From c4280e99534627423f2ae2d4ae7b19ac849214ff Mon Sep 17 00:00:00 2001 From: maulanasdqn Date: Thu, 2 Apr 2026 13:49:57 +0700 Subject: [PATCH] ci: replace legacy workflows with nix-build.yml Switch from cargo-based build + SCP deploy to Nix build + Cachix + infra flake.lock update pattern, matching imphnen-frontend-service. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/deploy-to-ancikri.yml | 65 ---------------------- .github/workflows/nix-build.yml | 73 +++++++++++++++++++++++++ .github/workflows/test-build.yml | 19 ------- 3 files changed, 73 insertions(+), 84 deletions(-) delete mode 100644 .github/workflows/deploy-to-ancikri.yml create mode 100644 .github/workflows/nix-build.yml delete mode 100644 .github/workflows/test-build.yml diff --git a/.github/workflows/deploy-to-ancikri.yml b/.github/workflows/deploy-to-ancikri.yml deleted file mode 100644 index b18d530..0000000 --- a/.github/workflows/deploy-to-ancikri.yml +++ /dev/null @@ -1,65 +0,0 @@ -name: Deploy to Ancikri - -on: - push: - branches: - - develop - -jobs: - build-and-deploy: - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@v2 - - - name: Set up Rust - uses: actions-rs/toolchain@v1 - with: - toolchain: stable - override: true - - - name: Build the project - run: cargo build --release - - - name: Stop service on VPS before upload - uses: appleboy/ssh-action@v0.1.7 - with: - host: ${{ secrets.VPS_ANCIKRI_IP }} - username: ${{ secrets.VPS_ANCIKRI_USER }} - key: ${{ secrets.VPS_ANCIKRI_SSH_KEY }} - port: ${{ secrets.VPS_ANCIKRI_PORT }} - script: | - set -e - echo "Stopping the service before uploading the binary" - sudo systemctl stop imphnen-backend-service - - - name: Upload artifact to VPS - uses: appleboy/scp-action@v0.1.7 - with: - host: ${{ secrets.VPS_ANCIKRI_IP }} - username: ${{ secrets.VPS_ANCIKRI_USER }} - key: ${{ secrets.VPS_ANCIKRI_SSH_KEY }} - port: ${{ secrets.VPS_ANCIKRI_PORT }} - source: ./target/release/* - target: /opt/imphnen-backend-service/imphnen-backend-service - rm: true - overwrite: true - - - name: Deploy to server - uses: appleboy/ssh-action@v0.1.7 - with: - host: ${{ secrets.VPS_ANCIKRI_IP }} - username: ${{ secrets.VPS_ANCIKRI_USER }} - key: ${{ secrets.VPS_ANCIKRI_SSH_KEY }} - port: ${{ secrets.VPS_ANCIKRI_PORT }} - script: | - set -e - - echo "Restarting the service" - - sudo systemctl daemon-reload - - sudo systemctl restart imphnen-backend-service - - echo "Deployment completed successfully" diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml new file mode 100644 index 0000000..83c6e1a --- /dev/null +++ b/.github/workflows/nix-build.yml @@ -0,0 +1,73 @@ +name: Nix Build & Deploy + +on: + push: + branches: ['develop'] + pull_request: + branches: ['develop'] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Install Nix + uses: DeterminateSystems/nix-installer-action@main + + - name: Setup Cachix + uses: cachix/cachix-action@v15 + with: + name: msdqn + authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' + + - name: Build + run: nix build .#default -o result + + - name: Push to Cachix + if: github.event_name == 'push' && github.ref == 'refs/heads/develop' + run: cachix push msdqn result + + deploy: + needs: build + if: github.event_name == 'push' && github.ref == 'refs/heads/develop' + runs-on: ubuntu-latest + steps: + - name: Install Nix + uses: DeterminateSystems/nix-installer-action@main + + - name: Setup SSH + env: + INFRA_DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }} + run: | + mkdir -p ~/.ssh + echo "${INFRA_DEPLOY_KEY}" > ~/.ssh/deploy_key + chmod 600 ~/.ssh/deploy_key + ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null + ssh-keyscan 167.235.70.37 >> ~/.ssh/known_hosts 2>/dev/null + + - name: Update infra flake.lock + run: | + export GIT_SSH_COMMAND="ssh -i ~/.ssh/deploy_key -o IdentitiesOnly=yes" + git clone git@github.com:IMPHNEN/imphnen-infrastructure.git /tmp/infra + cd /tmp/infra + nix flake update imphnen-backend + if git diff --quiet flake.lock; then + echo "flake.lock unchanged, skipping" + else + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + git add flake.lock + git commit -m "chore: update imphnen-backend-service to ${GITHUB_SHA::7}" + git push + fi + + - name: Deploy to server + continue-on-error: true + run: | + ssh -i ~/.ssh/deploy_key -o ConnectTimeout=15 -o StrictHostKeyChecking=accept-new root@167.235.70.37 \ + 'nixos-rebuild switch --flake github:IMPHNEN/imphnen-infrastructure#hetzner --refresh 2>&1 | tail -30' + + - name: Cleanup + if: always() + run: rm -f ~/.ssh/deploy_key diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml deleted file mode 100644 index adbba64..0000000 --- a/.github/workflows/test-build.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: Rust - -on: - push: - branches: ["develop"] - pull_request: - branches: ["develop"] - -env: - CARGO_TERM_COLOR: always - -jobs: - build: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v4 - - name: Build - run: cargo build --verbose