wangjia
cd0ba919d1
Deploy Server / deploy-server (push) Successful in 4m17s
冷缓存 runner 上 go build 拉私有 codes 依赖时,GOPROXY=goproxy.cn 对私有仓 404 → 回退 direct git 到 github.com → 无凭证失败(server-v1.1.0 首发在此挂,44s Compile 步红)。 加一步:GOPRIVATE + git insteadOf 把 github.com/wangjia/codes 重写到自建 gitea 并注入 FORGEJO_TOKEN(已验证 oauth2:<token> basic-auth 可 ls-remote 到 pin 的 commit)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A79VtQA1BwTuQN1ThpvYpo
74 lines
3.2 KiB
YAML
74 lines
3.2 KiB
YAML
name: Deploy Server
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'server-v[0-9]*.[0-9]*.[0-9]*'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-server
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy-server:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# runner 镜像(catthehacker ubuntu:act-latest,label ubuntu-latest)自带 node
|
|
# 但**不带 go** → 直接 `go build` 会 `go: command not found`(exit 127)。
|
|
# 故先装 go:从 Go 官方**中国镜像** golang.google.cn 取(go.dev 在墙内不稳),
|
|
# 版本对齐 server/go.mod 的 1.25.10;装到 /usr/local/go 并加进 $GITHUB_PATH
|
|
# 供后续 Compile/Test 步骤共用。模块下载仍走 GOPROXY=goproxy.cn(见 _env.sh)。
|
|
- name: Setup Go 1.25.10(CN 镜像)
|
|
run: |
|
|
GO_VER=1.25.10
|
|
# 供应链完整性:校验 sha256(取自 Go 官方 release JSON,pin 为字面量),
|
|
# 防镜像被篡改/MITM 注入恶意工具链(它会编译要上生产的二进制)。校验失败即中止。
|
|
GO_SHA256=42d4f7a32316aa66591eca7e89867256057a4264451aca10570a715b3637ba70
|
|
curl -fsSL --max-time 180 --retry 3 --retry-delay 5 --retry-connrefused \
|
|
"https://golang.google.cn/dl/go${GO_VER}.linux-amd64.tar.gz" -o /tmp/go.tgz
|
|
echo "${GO_SHA256} /tmp/go.tgz" | sha256sum -c -
|
|
rm -rf /usr/local/go
|
|
tar -C /usr/local -xzf /tmp/go.tgz
|
|
echo "/usr/local/go/bin" >> "$GITHUB_PATH"
|
|
export PATH=/usr/local/go/bin:$PATH
|
|
go version
|
|
|
|
# go.mod 依赖 github.com/wangjia/codes 的真源是自建私有 gitea(GOPROXY=goproxy.cn
|
|
# 对私有仓返 404 → 回退 direct git 到 github.com → 无凭证 terminal-prompts-disabled
|
|
# 失败)。这里把 go 对该路径的拉取重写到 gitea 并注入 token(oauth2:<token>
|
|
# basic-auth),GOPRIVATE 让 go 跳过公共 proxy/sumdb 直接走 git。runner 模块缓存
|
|
# 为热时不触发此路径,冷缓存(如换 runner/清缓存)必需。
|
|
- name: 私有依赖鉴权(github.com/wangjia/codes → 自建 gitea)
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
|
|
run: |
|
|
proto="${FORGEJO_URL%%://*}"
|
|
host="${FORGEJO_URL#*://}"
|
|
git config --global url."${proto}://oauth2:${FORGEJO_TOKEN}@${host}/wangjia/codes.git".insteadOf "https://github.com/wangjia/codes"
|
|
echo "GOPRIVATE=github.com/wangjia/codes" >> "$GITHUB_ENV"
|
|
|
|
# 直接在 runner 跑(不嵌套 docker,避免 DinD 挂载失败;go 由上一步装好)。
|
|
- name: Compile (Go 控制面)
|
|
run: bash scripts/ci/compile-backend.sh
|
|
|
|
- name: Test (go test)
|
|
run: bash scripts/ci/test.sh server
|
|
|
|
- name: Release → Forgejo
|
|
env:
|
|
FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
|
|
TAG: ${{ gitea.ref_name }}
|
|
run: bash scripts/ci/release-server.sh "$TAG"
|
|
|
|
- name: Deploy → pangolin1
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
TAG: ${{ gitea.ref_name }}
|
|
run: bash scripts/ci/deploy-server.sh "$TAG"
|