chore(dev): add SSH setup #318
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI + CD | |
| on: | |
| push: | |
| branches: | |
| - "**" | |
| env: | |
| DEV_PORT: 50505 | |
| STAGING_PORT: 50506 | |
| PROD_PORT: 50507 | |
| SONAR_PROJECT_KEY: "bas-kirill_muse-project_c40bc999-8826-433b-bb84-8871688b1ab1" | |
| jobs: | |
| openapi-linter: | |
| name: "[OpenAPI] Linter" | |
| runs-on: kiryuxa-1 | |
| steps: | |
| - uses: actions/checkout@v1 | |
| - name: Run Spectral Linter | |
| run: ./tools/scripts/openapi/runLinter.sh | |
| credentials-check: | |
| name: "[PR] GitGuardian scan" | |
| if: false # or in another case, there will be "Error: Server is not responding as expected." | |
| runs-on: kiryuxa-1 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # fetch all history so multiple commits can be scanned | |
| - name: GitGuardian scan | |
| uses: GitGuardian/ggshield-action@v1 | |
| env: | |
| GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }} | |
| GITHUB_PUSH_BASE_SHA: ${{ github.event.base }} | |
| GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }} | |
| client-linter: | |
| name: "[CLIENT] Linter" | |
| runs-on: kiryuxa-1 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Run linter | |
| run: ./tools/scripts/client/runLinter.sh | |
| client-static-analyzer: | |
| name: "[CLIENT] Static Analyzer" | |
| runs-on: kiryuxa-2 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Install dependencies | |
| run: cd ./client && npm install | |
| - name: Run Static Analyzer | |
| run: ./tools/scripts/client/runStaticAnalyzer.sh | |
| server-linter: | |
| name: "[SERVER] Linter" | |
| runs-on: kiryuxa-2 | |
| steps: | |
| - name: Set up JDK 21 (Temurin) | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "21.0" | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Run linter | |
| run: ./tools/scripts/server/runLinter.sh | |
| server-static-analyzer: | |
| name: "[SERVER] Static Analyzer" | |
| runs-on: kiryuxa-2 | |
| steps: | |
| - name: Set up JDK 21 (Temurin) | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "21.0" | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Run static analyzer | |
| run: ./tools/scripts/server/runStaticAnalyzer.sh | |
| server-sonarqube: | |
| name: "[SERVER] Run SonarQube" | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis | |
| - name: Set up JDK 17 | |
| uses: actions/setup-java@v1 | |
| with: | |
| java-version: 17 | |
| - name: Run sonarqube | |
| uses: sonarsource/sonarqube-scan-action@master | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} | |
| SONAR_PROJECT_KEY: ${{ env.SONAR_PROJECT_KEY }} | |
| - name: Wait for quality gate result | |
| run: sleep 5 | |
| - uses: phwt/sonarqube-quality-gate-action@v1 | |
| id: quality-gate-check | |
| with: | |
| sonar-project-key: "bas-kirill_muse-project_c40bc999-8826-433b-bb84-8871688b1ab1" | |
| sonar-host-url: ${{ secrets.SONAR_HOST_URL }} | |
| sonar-token: ${{ secrets.SONAR_TOKEN }} | |
| github-token: ${{ secrets.GH_TOKEN }} | |
| - name: Output result | |
| run: | | |
| echo "${{ steps.quality-gate-result.outputs.project-status }}" | |
| echo "${{ steps.quality-gate-result.outputs.quality-gate-result }}" | |
| server-unit-tests: | |
| name: "[SERVER] Unit Tests" | |
| runs-on: kiryuxa-3 | |
| permissions: | |
| contents: read | |
| issues: read | |
| checks: write | |
| pull-requests: write | |
| steps: | |
