From 46be8648a299a6cdb212a03fd9d5b59c2d659ef8 Mon Sep 17 00:00:00 2001 From: cesnimda Date: Wed, 1 Jul 2026 12:17:15 +0200 Subject: [PATCH] ci(staging): build env from Gitea secrets; drop redundant host build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The host-mode runner does a clean checkout without the git-ignored deploy/.env.staging, so regenerate it from Actions secrets (STAGING_POSTGRES_PASSWORD / STAGING_GOOGLE_CLIENT_ID / STAGING_GOOGLE_CLIENT_SECRET) at deploy time. Drop the duplicate host build+test — 'docker compose --build' compiles the API image in-container and CI already gates tests on the PR. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/deploy-staging.yml | 31 ++++++++++++++++++----------- 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/.gitea/workflows/deploy-staging.yml b/.gitea/workflows/deploy-staging.yml index d38cf36..a0f7112 100644 --- a/.gitea/workflows/deploy-staging.yml +++ b/.gitea/workflows/deploy-staging.yml @@ -1,15 +1,14 @@ name: Deploy Staging # Continuous deployment to the LOCAL staging stack. Fires when develop advances -# (i.e. after a PR is merged into develop). It re-verifies the code, then rebuilds -# and restarts the isolated staging stack on this machine. +# (i.e. after a PR is merged into develop), rebuilding and restarting the isolated +# staging stack on this machine. # -# CRITICAL: staging lives on your Windows box (ports 18080/18081). A cloud or -# container runner CANNOT reach it, so this job MUST run on a self-hosted Gitea -# Actions runner registered ON that Windows machine with Docker access -# (labels: self-hosted, windows). Until that runner exists this job just waits -# in the queue (harmless, cancelable) — deploy staging manually meanwhile with: -# ./deploy/up.ps1 -Staging +# Runs on the self-hosted host-mode runner (labels: self-hosted, windows) so it can +# reach the host's Docker and publish to localhost:18081. Because the runner does a +# fresh checkout that (correctly) does NOT contain the git-ignored deploy/.env.staging, +# the staging secrets are supplied as Gitea Actions secrets and the env file is +# regenerated here at deploy time. on: push: branches: [develop] @@ -21,12 +20,20 @@ jobs: steps: - uses: actions/checkout@v4 - # Re-run the gate on the exact merged code before it touches staging. - - name: Build + test (Release) + - name: Write staging env from secrets shell: powershell + # Single-quoted here-string: Gitea substitutes the ${{ secrets.* }} tokens + # before the shell runs, and PowerShell then treats the values literally + # (no $ interpolation). ascii = no BOM, which docker compose's env parser needs. run: | - dotnet build InboxIntel.sln -c Release --nologo - dotnet test InboxIntel.sln -c Release --no-build --nologo + @' + POSTGRES_PASSWORD=${{ secrets.STAGING_POSTGRES_PASSWORD }} + GOOGLE_CLIENT_ID=${{ secrets.STAGING_GOOGLE_CLIENT_ID }} + GOOGLE_CLIENT_SECRET=${{ secrets.STAGING_GOOGLE_CLIENT_SECRET }} + AI_MODE=Disabled + FRONTEND_ORIGIN=http://localhost:18081 + MAX_MESSAGES=2000 + '@ | Out-File -FilePath deploy/.env.staging -Encoding ascii - name: Redeploy staging stack shell: powershell -- 2.52.0