cesnimda
87d44537b9
security.yml: gitleaks secret scan + NuGet/npm vulnerability gate on PRs and pushes to main/develop (detective backstop to the pre-commit hook). deploy-staging.yml: on merge to develop, re-verify then rebuild the isolated local staging stack (needs a self-hosted Windows runner). deploy-prod.yml: tag-gated production promotion (the tag is the approval), ready to activate once the Linux server + its runner exist. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
name: Deploy Production
|
|
|
|
# Production promotion. The APPROVAL GATE is the git tag: production only ever
|
|
# deploys a tagged release cut on main (see docs/WORKFLOW.md §5). Cutting the tag
|
|
# is the deliberate, auditable "approve to go live" action — and the tag doubles
|
|
# as the rollback target. workflow_dispatch adds a manual "Run workflow" button
|
|
# for re-deploys/rollbacks.
|
|
#
|
|
# STATUS: inactive until (a) the Linux production server exists and (b) a
|
|
# self-hosted Gitea runner is registered on it with labels [self-hosted, production].
|
|
# Tag pushes before then will queue harmlessly. This file is the wiring, ready to
|
|
# switch on — review the deploy step for your server before first use.
|
|
on:
|
|
push:
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
inputs:
|
|
ref:
|
|
description: 'Tag or commit to deploy (e.g. v1.2.0)'
|
|
required: true
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: [self-hosted, production]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# Deploy the exact tag that triggered the run (immutable), or the
|
|
# ref given to a manual dispatch.
|
|
ref: ${{ github.event.inputs.ref || github.ref_name }}
|
|
fetch-depth: 0
|
|
|
|
- name: Deploy release to production
|
|
run: |
|
|
echo "Deploying ${{ github.event.inputs.ref || github.ref_name }} to production"
|
|
# deploy/.env lives on the server (never in git). up.sh validates it,
|
|
# builds the Linux images, applies EF migrations on boot, and starts
|
|
# the stack behind the nginx reverse proxy.
|
|
./deploy/up.sh --proxy
|
|
|
|
- name: Smoke check
|
|
run: |
|
|
sleep 5
|
|
curl -fsS http://localhost/ >/dev/null && echo "Prod responding on :80" || \
|
|
{ echo "Smoke check failed"; exit 1; }
|