ci: deploy pro with docker compose

.gitea/workflows/deploy.yml

@@ -1,37 +1,68 @@
-name: Deploy olons-admin (k3s test cluster)
+name: Deploy olons-admin production
 
 on:
+  push:
+    branches:
+      - pro
   workflow_dispatch:
-    inputs:
+
-      image_tag:
+concurrency:
-        description: '镜像 tag，默认 test'
+  group: production-olons-admin
-        required: false
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  REGISTRY: git.olns.shop
+  IMAGE: git.olns.shop/pro/olons_admin
+  SERVICE: olons-admin
+  DEPLOY_HOST: 145.223.69.9
+  DEPLOY_USER: olns-deploy
 
 jobs:
   deploy:
     runs-on: deploy-host
+    timeout-minutes: 60
     steps:
       - uses: actions/checkout@v4
 
-      - name: 确定镜像 tag
+      - name: Log in to Gitea Container Registry
-        id: vars
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          TAG="${{ github.event.inputs.image_tag }}"
+          set -euo pipefail
-          [ -z "$TAG" ] && TAG=test
+          printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u admin --password-stdin
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-      - name: 登录镜像仓库
+      - name: Build and push image
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.118im.com -u admin --password-stdin
+        env:
-
+          GITHUB_SHA: ${{ github.sha }}
-      - name: 构建并推送前后端一体镜像
         run: |
-          docker build -t git.118im.com/im_team/olons-admin:${{ steps.vars.outputs.tag }} .
+          set -euo pipefail
-          docker push git.118im.com/im_team/olons-admin:${{ steps.vars.outputs.tag }}
+          SHORT_SHA="$(printf '%.12s' "$GITHUB_SHA")"
+          docker build -t "${IMAGE}:pro" -t "${IMAGE}:${SHORT_SHA}" .
+          docker push "$IMAGE:pro"
+          docker push "$IMAGE:$SHORT_SHA"
 
-      - name: 滚动更新测试集群
+      - name: Deploy Compose service
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
-          mkdir -p ~/.kube
+          set -euo pipefail
-          echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
+          install -d -m 700 "$HOME/.ssh"
-          chmod 600 ~/.kube/config
+          KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
-          kubectl rollout restart deployment/olons-admin -n olons-admin-system
+          cleanup() {
-          kubectl rollout status deployment/olons-admin -n olons-admin-system --timeout=180s
+            shred -u "$KEY_FILE" 2>/dev/null || true
+          }
+          trap cleanup EXIT
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
+          chmod 600 "$KEY_FILE"
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          chmod 600 "$HOME/.ssh/known_hosts"
+          SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
+          printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "docker login git.olns.shop -u admin --password-stdin"
+          ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+            "cd /opt/olns && docker compose pull olons-admin && docker compose up -d --no-deps --wait olons-admin"

tests/test_actions_workflow.py

@@ -0,0 +1,39 @@
+from pathlib import Path
+import unittest
+
+
+WORKFLOW = Path(__file__).resolve().parents[1] / ".gitea/workflows/deploy.yml"
+
+
+class DeployWorkflowContractTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.workflow = WORKFLOW.read_text(encoding="utf-8")
+
+    def test_targets_pro_branch_and_single_runner(self):
+        self.assertIn("push:", self.workflow)
+        self.assertIn("- pro", self.workflow)
+        self.assertIn("workflow_dispatch:", self.workflow)
+        self.assertIn("runs-on: deploy-host", self.workflow)
+        self.assertIn("concurrency:", self.workflow)
+
+    def test_builds_and_pushes_pro_image(self):
+        self.assertIn("git.olns.shop/pro/olons_admin", self.workflow)
+        self.assertIn("docker push", self.workflow)
+        self.assertIn(":pro", self.workflow)
+
+    def test_deploys_compose_service_with_pinned_host_key(self):
+        self.assertIn("DEPLOY_SSH_KEY", self.workflow)
+        self.assertIn("DEPLOY_KNOWN_HOSTS", self.workflow)
+        self.assertIn("StrictHostKeyChecking=yes", self.workflow)
+        self.assertIn("docker compose pull olons-admin", self.workflow)
+        self.assertIn("docker compose up -d --no-deps --wait olons-admin", self.workflow)
+
+    def test_removes_old_kubernetes_and_registry_targets(self):
+        self.assertNotIn("kubectl", self.workflow)
+        self.assertNotIn("KUBECONFIG", self.workflow)
+        self.assertNotIn("git.118im.com", self.workflow)
+
+if __name__ == "__main__":
+    unittest.main()
+