Asep Haryana
59f131f951
Separate deploy job failed because it used ls to find store paths by name, finding OLD local paths instead of the freshly copied CI paths. Now each service builds, copies, and updates its profile in a single job using the exact store path from the build output. No more guessing which path is the right one.
84 lines
2.5 KiB
YAML
84 lines
2.5 KiB
YAML
name: Nix Build & Deploy — All Services
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'apps/**'
|
|
- 'infra/**'
|
|
- 'flake.nix'
|
|
- 'flake.lock'
|
|
- '.github/workflows/nix-build.yml'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: nix-deploy
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
VPS_HOST: ${{ secrets.VPS_HOST }}
|
|
VPS_USER: ${{ secrets.VPS_USER }}
|
|
|
|
jobs:
|
|
build-and-deploy:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
service: [hub, scraper, tools-gateway, tools-workers, tools-frontend, llm-api]
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
submodules: recursive
|
|
fetch-depth: 0
|
|
|
|
- name: Install Nix
|
|
uses: DeterminateSystems/nix-installer-action@v16
|
|
with:
|
|
extra-conf: |
|
|
sandbox = false
|
|
accept-flake-config = true
|
|
|
|
- name: Cache Nix
|
|
uses: DeterminateSystems/magic-nix-cache-action@v8
|
|
|
|
- name: Build ${{ matrix.service }}
|
|
id: build
|
|
run: |
|
|
nix build .#${{ matrix.service }} --impure --option sandbox false --print-build-logs
|
|
STORE_PATH=$(readlink result)
|
|
echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT"
|
|
echo "✅ ${{ matrix.service }}: $STORE_PATH"
|
|
|
|
- name: Setup SSH key
|
|
if: github.ref == 'refs/heads/main'
|
|
env:
|
|
SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "$SSH_KEY" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
sed -i 's/\r$//' ~/.ssh/id_ed25519
|
|
ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
|
|
ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: Deploy ${{ matrix.service }} to VPS
|
|
if: github.ref == 'refs/heads/main'
|
|
run: |
|
|
STORE_PATH="${{ steps.build.outputs.store-path }}"
|
|
echo "=== Copying ${{ matrix.service }}: $STORE_PATH ==="
|
|
nix copy --to "ssh://$VPS_USER@$VPS_HOST" "$STORE_PATH"
|
|
|
|
echo "=== Updating profile ==="
|
|
ssh "$VPS_USER@$VPS_HOST" "sudo /nix/var/nix/profiles/default/bin/nix-env --profile /nix/var/nix/profiles/${{ matrix.service }} --set '$STORE_PATH'"
|
|
|
|
echo "=== Restarting service ==="
|
|
ssh "$VPS_USER@$VPS_HOST" "sudo systemctl restart ${{ matrix.service }}" || echo " ⚠️ restart failed (may not be enabled yet)"
|
|
|
|
echo "✅ ${{ matrix.service }} deployed"
|