| - name: Set up JDK 21 (Temurin) | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "21.0" | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Run Unit Tests | |
| env: | |
| MUSE_JWT_SECRET_KEY: ${{ secrets.MUSE_JWT_SECRET_KEY }} | |
| run: ./tools/scripts/server/runUnitTests.sh | |
| # - name: Publish Unit Test Results | |
| # if: always() | |
| # uses: EnricoMi/[email protected] | |
| # with: | |
| # files: ./**/**/build/test-results/**/*.xml | |
| # report_individual_runs: true | |
| - name: Gather reports | |
| uses: actions/upload-artifact@v2 | |
| if: always() | |
| with: | |
| name: reports | |
| path: ./**/**/build/reports | |
| deploy-dev: | |
| name: "[SERVER] Deploy to Dev" | |
| # needs: | |
| # - openapi-linter | |
| # - client-linter | |
| # - client-static-analyzer | |
| # - server-linter | |
| # - server-static-analyzer | |
| # - server-unit-tests | |
| # - server-sonarqube | |
| runs-on: ubuntu-22.04 | |
| environment: | |
| name: dev | |
| url: http://dev.muse.kiryuxa.com | |
| steps: | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: myshx | |
| password: ${{ secrets.DOCKER_HUB_TOKEN }} | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Set up JDK 21 (Temurin) | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "21.0" | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20.16.0" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: "Install `Redocly`" | |
| run: npm i -g @redocly/cli@latest | |
| - name: Cache npm dependencies | |
| uses: actions/cache@v2 | |
| with: | |
| path: '~/.npm' | |
| key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} | |
| restore-keys: | | |
| ${{ runner.os }}-node- | |
| - name: Install Dependencies | |
| run: npm install --prefix client | |
| - name: Setup SSH connection to deploy server | |
| uses: kielabokkie/ssh-key-and-known-hosts-action@v1 | |
| with: | |
| ssh-private-key: ${{ secrets.DEPLOY_SERVER_SSH_PRIVATE_KEY }} | |
| ssh-host: kiryuxa.com | |
| ssh-port: 22 | |
| - name: Deploy at home lab | |
| run: echo "$(pwd)" && ./tools/scripts/deploy.sh dev | |
| env: | |
| MUSE_DOCKER_DEFAULT_CONTEXT: default | |
| MUSE_JWT_SECRET_KEY: ${{ secrets.MUSE_JWT_SECRET_KEY }} | |
| CI: false # https://stackoverflow.com/questions/34917977/disable-npm-warnings-as-errors-build-definition-tfs | |
| # deploy-staging: | |
| # name: "[SERVER] Deploy to Staging" | |
| # if: github.event.ref == 'refs/heads/main' | |
| # needs: | |
| # - openapi-linter | |
| # - client-linter | |
| # - client-static-analyzer | |
| # - server-linter | |
| # - server-static-analyzer | |
| # - server-unit-tests | |
| # - server-sonarqube | |
| # runs-on: ubuntu-22.04 | |
| # environment: | |
| # name: staging | |
| # url: http://staging.muse.kiryuxa.com | |
| # steps: | |
| # - name: Set up JDK 21 (Temurin) | |
| # uses: actions/setup-java@v4 | |
| # with: | |
| # distribution: temurin | |
| # java-version: "21.0" | |
| # - name: Check out the repo | |
| # uses: actions/checkout@v4 | |
| # - name: Log in to Docker Hub | |
| # run: docker login -u myshx -p ${{ secrets.DOCKER_HUB_TOKEN }} | |
| # - name: Build Server Docker Image | |
| # run: > | |
| # ./tools/scripts/server/buildJar.sh | |
| # | |
| # docker build . -t "myshx/muse-server:staging-${{ github.sha }}" -f ./server/Dockerfile | |
| # - name: Push Server Docker Image | |
| # run: docker push "myshx/muse-server:staging-${{ github.sha }}" | |
| # - name: Run server at home lab | |
| # uses: appleboy/ssh-action@master | |
| # env: | |
