wangjia
8c8486f9af
安全审查:run: 里内联 ${{ gitea.ref_name }} 有注入风险(恶意 tag 名);改经 env REF_NAME
+ 引用 "$REF_NAME"(同 deploy-server.yml 的 TAG 做法)。notify 的 job.status 同法。
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u
125 lines
4.1 KiB
YAML
125 lines
4.1 KiB
YAML
name: Deploy Client
|
|
|
|
# Mirrors ~/code/jiu/.gitea/workflows/deploy-client.yml's tag→build→release→
|
|
# deploy shape, trimmed to the two platforms drafted so far (Android +
|
|
# Windows — no client-web/macOS/iOS jobs; pangolin has no Flutter-web build
|
|
# in this pipeline and macOS/iOS are a separate not-yet-drafted phase, see
|
|
# docs/superpowers/plans/2026-07-05-cicd.md Phase 3).
|
|
#
|
|
# TODO(controller) — RUNNER AVAILABILITY: per docs/ci-runner.md, pangolin
|
|
# currently has exactly ONE registered Gitea Actions runner
|
|
# ("mac-pangolin-2", label `nas:host`). Neither `runs-on: mac` nor
|
|
# `runs-on: windows` below has any runner registered to pick it up yet — this
|
|
# workflow will queue forever until that's fixed. Options: (a) register
|
|
# mac-pangolin-2 with an additional `mac` label (it's already a mac host —
|
|
# cheapest fix for build-android/release-deploy) and separately stand up +
|
|
# register an actual Windows host runner labeled `windows` for build-windows
|
|
# (no such machine exists per docs/ci-runner.md), or (b) repoint both at
|
|
# `nas` and accept that Android/Windows builds then compete with the
|
|
# docker-in-domain nas jobs on the same single mac host. This mirrors the
|
|
# `runs-on: mac` / `runs-on: windows` split already planned in
|
|
# docs/superpowers/plans/2026-07-05-cicd.md Task 7/10 — written that way here
|
|
# for fidelity to that plan, NOT because the runners are confirmed to exist.
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'client-v[0-9]*.[0-9]*.[0-9]*'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-client
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
build-android:
|
|
runs-on: mac
|
|
env:
|
|
GOPROXY: https://goproxy.cn,direct
|
|
PUB_HOSTED_URL: https://pub.flutter-io.cn
|
|
FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Compile (Android APK)
|
|
env:
|
|
RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }}
|
|
KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
|
|
REF_NAME: ${{ gitea.ref_name }}
|
|
run: bash scripts/ci/compile-android.sh "$REF_NAME"
|
|
|
|
- name: Upload android artifact
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: android
|
|
path: dist/
|
|
|
|
build-windows:
|
|
runs-on: windows
|
|
env:
|
|
GOPROXY: https://goproxy.cn,direct
|
|
PUB_HOSTED_URL: https://pub.flutter-io.cn
|
|
FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Compile (Windows installer)
|
|
shell: bash
|
|
env:
|
|
REF_NAME: ${{ gitea.ref_name }}
|
|
run: bash scripts/ci/compile-windows.sh "$REF_NAME"
|
|
|
|
- name: Upload windows artifact
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: windows
|
|
path: dist/
|
|
|
|
release-deploy:
|
|
needs: [build-android, build-windows]
|
|
runs-on: mac
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Download android artifact
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: android
|
|
path: dist/
|
|
|
|
- name: Download windows artifact
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: windows
|
|
path: dist/
|
|
|
|
- name: Release → Forgejo
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
|
|
REF_NAME: ${{ gitea.ref_name }}
|
|
run: bash scripts/ci/release-client.sh "$REF_NAME"
|
|
|
|
- name: Deploy → pangolin1 (downloads/)
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
REF_NAME: ${{ gitea.ref_name }}
|
|
run: bash scripts/ci/deploy-client.sh "$REF_NAME"
|
|
|
|
- name: Notify
|
|
if: always()
|
|
env:
|
|
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
|
|
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
|
|
REF_NAME: ${{ gitea.ref_name }}
|
|
JOB_STATUS: ${{ job.status }}
|
|
run: |
|
|
. scripts/ci/notify.sh
|
|
if [ "$JOB_STATUS" = "success" ]; then
|
|
notify_ok "client $REF_NAME released + deployed"
|
|
else
|
|
notify_fail "client $REF_NAME pipeline failed"
|
|
fi
|