jianwei/.github/workflows/deploy.yml at master · topbat/jianwei · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
name: Deploy

# 三种触发方式：
#   1) 提交触发  —— push 到 master 分支
#   2) 网页触发  —— Actions 页面 "Run workflow"（workflow_dispatch，可选 environment）
#   3) 脚本/API 触发 —— repository_dispatch（event_type=deploy），
#        例：gh api repos/<owner>/<repo>/dispatches -f event_type=deploy
on:
  push:
    branches: [master]
  workflow_dispatch:
    inputs:
      environment:
        description: 目标环境
        type: choice
        options: [master, dev]
        default: master
  repository_dispatch:
    types: [deploy]

env:
  # 默认推送到 GitHub Container Registry（零配置，用内置 GITHUB_TOKEN）。
  # 阿里云生产改用 ACR：把 REGISTRY 改成 ACR 地址，并替换下方登录步骤为 ACR 凭证。
  # 注：workflow 级 env 不可引用 secrets，故此处用固定默认值。
  REGISTRY: ghcr.io/${{ github.repository_owner }}
  IMAGE_TAG: ${{ github.sha }}

jobs:
  # ---------------- 构建并推送镜像 ----------------
  build-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3

      # 默认登录 GHCR；改用阿里云 ACR 时替换为 ACR 的 registry/username/password
      - name: 登录 GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: 构建并推送 api 镜像
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          file: ./backend/Dockerfile
          platforms: linux/amd64
          push: true
          tags: |
            ${{ env.REGISTRY }}/api:${{ env.IMAGE_TAG }}
            ${{ env.REGISTRY }}/api:latest

      - name: 构建并推送 crawler 镜像
        uses: docker/build-push-action@v6
        with:
          context: ./backend
          file: ./backend/Dockerfile.crawler
          platforms: linux/amd64
          push: true
          tags: |
            ${{ env.REGISTRY }}/crawler:${{ env.IMAGE_TAG }}
            ${{ env.REGISTRY }}/crawler:latest

      - name: 构建并推送 frontend 镜像
        uses: docker/build-push-action@v6
        with:
          context: ./frontend
          file: ./frontend/Dockerfile
          target: prod
          platforms: linux/amd64
          push: true
          tags: |
            ${{ env.REGISTRY }}/frontend:${{ env.IMAGE_TAG }}
            ${{ env.REGISTRY }}/frontend:latest

  # ---------------- SSH 部署到阿里云 ECS ----------------
  deploy:
    needs: build-push
    runs-on: ubuntu-latest
    steps:
      - name: 检查部署密钥是否配置
        id: gate
        run: |
          if [ -z "${{ secrets.ECS_HOST }}" ]; then
            echo "未配置 ECS_HOST 等密钥，跳过远程部署（镜像已推送，可手动部署）"
            echo "enabled=false" >> "$GITHUB_OUTPUT"
          else
            echo "enabled=true" >> "$GITHUB_OUTPUT"
          fi

      - name: SSH 部署
        if: steps.gate.outputs.enabled == 'true'
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.ECS_HOST }}
          username: ${{ secrets.ECS_USER }}
          key: ${{ secrets.ECS_SSH_KEY }}
          script: |
            set -e
            cd ${{ secrets.ECS_PATH }}            # 服务器上的仓库目录（含 .env）
            git pull --ff-only || true
            export REGISTRY="${{ env.REGISTRY }}"
            export TAG="${{ env.IMAGE_TAG }}"
            # 若用 GHCR 私有镜像，服务器需先登录（凭证经 secrets 注入环境亦可）
            docker compose -f docker-compose.yml -f docker-compose.prod.yml --env-file .env pull
            docker compose -f docker-compose.yml -f docker-compose.prod.yml --env-file .env up -d --remove-orphans
            sleep 8
            curl -fsS -k https://localhost/api/health || curl -fsS http://localhost/api/health
            echo "部署完成 TAG=$TAG"