Max/zkldi_Tachi
1
0
Fork 0
mirror of https://github.com/zkldi/Tachi.git synced 2026-10-02 20:08:17 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: harden ci, don't log any kamal stuff here, it's a liability

Browse Source
This commit is contained in:
zk
2026-05-16 13:15:32 +00:00
parent c732034a6d
commit 9f2ca87665
4 changed files with 49 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/bot.yml
+12 -14
View File
@@ -58,27 +58,25 @@ jobs:
cache-from: type=gha,scope=${{ github.ref_name }}-bot
cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-bot
deploy:
dispatch-deploy:
# See server.yml for rationale — deploy logs live in the private tachi-deploy repo.
runs-on: ubuntu-latest
needs: [docker-push]
if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
strategy:
fail-fast: false
max-parallel: 1
matrix:
destination: [boku, kamai, dev]
steps:
- name: Enable SSH
- name: Dispatch deploy
env:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
DEST: ${{ matrix.destination }}
SHA: ${{ github.sha }}
run: |
mkdir -p ~/.ssh
printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
- name: Deploy updates
env:
TACHI_HOST: ${{ secrets.TACHI_HOST }}
run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/operations/deploy.sh bot ${{ matrix.destination }} ${{ github.sha }}"
gh api repos/zkldi/tachi-deploy/dispatches \
-f event_type=deploy \
-F "client_payload[app]=bot" \
-F "client_payload[dest]=${DEST}" \
-F "client_payload[sha]=${SHA}"
echo "::notice::Dispatched bot@${DEST} ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"
.github/workflows/database-seeds.yml
+11 -16
View File
@@ -42,25 +42,20 @@ jobs:
env:
NODE_ENV: "test"
deploy:
dispatch-deploy:
# See ../workflows/server.yml for rationale — deploy logs live in tachi-deploy.
runs-on: ubuntu-latest
needs: [test]
if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
concurrency:
group: "seeds-lock-${{ github.sha }}"
cancel-in-progress: false
steps:
- name: Enable SSH
- name: Dispatch seeds deploy
env:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
SHA: ${{ github.sha }}
run: |
mkdir -p ~/.ssh
printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
- name: Deploy seeds
env:
TACHI_HOST: ${{ secrets.TACHI_HOST }}
run: ssh -i ~/.ssh/id_rsa "ci@${TACHI_HOST}" /home/ci/tachi-deploy/operations/deploy-seeds.sh "${{ github.sha }}"
gh api repos/zkldi/tachi-deploy/dispatches \
-f event_type=deploy \
-F "client_payload[app]=seeds" \
-F "client_payload[dest]=-" \
-F "client_payload[sha]=${SHA}"
echo "::notice::Dispatched seeds ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"
.github/workflows/github-bot.yml
+11 -13
View File
@@ -57,22 +57,20 @@ jobs:
cache-from: type=gha,scope=${{ github.ref_name }}-github-bot
cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-github-bot
deploy:
dispatch-deploy:
# See server.yml for rationale — deploy logs live in the private tachi-deploy repo.
runs-on: ubuntu-latest
needs: [docker-push]
if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
steps:
- name: Enable SSH
- name: Dispatch deploy
env:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
SHA: ${{ github.sha }}
run: |
mkdir -p ~/.ssh
printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
- name: Deploy updates
env:
TACHI_HOST: ${{ secrets.TACHI_HOST }}
run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/operations/deploy.sh ghbot - ${{ github.sha }}"
gh api repos/zkldi/tachi-deploy/dispatches \
-f event_type=deploy \
-F "client_payload[app]=ghbot" \
-F "client_payload[dest]=-" \
-F "client_payload[sha]=${SHA}"
echo "::notice::Dispatched ghbot ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"
.github/workflows/server.yml
+15 -14
View File
@@ -150,29 +150,30 @@ jobs:
cache-from: type=gha,scope=server-${{ github.ref_name }}
cache-to: type=gha,mode=max,scope=server-${{ github.ref_name }}
deploy:
dispatch-deploy:
# Fire a repository_dispatch at tachi-deploy (private). That repo's workflow
# owns the SSH key and Kamal output — keeping deploy logs out of this
# public repo. See tachi-deploy/.github/workflows/deploy.yml.
runs-on: ubuntu-latest
needs: [test, docker-push]
if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
strategy:
fail-fast: false
max-parallel: 1
matrix:
destination: [boku, kamai, dev]
permissions:
contents: read
steps:
- name: Enable SSH
- name: Dispatch deploy
env:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
# Fine-grained PAT, repo-scoped to zkldi/tachi-deploy, Contents: write.
GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
DEST: ${{ matrix.destination }}
SHA: ${{ github.sha }}
run: |
mkdir -p ~/.ssh
printf '%s' "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
- name: Deploy on server
env:
TACHI_HOST: ${{ secrets.TACHI_HOST }}
run: ssh "ci@${TACHI_HOST}" "/home/ci/tachi-deploy/operations/deploy.sh server ${{ matrix.destination }} ${{ github.sha }}"
gh api repos/zkldi/tachi-deploy/dispatches \
-f event_type=deploy \
-F "client_payload[app]=server" \
-F "client_payload[dest]=${DEST}" \
-F "client_payload[sha]=${SHA}"
echo "::notice::Dispatched server@${DEST} ${SHA} — logs: https://github.com/zkldi/tachi-deploy/actions/workflows/deploy.yml"