discord_bot/.github/workflows/dev_deploy.yml at dev · pesu-dev/discord_bot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: Dev Deploy

on:
  workflow_run:
    workflows:
      - CI Checks
    types:
      - completed

permissions:
  contents: read
  packages: write

env:
  SHA_TAG: ${{ github.event.workflow_run.head_sha }}
  IMAGE: ghcr.io/${{ github.repository }}

concurrency:
  group: dev_deploy
  cancel-in-progress: false

jobs:
  build_and_push_image:
    name: Build and push commit image
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.head_branch == 'dev'
    uses: pesu-dev/actions/.github/workflows/build_push_image.yml@v1
    with:
      ref: ${{ github.event.workflow_run.head_sha }}
      image_tag: ${{ github.event.workflow_run.head_sha }}
      push: true

  deploy_dev:
    name: Deploy commit image to dev
    needs: [build_and_push_image]
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.head_branch == 'dev'
    runs-on: ubuntu-latest
    environment: dev
    steps:
      - name: Trigger VM deploy gate (dev)
        uses: appleboy/ssh-action@v1.2.5
        with:
          host: ${{ secrets.VM_HOST }}
          username: ${{ secrets.VM_USERNAME }}
          key: ${{ secrets.VM_SSH_KEY }}
          fingerprint: ${{ secrets.VM_FINGERPRINT }}
          script: dev ${{ env.SHA_TAG }}

  sync_guild_commands:
    name: Sync guild commands (dev)
    needs: [build_and_push_image, deploy_dev]
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push' &&
      github.event.workflow_run.head_branch == 'dev'
    runs-on: ubuntu-latest
    environment: dev
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          fetch-depth: 0

      - name: GHCR login
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Resolve previously deployed dev SHA
        id: previous
        env:
          IMAGE: ghcr.io/${{ github.repository }}
        run: |
          set -euo pipefail
          if docker pull "${IMAGE}:dev" >/dev/null 2>&1; then
            BASE_SHA="$(docker inspect --format='{{ index .Config.Labels "org.opencontainers.image.revision"}}' "${IMAGE}:dev")"
            if [ -z "${BASE_SHA}" ] || [ "${BASE_SHA}" = "unknown" ]; then
              echo "No usable revision label on :dev image; command sync will run unconditionally."
              echo "base_ref=" >> "$GITHUB_OUTPUT"
            else
              echo "base_ref=${BASE_SHA}" >> "$GITHUB_OUTPUT"
              echo "Previously deployed dev SHA: ${BASE_SHA}"
            fi
          else
            echo "base_ref=" >> "$GITHUB_OUTPUT"
            echo "No existing dev image tag; command sync will run unconditionally."
          fi

      - name: Sync guild commands if registry changed
        uses: ./.github/actions/sync-guild-commands
        with:
          head_ref: ${{ github.event.workflow_run.head_sha }}
          base_ref: ${{ steps.previous.outputs.base_ref }}
          bot_token: ${{ secrets.BOT_TOKEN }}
          app_env: dev

  tag_dev:
    name: Tag deployed commit image as dev
    needs: [deploy_dev, sync_guild_commands]
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    steps:
      - name: GHCR login
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Retag commit image as dev
        run: |
          docker buildx imagetools create \
            --prefer-index=false \
            --tag "${IMAGE}:dev" \
            "${IMAGE}:${SHA_TAG}"

  cleanup_ghcr:
    name: Cleanup old package versions in GHCR
    needs: [tag_dev]
    uses: ./.github/workflows/ghcr_cleanup.yml
    with:
      keep_sha_tags: 20