ci: migrate CI to GitHub Actions (deploy nix + mirror ke Gitea backup)

2026-08-01 16:42:37 +07:00
parent a07c26c55b
commit 4c79a1f09d
3 changed files with 116 additions and 78 deletions
@@ -0,0 +1,90 @@
+name: Build & Deploy (Nix)
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: zeavis-deploy
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  VPS_HOST: ${{ secrets.VPS_HOST }}
+  VPS_USER: ${{ secrets.VPS_USER }}
+
+jobs:
+  build-and-deploy:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        service: [api, ml-service, web]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          submodules: false
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          determinate: false
+          extra-conf: |
+            sandbox = false
+            accept-flake-config = true
+
+      - name: Cache Nix
+        uses: DeterminateSystems/magic-nix-cache-action@v14
+
+      - name: Build zeavis-${{ matrix.service }}
+        id: build
+        run: |
+          STORE_PATH=$(nix build .#${{ matrix.service }} --impure --option sandbox false --no-link --print-out-paths | tail -1)
+          echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT"
+          echo "Build OK zeavis-${{ matrix.service }}: $STORE_PATH"
+
+      - name: Setup SSH key
+        env:
+          SSH_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          sed -i 's/\r$//' ~/.ssh/id_ed25519
+          ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
+          ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+      - name: Deploy zeavis-${{ matrix.service }} to VPS
+        run: |
+          STORE_PATH="${{ steps.build.outputs.store-path }}"
+          echo "=== Copying zeavis-${{ matrix.service }}: $STORE_PATH ==="
+          nix copy --to "ssh://$VPS_USER@$VPS_HOST" "$STORE_PATH"
+
+          echo "=== Updating profile + restarting ==="
+          ssh "$VPS_USER@$VPS_HOST" "
+            set -eu
+            if [ -d /nix/var/nix/profiles/zeavis-${{ matrix.service }} ] && [ ! -L /nix/var/nix/profiles/zeavis-${{ matrix.service }} ]; then
+              rm -rf /nix/var/nix/profiles/zeavis-${{ matrix.service }}
+            fi
+            sudo /nix/var/nix/profiles/default/bin/nix-env --profile /nix/var/nix/profiles/zeavis-${{ matrix.service }} --set '$STORE_PATH'
+            sudo systemctl daemon-reload
+            sudo systemctl enable zeavis-${{ matrix.service }} 2>/dev/null || true
+            sudo systemctl restart zeavis-${{ matrix.service }}
+            for i in \$(seq 1 30); do
+              systemctl is-active --quiet zeavis-${{ matrix.service }} && break
+              sleep 1
+            done
+            systemctl is-active zeavis-${{ matrix.service }} || {
+              echo '=== SERVICE FAILED — journal ==='
+              journalctl -u zeavis-${{ matrix.service }} -n 40 --no-pager
+              exit 1
+            }
+            systemctl status zeavis-${{ matrix.service }} --no-pager 2>&1 | head -8
+          "
+          echo "✅ zeavis-${{ matrix.service }} deployed"