Repository navigation
chore(deps-dev): bump the minor-and-patch group across 1 directory with 2 updates #17
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Gate every push and PR to main, then deploy. On a push to main, the `deploy` job | |
| # triggers Dokploy's webhook ONLY after lint / typecheck / build / docker all pass — | |
| # so broken code never reaches production. PRs run the checks but never deploy. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Manual re-run / re-deploy from the Actions tab (runs checks then deploys on main). | |
| workflow_dispatch: | |
| # Cancel superseded runs on the same ref (e.g. rapid pushes to a PR branch). | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check: | |
| name: Lint · Typecheck · Build | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: auth | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: auth/package-lock.json | |
| # Reproducible install from the committed lockfile. | |
| - run: npm ci | |
| # Lint + format check (Biome). Warnings (e.g. noExplicitAny at the Notion | |
| # boundary) are surfaced but do not fail the build; formatting / lint errors do. | |
| - run: npm run lint | |
| # Type safety across the whole project. | |
| - run: npm run typecheck | |
| # Compile TS -> dist, exactly as the Docker build stage does. | |
| - run: npm run build | |
| docker: | |
| name: Docker build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| # Validate the production image builds (multi-stage, incl. npm ci --omit=dev). | |
| # Build only — no push. Layer cache via GitHub Actions cache. | |
| - uses: docker/build-push-action@v6 | |
| with: | |
| context: auth | |
| file: auth/Dockerfile | |
| push: false | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| deploy: | |
| name: Deploy (Dokploy webhook) | |
| # Only after BOTH gates pass, and only on a real push to main — never on PRs or forks. | |
| needs: [check, docker] | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Trigger Dokploy redeploy | |
| env: | |
| # Dokploy per-app deploy webhook. Set in repo Settings → Secrets and variables → | |
| # Actions → New repository secret named DOKPLOY_DEPLOY_WEBHOOK. Never commit it. | |
| WEBHOOK: ${{ secrets.DOKPLOY_DEPLOY_WEBHOOK }} | |
| run: | | |
| if [ -z "$WEBHOOK" ]; then | |
| echo "::warning::DOKPLOY_DEPLOY_WEBHOOK secret is not set — skipping deploy. \ | |
| Add it in repo Settings → Secrets → Actions to enable autodeploy." | |
| exit 0 | |
| fi | |
| echo "Checks passed — triggering Dokploy redeploy…" | |
| # Dokploy's webhook matches the branch from the payload's `ref`, so send a | |
| # minimal GitHub-style body (a bare POST yields {"message":"Branch Not Match"} | |
| # and no deploy). -f fails the job on HTTP >=400; --retry rides out a blip. | |
| resp=$(curl -fsS --retry 3 --retry-delay 5 -X POST \ | |
| -H "Content-Type: application/json" \ | |
| -H "X-GitHub-Event: push" \ | |
| -d "{\"ref\":\"${GITHUB_REF}\"}" \ | |
| "$WEBHOOK") | |
| echo "Dokploy response: $resp" | |
| # Guard: a 200 with "Branch Not Match" means Dokploy silently skipped the deploy. | |
| if echo "$resp" | grep -qi "not match\|error"; then | |
| echo "::error::Dokploy did not deploy (response: $resp)" | |
| exit 1 | |
| fi | |
| echo "Dokploy deploy triggered." |