70 lines
2.9 KiB
YAML
70 lines
2.9 KiB
YAML
# Gitea Actions 工作流：构建 Docker 镜像并通过 SSH 触发部署
|
||
# 前置：
|
||
# 1. Gitea Runner 已开放 Docker 访问（挂载 /var/run/docker.sock 到容器内）
|
||
# 2. 仓库 Secret 中已添加 SSH_PRIVATE_KEY（内容为部署机私钥全文，含 BEGIN/END 行）
|
||
# 3. 私钥对应的公钥已加入部署机 ~/.ssh/authorized_keys
|
||
name: build-and-deploy
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
workflow_dispatch:
|
||
|
||
env:
|
||
DEPLOY_HOST: bh.vps.honor3.com
|
||
DEPLOY_USER: root
|
||
DEPLOY_DIR: /app/registry
|
||
IMAGE_NAME: registry-app
|
||
|
||
jobs:
|
||
build-and-deploy:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: 检出代码
|
||
uses: actions/checkout@v4
|
||
|
||
- name: 生成镜像 tag（短 commit）
|
||
id: meta
|
||
run: echo "tag=$(echo ${GITHUB_SHA} | cut -c1-8)" >> "$GITHUB_OUTPUT"
|
||
|
||
- name: 构建 Docker 镜像
|
||
run: |
|
||
docker build \
|
||
-t "${IMAGE_NAME}:${{ steps.meta.outputs.tag }}" \
|
||
-t "${IMAGE_NAME}:latest" \
|
||
.
|
||
|
||
- name: 准备 SSH 私钥
|
||
env:
|
||
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||
run: |
|
||
mkdir -p ~/.ssh
|
||
# 写入并去除可能被 secret 引入的 CR，避免 openssh 解析失败
|
||
printf '%s\n' "${SSH_PRIVATE_KEY}" | tr -d '\r' > ~/.ssh/deploy_key
|
||
chmod 600 ~/.ssh/deploy_key
|
||
ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
|
||
# 诊断：不打印私钥内容，只打印结构，便于定位 secret 是否损坏
|
||
echo "---私钥文件行数与首末行（不含中间敏感内容）---"
|
||
wc -l ~/.ssh/deploy_key
|
||
head -n 1 ~/.ssh/deploy_key
|
||
tail -n 1 ~/.ssh/deploy_key
|
||
# 通过 ssh-keygen 校验私钥合法性并派生公钥指纹
|
||
ssh-keygen -y -f ~/.ssh/deploy_key > ~/.ssh/deploy_key.pub
|
||
echo "---派生公钥指纹（把公钥追加到部署机 authorized_keys）---"
|
||
ssh-keygen -l -f ~/.ssh/deploy_key.pub
|
||
echo "---派生公钥内容（可直接 append 到部署机 ~/.ssh/authorized_keys）---"
|
||
cat ~/.ssh/deploy_key.pub
|
||
|
||
- name: 上传 start.sh 到部署目录
|
||
run: |
|
||
# 强制仅用密钥认证 + 详细日志，password 认证禁用后仍失败会直接抛错
|
||
SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
|
||
ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
|
||
scp $SSH_OPTS deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
|
||
ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
|
||
|
||
- name: 远程执行部署
|
||
run: |
|
||
SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
|
||
ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" \
|
||
"IMAGE_TAG=${{ steps.meta.outputs.tag }} ${DEPLOY_DIR}/start.sh" |