wangjia
f1950ffb6f
Deploy Server / deploy-server (push) Failing after 13m45s
- lib-forgejo/release-server: 5 处 read -r X < file 在 set -e 下遇无结尾换行的
EOF 会返回 1 静默中止(ver_from_tag printf 无换行、curl -w http_code 无换行);
逐处加 || true 容错(值已赋)。
- lib-forgejo: 空数组 ${FORGEJO_CURL_TLS[@]} 在 set -u 下老 bash 报 unbound;
改 empty-safe 展开(可移植 + 本地可测)。
- deploy-server.yml: Setup Go 加 sha256 校验(供应链完整性, 防镜像篡改注入工具链)。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u
58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
name: Deploy Server
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'server-v[0-9]*.[0-9]*.[0-9]*'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-server
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy-server:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# runner 镜像(catthehacker ubuntu:act-latest,label ubuntu-latest)自带 node
|
|
# 但**不带 go** → 直接 `go build` 会 `go: command not found`(exit 127)。
|
|
# 故先装 go:从 Go 官方**中国镜像** golang.google.cn 取(go.dev 在墙内不稳),
|
|
# 版本对齐 server/go.mod 的 1.25.10;装到 /usr/local/go 并加进 $GITHUB_PATH
|
|
# 供后续 Compile/Test 步骤共用。模块下载仍走 GOPROXY=goproxy.cn(见 _env.sh)。
|
|
- name: Setup Go 1.25.10(CN 镜像)
|
|
run: |
|
|
GO_VER=1.25.10
|
|
# 供应链完整性:校验 sha256(取自 Go 官方 release JSON,pin 为字面量),
|
|
# 防镜像被篡改/MITM 注入恶意工具链(它会编译要上生产的二进制)。校验失败即中止。
|
|
GO_SHA256=42d4f7a32316aa66591eca7e89867256057a4264451aca10570a715b3637ba70
|
|
curl -fsSL "https://golang.google.cn/dl/go${GO_VER}.linux-amd64.tar.gz" -o /tmp/go.tgz
|
|
echo "${GO_SHA256} /tmp/go.tgz" | sha256sum -c -
|
|
rm -rf /usr/local/go
|
|
tar -C /usr/local -xzf /tmp/go.tgz
|
|
echo "/usr/local/go/bin" >> "$GITHUB_PATH"
|
|
export PATH=/usr/local/go/bin:$PATH
|
|
go version
|
|
|
|
# 直接在 runner 跑(不嵌套 docker,避免 DinD 挂载失败;go 由上一步装好)。
|
|
- name: Compile (Go 控制面)
|
|
run: bash scripts/ci/compile-backend.sh
|
|
|
|
- name: Test (go test)
|
|
run: bash scripts/ci/test.sh server
|
|
|
|
- name: Release → Forgejo
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
|
|
TAG: ${{ gitea.ref_name }}
|
|
run: bash scripts/ci/release-server.sh "$TAG"
|
|
|
|
- name: Deploy → pangolin1
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
TAG: ${{ gitea.ref_name }}
|
|
run: bash scripts/ci/deploy-server.sh "$TAG"
|