Repository navigation
Planner: segments work without open or link tracking (#132) #36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Ship every merge to dev2, where outreachgraph.com runs since it left Railway (which | |
| # deployed on merge by itself). The box pulls the merged commit, rebuilds the | |
| # image(s) from this repo and restarts the compose stack under | |
| # /home/anthony/www/outreachgraph.com. Generated by cli-tools/dev2/dev2-site scaffold. | |
| name: Deploy to dev2 | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: Git ref to deploy (defaults to the pushed commit) | |
| required: false | |
| type: string | |
| concurrency: | |
| group: deploy-dev2 | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| steps: | |
| # ${{ }} values go through env, never straight into a run: body. | |
| - name: Resolve target revision | |
| id: rev | |
| env: | |
| REF: ${{ inputs.ref || github.sha }} | |
| run: echo "sha=$REF" >> "$GITHUB_OUTPUT" | |
| - name: Set up ssh | |
| env: | |
| SSH_KEY: ${{ secrets.DEV2_SSH_KEY }} | |
| KNOWN_HOSTS: ${{ secrets.DEV2_KNOWN_HOSTS }} | |
| run: | | |
| install -d -m 700 ~/.ssh | |
| printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519 | |
| chmod 600 ~/.ssh/id_ed25519 | |
| printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts | |
| chmod 644 ~/.ssh/known_hosts | |
| # app.env on the box is the runtime's only env and nothing else writes it, so a | |
| # secret a new feature needs ships as a repo secret and lands here, reviewable | |
| # and repeatable, instead of somebody editing dev2 by hand. Additive: an unset | |
| # secret is skipped, an unchanged value writes nothing, and a change keeps a | |
| # numbered backup of app.env first. Values travel on stdin, never in argv. | |
| - name: Sync secrets into app.env | |
| env: | |
| DEV2_USER: ${{ secrets.DEV2_USER }} | |
| DEV2_HOST: ${{ secrets.DEV2_HOST }} | |
| VALUESERP_API_KEY: ${{ secrets.VALUESERP_API_KEY }} | |
| CHOVY_CAMPAIGN_SECRET: ${{ secrets.CHOVY_CAMPAIGN_SECRET }} | |
| PDL_API_KEY: ${{ secrets.PDL_API_KEY }} | |
| run: | | |
| lines="" | |
| for key in VALUESERP_API_KEY CHOVY_CAMPAIGN_SECRET PDL_API_KEY; do | |
| value=$(printenv "$key" || true) | |
| [ -n "$value" ] && lines="$lines$key=$value"$'\n' | |
| done | |
| if [ -z "$lines" ]; then echo "no secrets to sync"; exit 0; fi | |
| printf '%s' "$lines" | ssh -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20 "$DEV2_USER@$DEV2_HOST" ' | |
| set -eu | |
| env_file=/home/anthony/www/outreachgraph.com/app.env | |
| tmp=$(mktemp); cp "$env_file" "$tmp"; changed="" | |
| while IFS= read -r line; do | |
| [ -n "$line" ] || continue | |
| key=${line%%=*} | |
| if grep -qxF -- "$line" "$tmp"; then continue; fi | |
| grep -v "^$key=" "$tmp" > "$tmp.next" || true | |
| printf "%s\n" "$line" >> "$tmp.next" | |
| mv "$tmp.next" "$tmp"; changed="$changed $key" | |
| done | |
| if [ -n "$changed" ]; then | |
| n=1; while [ -e "$env_file.bak-$(printf %03d $n)" ]; do n=$((n+1)); done | |
| cp -p "$env_file" "$env_file.bak-$(printf %03d $n)" | |
| cat "$tmp" > "$env_file"; chmod 600 "$env_file" | |
| echo "app.env updated:$changed" | |
| else | |
| echo "app.env already current" | |
| fi | |
| rm -f "$tmp" | |
| ' | |
| - name: Deploy | |
| env: | |
| DEV2_USER: ${{ secrets.DEV2_USER }} | |
| DEV2_HOST: ${{ secrets.DEV2_HOST }} | |
| SHA: ${{ steps.rev.outputs.sha }} | |
| run: | | |
| ssh -o BatchMode=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=20 "$DEV2_USER@$DEV2_HOST" \ | |
| /home/anthony/www/outreachgraph.com/deploy-app.sh "$SHA" | |
| - name: Verify the site answers | |
| run: | | |
| for i in $(seq 1 10); do | |
| code=$(curl -s -o /dev/null -w '%{http_code}' "https://outreachgraph.com/health/live" || true) | |
| case "$code" in 2*|3*|401|403) echo "outreachgraph.com $code"; exit 0;; esac | |
| echo "attempt $i: $code"; sleep 10 | |
| done | |
| echo "outreachgraph.com never answered"; exit 1 |