feat: add gcp deploy in orion worker, remove dev env scripts (#1964) #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Orion client deploy | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - ".github/workflows/orion-client-deploy.yml" | |
| - "orion/**" | |
| - "scorpio/**" | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| # Rust toolchain | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust cache | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: release | |
| cache-on-failure: true | |
| - name: Build Orion | |
| run: cargo build --release -p orion --bin orion | |
| - name: Build Scorpio | |
| run: cargo build --release -p scorpio --bin scorpio | |
| - name: Verify build artifacts | |
| run: | | |
| set -e | |
| ls -lh target/release | |
| test -f target/release/orion | |
| test -f target/release/scorpio | |
| file target/release/orion | |
| file target/release/scorpio | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: orion-scorpio-bins | |
| path: | | |
| target/release/orion | |
| target/release/scorpio | |
| retention-days: 7 | |
| deploy: | |
| if: ${{ github.repository == 'web3infra-foundation/mega' }} | |
| runs-on: ubuntu-latest | |
| needs: build | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Download build artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: orion-scorpio-bins | |
| path: ./artifacts | |
| # NOTE: | |
| # The legacy orion_vm was provisioned with root-only SSH access. | |
| # For backward compatibility and to avoid breaking existing | |
| # production automation, deployment continues to use the root user. | |
| # | |
| # The new GCP VM correctly uses a non-root `orion` user. | |
| # Future infrastructure revisions should migrate orion_vm | |
| # to a least-privilege deployment user. | |
| - name: Upload binaries via rsync to orion_vm | |
| uses: burnett01/rsync-deployments@8.0.4 | |
| with: | |
| switches: -avz --progress | |
| path: artifacts/orion artifacts/scorpio | |
| remote_path: /root/orion-runner/ | |
| remote_host: ${{ secrets.ORION_DEPLOY_HOST }} | |
| remote_user: root | |
| remote_key: ${{ secrets.ORION_DEPLOY_SSH_KEY }} | |
| - name: Restart service to orion_vm | |
| uses: appleboy/ssh-action@v1.0.3 | |
| with: | |
| host: ${{ secrets.ORION_DEPLOY_HOST }} | |
| username: root | |
| key: ${{ secrets.ORION_DEPLOY_SSH_KEY }} | |
| script: | | |
| systemctl daemon-reload | |
| systemctl restart orion-runner.service | |
| systemctl status orion-runner.service --no-pager | |
| - name: Upload binaries via rsync to gcp_vm | |
| uses: burnett01/rsync-deployments@8.0.4 | |
| with: | |
| switches: -avz --progress | |
| path: artifacts/orion artifacts/scorpio | |
| remote_path: /home/orion/orion-runner/ | |
| remote_host: ${{ secrets.ORION_GCP_VM_HOST }} | |
| remote_user: orion | |
| remote_key: ${{ secrets.ORION_GCP_VM_SSH_KEY }} | |
| - name: Restart service to gcp_vm | |
| uses: appleboy/ssh-action@v1.0.3 | |
| with: | |
| host: ${{ secrets.ORION_GCP_VM_HOST }} | |
| username: orion | |
| key: ${{ secrets.ORION_GCP_VM_SSH_KEY }} | |
| script: | | |
| sudo systemctl daemon-reload | |
| sudo systemctl restart orion-runner.service | |
| sudo systemctl status orion-runner.service --no-pager |