diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index d4de72ea3..eca4b21e4 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -4,6 +4,7 @@ on: push: branches: - "main" + - "main-dev" paths: - "typescript/**" - "biome.json" @@ -15,6 +16,7 @@ on: pull_request: branches: - "main" + - "main-dev" paths: - "typescript/**" - "biome.json" diff --git a/.github/workflows/client.yml b/.github/workflows/client.yml index f3e4981d2..929712bdb 100644 --- a/.github/workflows/client.yml +++ b/.github/workflows/client.yml @@ -4,6 +4,7 @@ on: push: branches: - "main" + - "main-dev" paths: - "typescript/client/**" - "typescript/common/**" @@ -12,6 +13,7 @@ on: pull_request: branches: - "main" + - "main-dev" paths: - "typescript/client/**" - "typescript/common/**" @@ -27,7 +29,7 @@ jobs: container: image: ghcr.io/zkldi/tachi-ci:main options: --user root - if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} + if: ${{ (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/main-dev') && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} steps: - name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -38,6 +40,7 @@ jobs: run: bun install --frozen-lockfile - name: Build Bokutachi + if: github.ref == 'refs/heads/main' run: bun run --filter tachi-client build env: VITE_GIT_REPO: "GitHub:zkldi/Tachi" @@ -51,6 +54,7 @@ jobs: BUILD_OUT_DIR: /tmp/boku - name: Build Kamaitachi + if: github.ref == 'refs/heads/main' run: bun run --filter tachi-client build env: VITE_MANDATE_LOGIN: true @@ -68,6 +72,7 @@ jobs: BUILD_OUT_DIR: /tmp/kamai - name: Build Dev + if: github.ref == 'refs/heads/main-dev' run: bun run --filter tachi-client build env: VITE_MANDATE_LOGIN: true @@ -83,8 +88,13 @@ jobs: TACHI_NAME: "Tachi Dev" BUILD_OUT_DIR: /tmp/dev - - name: Bundle build outputs - run: tar -C /tmp -czf client-builds.tgz boku kamai dev + - name: Bundle build outputs (main) + if: github.ref == 'refs/heads/main' + run: tar -C /tmp -czf client-builds.tgz boku kamai + + - name: Bundle build outputs (main-dev) + if: github.ref == 'refs/heads/main-dev' + run: tar -C /tmp -czf client-builds.tgz dev - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: @@ -95,7 +105,7 @@ jobs: deploy: runs-on: ubuntu-latest needs: build - if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} + if: ${{ (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/main-dev') && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} steps: - name: Install rsync run: sudo apt-get update && sudo apt-get install -y rsync @@ -119,10 +129,16 @@ jobs: chmod 600 ~/.ssh/id_rsa printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts - - name: Deploy static to VPS (Caddy roots) + - name: Deploy static to Ceres — production (kamai + boku) + if: github.ref == 'refs/heads/main' env: TACHI_HOST: ${{ secrets.TACHI_HOST }} run: | rsync --recursive --compress --delete --progress /tmp/kamai/. "ci@${TACHI_HOST}:/srv/tachi-static/kamai/" rsync --recursive --compress --delete --progress /tmp/boku/. "ci@${TACHI_HOST}:/srv/tachi-static/boku/" - rsync --recursive --compress --delete --progress /tmp/dev/. "ci@${TACHI_HOST}:/srv/tachi-static/dev/" + + - name: Deploy static to Ceres — dev + if: github.ref == 'refs/heads/main-dev' + env: + TACHI_HOST: ${{ secrets.TACHI_HOST }} + run: rsync --recursive --compress --delete --progress /tmp/dev/. "ci@${TACHI_HOST}:/srv/tachi-static/dev/" diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml index 78557d827..d69e046b5 100644 --- a/.github/workflows/common.yml +++ b/.github/workflows/common.yml @@ -4,12 +4,14 @@ on: push: branches: - "main" + - "main-dev" paths: - "typescript/common/**" - ".github/workflows/common.yml" pull_request: branches: - "main" + - "main-dev" paths: - "typescript/common/**" - ".github/workflows/common.yml" diff --git a/.github/workflows/server.yml b/.github/workflows/server.yml index 9093dd8f4..bbc447532 100644 --- a/.github/workflows/server.yml +++ b/.github/workflows/server.yml @@ -4,6 +4,7 @@ on: push: branches: - "main" + - "main-dev" paths: - "typescript/server/**" - "typescript/common/**" @@ -15,6 +16,7 @@ on: pull_request: branches: - "main" + - "main-dev" paths: - "typescript/server/**" - "typescript/common/**" @@ -170,20 +172,28 @@ jobs: id: build_time run: echo "value=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT" + - name: Compute floating image tags + id: floating_tags + run: | + if [ "$GITHUB_REF" = "refs/heads/main" ]; then + echo "value=ghcr.io/zkldi/tachi:main\nghcr.io/zkldi/tachi:latest" >> "$GITHUB_OUTPUT" + else + echo "value=ghcr.io/zkldi/tachi:main-dev" >> "$GITHUB_OUTPUT" + fi + - name: Build and push unified server image uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 with: context: . file: docker/Dockerfile.server target: prod - push: ${{ github.ref == 'refs/heads/main' }} + push: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/main-dev' }} provenance: true sbom: true tags: | ghcr.io/zkldi/tachi:${{ steps.revision.outputs.image_tag }} ghcr.io/zkldi/tachi:${{ github.sha }} - ghcr.io/zkldi/tachi:main - ghcr.io/zkldi/tachi:latest + ${{ steps.floating_tags.outputs.value }} build-args: | VERSION=${{ steps.server_version.outputs.version }} VERSION_DETAIL=${{ steps.revision.outputs.image_tag }} @@ -192,17 +202,16 @@ jobs: cache-from: type=gha,scope=server-${{ github.ref_name }} cache-to: type=gha,mode=max,scope=server-${{ github.ref_name }} - dispatch-deploy: - # Fire a repository_dispatch at server-ceres (private). That repo's workflow - # owns the SSH key and Kamal output — keeping deploy logs out of this - # public repo. See server-ceres/.github/workflows/tachi-deploy.yml. + dispatch-deploy-prod: + # Deploys boku and kamai from main. + # See server.yml for rationale — deploy logs live in the private server-ceres repo. runs-on: ubuntu-latest needs: [test, docker-push] if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} strategy: fail-fast: false matrix: - destination: [boku, kamai, dev] + destination: [boku, kamai] permissions: contents: read steps: @@ -221,3 +230,27 @@ jobs: -F "client_payload[sha]=${SHA}" \ -F "client_payload[image_tag]=${IMAGE_TAG}" echo "::notice::Dispatched server@${DEST} ${IMAGE_TAG} (${SHA}) — logs: https://github.com/zkldi/server-ceres/actions/workflows/tachi-deploy.yml" + + dispatch-deploy-dev: + # Deploys dev from main-dev. + # See server.yml for rationale — deploy logs live in the private server-ceres repo. + runs-on: ubuntu-latest + needs: [test, docker-push] + if: ${{ github.ref == 'refs/heads/main-dev' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} + permissions: + contents: read + steps: + - name: Dispatch deploy + env: + # Fine-grained PAT, repo-scoped to zkldi/server-ceres, Contents: write. + GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }} + SHA: ${{ github.sha }} + IMAGE_TAG: ${{ needs.docker-push.outputs.image_tag }} + run: | + gh api repos/zkldi/server-ceres/dispatches \ + -f event_type=deploy \ + -F "client_payload[app]=server" \ + -F "client_payload[dest]=dev" \ + -F "client_payload[sha]=${SHA}" \ + -F "client_payload[image_tag]=${IMAGE_TAG}" + echo "::notice::Dispatched server@dev ${IMAGE_TAG} (${SHA}) — logs: https://github.com/zkldi/server-ceres/actions/workflows/tachi-deploy.yml"