wangjia
824992fe6e
- nginx-jiu-ali.conf：443 ssl+http2 正式入口（HSTS/XFO/nosniff 安全头、 ACME webroot 续期通道、80→443 跳转）；8443 明文过渡口拆除 - 客户端构建 URL 全量回切 https://jiu.51yanmei.com（compile×5/local_test/ release-client/notify） - 流水线去 EC2：deploy-client/site 单轨 Ali、manual 回滚与每日备份切 ali、 seed/reset/debug-db 改容器内取密码（SEC-003，退役 DB_PASSWORD secret） Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o
56 lines
2.1 KiB
YAML
56 lines
2.1 KiB
YAML
name: Manual Deploy
|
|
|
|
# Re-deploy a previously released tag. The tag prefix selects which part:
|
|
# client-v* -> deploy-client.sh (web app + installers + version.yaml)
|
|
# site-v* -> deploy-site.sh (marketing site)
|
|
# server-v* -> deploy-server.sh (backend binary + nginx)
|
|
# Each deploy script downloads its assets from the matching Forgejo Release.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'Prefixed tag to deploy (e.g. client-v1.0.55 / site-v1.0.0 / server-v1.0.0)'
|
|
required: true
|
|
type: string
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: mac
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ inputs.version }}
|
|
|
|
- name: Deploy (routed by tag prefix)
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
# 2026-07-03 割接后回滚目标统一为阿里机
|
|
DEPLOY_TARGET: ali
|
|
DEPLOY_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
|
|
DEPLOY_HOST: ${{ secrets.ALI_HOST }}
|
|
DEPLOY_USER: ${{ secrets.ALI_USER }}
|
|
# 兼容：回滚割接前旧 tag 时，旧脚本直接引用 EC2_*（set -u 下缺失即炸）——
|
|
# 同值指向阿里，旧脚本也会部署到阿里而不是复活 EC2
|
|
EC2_SSH_KEY: ${{ secrets.ALI_SSH_KEY }}
|
|
EC2_HOST: ${{ secrets.ALI_HOST }}
|
|
EC2_USER: ${{ secrets.ALI_USER }}
|
|
run: |
|
|
TAG="${{ inputs.version }}"
|
|
case "$TAG" in
|
|
client-v*) sh scripts/ci/deploy-client.sh "$TAG" ;;
|
|
site-v*) sh scripts/ci/deploy-site.sh "$TAG" ;;
|
|
server-v*) sh scripts/ci/deploy-server.sh "$TAG" ;;
|
|
*) echo "Unknown tag prefix: $TAG (expected client-v* / site-v* / server-v*)" >&2; exit 1 ;;
|
|
esac
|
|
|
|
- name: Notify
|
|
if: always()
|
|
env:
|
|
TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
|
|
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
|
|
run: sh scripts/ci/notify.sh "${{ inputs.version }}" "${{ job.status }}"
|