| # GIT_COMMIT_SHA: ${{ github.sha }} | |
| # STAGING_PORT: ${{ env.STAGING_PORT }} | |
| # with: | |
| # host: ${{ secrets.SERVER_HOST }} | |
| # username: ${{ secrets.SERVER_USERNAME }} | |
| # password: ${{ secrets.SERVER_PASSWORD }} | |
| # port: ${{ secrets.SERVER_PORT }} | |
| # envs: GIT_COMMIT_SHA, STAGING_PORT | |
| # script: > | |
| # export GIT_COMMIT_SHA=$GIT_COMMIT_SHA | |
| # | |
| # export STAGING_PORT=$STAGING_PORT | |
| # | |
| # | |
| # staging_container_ids=$(docker inspect --format='{{.Config.Image}} {{.Id}}' $(docker ps -aq) | grep -E 'myshx/muse-server:staging-\b[0-9a-f]{40}\b' | awk '{print $2}') | |
| # | |
| # staging_image_ids=$(docker inspect --format='{{.Config.Image}} {{.Image}}' $(docker ps -aq) | grep -E 'myshx/muse-server:staging-\b[0-9a-f]{40}\b' | awk '{print $2}') | |
| # | |
| # | |
| # for container_id in $staging_container_ids; do | |
| # docker stop "$container_id" | |
| # done | |
| # | |
| # | |
| # for container_id in $staging_container_ids; do | |
| # docker rm "$container_id" | |
| # done | |
| # | |
| # | |
| # for image_id in $staging_image_ids; do | |
| # docker rmi -f "$image_id"; | |
| # done | |
| # | |
| # | |
| # docker run -d -p $STAGING_PORT:8080 "myshx/muse-server:staging-$GIT_COMMIT_SHA" | |
| # deploy-prod: | |
| # name: "[SERVER] Deploy to Prod" | |
| # needs: | |
| # - deploy-staging | |
| # runs-on: ubuntu-22.04 | |
| # environment: | |
| # name: prod | |
| # url: http://prod.muse.kiryuxa.com | |
| # steps: | |
| # - name: Set up JDK 21 (Temurin) | |
| # uses: actions/setup-java@v4 | |
| # with: | |
| # distribution: temurin | |
| # java-version: "21.0" | |
| # - name: Check out the repo | |
| # uses: actions/checkout@v4 | |
| # - name: Log in to Docker Hub | |
| # run: docker login -u myshx -p ${{ secrets.DOCKER_HUB_TOKEN }} | |
| # - name: Build Server Docker Image | |
| # run: > | |
| # ./tools/scripts/server/buildJar.sh | |
| # | |
| # docker build . -t "myshx/muse-server:prod-${{ github.sha }}" -f ./server/Dockerfile | |
| # - name: Push Server Docker Image | |
| # run: docker push "myshx/muse-server:prod-${{ github.sha }}" | |
| # - name: Run server at home lab | |
| # uses: appleboy/ssh-action@master | |
| # env: | |
| # GIT_COMMIT_SHA: ${{ github.sha }} | |
| # PROD_PORT: ${{ env.PROD_PORT }} | |
| # with: | |
| # host: ${{ secrets.SERVER_HOST }} | |
| # username: ${{ secrets.SERVER_USERNAME }} | |
| # password: ${{ secrets.SERVER_PASSWORD }} | |
| # port: ${{ secrets.SERVER_PORT }} | |
| # envs: GIT_COMMIT_SHA, PROD_PORT | |
| # script: > | |
| # export GIT_COMMIT_SHA=$GIT_COMMIT_SHA | |
| # | |
| # export PROD_PORT=$PROD_PORT | |
| # | |
| # | |
| # prod_container_ids=$(docker inspect --format='{{.Config.Image}} {{.Id}}' $(docker ps -aq) | grep -E 'myshx/muse-server:prod-\b[0-9a-f]{40}\b' | awk '{print $2}') | |
| # | |
| # prod_image_ids=$(docker inspect --format='{{.Config.Image}} {{.Image}}' $(docker ps -aq) | grep -E 'myshx/muse-server:prod-\b[0-9a-f]{40}\b' | awk '{print $2}') | |
| # | |
| # | |
| # for container_id in $prod_container_ids; do | |
| # docker stop "$container_id" | |
| # done | |
| # | |
| # | |
| # for container_id in $prod_container_ids; do | |
| # docker rm "$container_id" | |
| # done | |
| # | |
| # | |
| # for image_id in $prod_image_ids; do | |
| # docker rmi -f "$image_id"; | |
| # done | |
| # | |
| # | |
| # docker run -d -p $PROD_PORT:8080 "myshx/muse-server:prod-$GIT_COMMIT_SHA" |