add3ff8831
All checks were successful
Docker Build and Push / build-image (push) Successful in 6m37s
71 lines
2.4 KiB
YAML
71 lines
2.4 KiB
YAML
name: Docker Build and Push
|
|
|
|
# 仅 main 分支 push 触发, 其他分支不触发
|
|
# 每次主分支提交: 构建前端 + 生成 OTA 升级包 (签名) → 打进 Docker 镜像 → 部署
|
|
# OTA 随镜像发布: 容器内 OTA_PACKAGE_DIR=/app/ota-package 指向打包的 ota-package/
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- master
|
|
|
|
jobs:
|
|
build-image:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Setup Node
|
|
uses: https://gitea.com/actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Install deps
|
|
run: npm ci --no-audit --no-fund
|
|
|
|
- name: Build frontend
|
|
# dist/ 供 OTA 打包用 (Dockerfile 内也会构建一份)
|
|
run: npm run build
|
|
|
|
- name: Install minisign
|
|
run: sudo apt-get update && sudo apt-get install -y minisign
|
|
|
|
- name: Build & sign OTA package
|
|
# 每次主分支提交生成 OTA 升级包, sequence 默认时间戳 (单调递增)
|
|
# 产物 ota-package/ (tar.gz + latest.json + .minisig) 进入 docker build context, 由 Dockerfile COPY 进镜像
|
|
env:
|
|
MINISIGN_PRIVATE_KEY: ${{ secrets.MINISIGN_PRIVATE_KEY }}
|
|
OTA_NOTES: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
node scripts/build-ota.mjs --out ota-package --notes ${OTA_NOTES}
|
|
echo "===== latest.json ====="
|
|
cat ota-package/latest.json
|
|
echo "===== bundle sha256 ====="
|
|
sha256sum ota-package/iboard-ota.tar.gz
|
|
|
|
- name: Build Docker image
|
|
# DATABASE_URL 仅在 prisma generate 阶段需要, 可用任何合法占位串
|
|
run: docker build -t iboard:latest --build-arg DATABASE_URL=mysql://build:build@127.0.0.1:3306/build .
|
|
|
|
- name: List images
|
|
run: docker images
|
|
|
|
- name: Remove old container
|
|
run: docker rm -vf iboard || true
|
|
|
|
- name: Recycle container
|
|
run: docker system prune --volumes -f
|
|
|
|
- name: Run container
|
|
# DATABASE_URL 通过 gitea Actions secret 注入, 不进镜像层
|
|
# OTA_PACKAGE_DIR 已在 Dockerfile 设为 /app/ota-package
|
|
run: |
|
|
docker run -d --name iboard -p 3001:3001 \
|
|
-e DATABASE_URL="${{ secrets.DATABASE_URL }}" \
|
|
-e JWT_SECRET="${{ secrets.JWT_SECRET }}" \
|
|
iboard:latest
|
|
env:
|
|
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
|
JWT_SECRET: ${{ secrets.JWT_SECRET }}
|