/rollcall/deploy/"
|
|
scp -q -r agent/* "$USER@$HOST:/opt/rollcall/agent/"
|
|
ssh "$USER@$HOST" 'cd /opt/rollcall/deploy && chmod +x install.sh rollcall ../agent/*.sh ../agent/*.py && sudo ./install.sh && sudo rollcall list >/dev/null && echo DEPLOY_OK'
|
|
|
|
image:
|
|
needs: server
|
|
if: >
|
|
(github.event_name == 'workflow_dispatch' && inputs.rebuild_image) ||
|
|
(github.event_name == 'workflow_run' && contains(join(github.event.workflow_run.head_commit.message, ' '), '[image]'))
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: SSH setup
|
|
env:
|
|
KEY: ${{ secrets.PXE_SSH_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
printf '%s\n' "$KEY" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
|
|
printf 'Host *\n StrictHostKeyChecking accept-new\n ServerAliveInterval 30\n' > ~/.ssh/config
|
|
- name: Rebuild the live image on the PXE server
|
|
env:
|
|
HOST: ${{ vars.PXE_HOST }}
|
|
USER: ${{ vars.PXE_USER }}
|
|
run: ssh "$USER@$HOST" 'sudo /opt/rollcall/agent/build-image.sh 2>&1 | tail -20'
|
|
|
|
site:
|
|
needs: server
|
|
if: vars.SITE_HOST != ''
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: SSH setup
|
|
env:
|
|
KEY: ${{ secrets.SITE_SSH_KEY || secrets.PXE_SSH_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
printf '%s\n' "$KEY" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
|
|
printf 'Host *\n StrictHostKeyChecking accept-new\n' > ~/.ssh/config
|
|
- name: Publish website
|
|
env:
|
|
HOST: ${{ vars.SITE_HOST }}
|
|
USER: ${{ vars.SITE_USER }}
|
|
DEST: ${{ vars.SITE_PATH }}
|
|
run: |
|
|
set -eu
|
|
tar -C site -czf - . | ssh "$USER@$HOST" "mkdir -p '$DEST' && tar -C '$DEST' -xzf - && echo SITE_OK"
|