deploy #1929
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - .gitignore | |
| - README.md | |
| - SECURITY.md | |
| - LICENSE | |
| - CHANGELOG.md | |
| - CHANGELOG.json | |
| - 'docs/**' | |
| - '.vscode/**' | |
| - '.github/ISSUE_TEMPLATE/**' | |
| # Inherited from the now-deleted publish-dockerhub.yaml so we can still | |
| # trigger a manual rebuild/republish of the Docker Hub `latest` tag. | |
| workflow_dispatch: | |
| permissions: | |
| # `contents: write` is required by einaregilsson/build-number@v2 — it | |
| # creates a `build-number-NNN` git ref via the REST API to track the | |
| # monotonic counter. Tightening to `read` here gives 403 | |
| # "Resource not accessible by integration" on the very first step. | |
| contents: write | |
| packages: write # for ghcr.io push | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Generate Build Number | |
| uses: einaregilsson/build-number@v2 | |
| with: | |
| token: ${{ secrets.github_token }} | |
| env: | |
| # build-number@v2 still uses the legacy ::set-env command, which is | |
| # gated behind this insecure-commands flag. Required to populate | |
| # $BUILD_NUMBER for the image tag + deploy/run.sh's ${TAG} sed. | |
| ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true' | |
| - name: Compute Docker Hub version tag | |
| id: docker_tag | |
| # Mirrors the previous publish-dockerhub.yaml scheme: YYYY.M.D-<sha7>. | |
| # Pushed alongside `:latest` for public DockerHub consumers. | |
| run: | | |
| echo "version=$(date +'%Y.%-m.%-d')-$(echo ${GITHUB_SHA} | cut -c1-7)" >> "$GITHUB_OUTPUT" | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build & push image (GHCR + Docker Hub) | |
| # Single buildx invocation: ONE image manifest, THREE tags across TWO | |
| # registries. Replaces both the old docker-compose build/push step | |
| # AND the entire publish-dockerhub.yaml workflow — eliminating one | |
| # full Docker build per push to main (~140s × ~14 pushes/day ≈ | |
| # ~990 Ubuntu min/month saved). GHA layer cache makes subsequent | |
| # unchanged-layer builds near-instant. | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| push: true | |
| tags: | | |
| ghcr.io/acedatacloud/hub-frontend:${{ env.BUILD_NUMBER }} | |
| acedatacloud/nexior:${{ steps.docker_tag.outputs.version }} | |
| acedatacloud/nexior:latest | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Set Kubectl | |
| uses: Azure/k8s-set-context@v5 | |
| with: | |
| kubeconfig: ${{ secrets.KUBE_CONFIG }} | |
| - name: Deploy | |
| # Pulls ghcr.io/acedatacloud/hub-frontend:${BUILD_NUMBER} via the | |
| # production manifests' ${TAG} substitution (see deploy/run.sh). | |
| run: sh ./deploy/run.sh |