ci: migrate GitHub Actions para Gitea Actions
- Move .github/workflows/ para .gitea/workflows/ (desativa CI no GitHub) - gitea.* contexts no lugar de github.*; GITHUB_TOKEN -> GITEA_PAT/GITEA_REGISTRY_USER (GITEA_TOKEN nao publica pacotes OCI, gitea#23642) - Registry: ghcr.io -> git.hellomanoel.com (container registry da instancia) - docs/deployment/dokploy.md: prereqs Gitea (Actions, runner, secrets, Dokploy registry)
This commit is contained in:
295
.gitea/workflows/ci.yml
Normal file
295
.gitea/workflows/ci.yml
Normal file
@@ -0,0 +1,295 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
|
||||
concurrency:
|
||||
group: ci-${{ gitea.workflow }}-${{ gitea.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
env:
|
||||
APP_ENV: testing
|
||||
APP_KEY: base64:NXm/6jIyFcDGHoMKGc5QZuSaq0dRZFYPg1Isuy1fNvE=
|
||||
APP_LOCALE: pt_BR
|
||||
APP_FALLBACK_LOCALE: pt_BR
|
||||
APP_TIMEZONE: America/Sao_Paulo
|
||||
BCRYPT_ROUNDS: 4
|
||||
CACHE_STORE: database
|
||||
DB_CONNECTION: pgsql
|
||||
DB_HOST: 127.0.0.1
|
||||
DB_PORT: 5432
|
||||
DB_DATABASE: amare_test
|
||||
DB_USERNAME: amare
|
||||
DB_PASSWORD: secret
|
||||
QUEUE_CONNECTION: database
|
||||
SESSION_DRIVER: database
|
||||
|
||||
jobs:
|
||||
static:
|
||||
name: static
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
- run: cp .env.example .env
|
||||
|
||||
- uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: "8.4"
|
||||
extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_pgsql, bcmath, intl, sodium, gd
|
||||
coverage: none
|
||||
|
||||
- uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/.composer/cache/files
|
||||
key: composer-${{ runner.os }}-${{ hashFiles('**/composer.lock') }}
|
||||
restore-keys: composer-${{ runner.os }}-
|
||||
|
||||
- run: composer validate --strict
|
||||
- run: composer install --no-interaction --prefer-dist
|
||||
- run: composer pint:check
|
||||
- run: composer phpstan
|
||||
- run: composer audit
|
||||
# audit-level=high: package.json has no runtime `dependencies` today (npm
|
||||
# itself reports prod:1, 0 vulnerabilities), so this is currently a
|
||||
# vacuous forward guard rather than an active protection. `high` is
|
||||
# chosen deliberately over `low`/`moderate` so that once a real runtime
|
||||
# JS dependency is added, the gate flags exploitable issues without
|
||||
# becoming noisy on every transitive dev-only advisory.
|
||||
- run: npm audit --omit=dev --audit-level=high
|
||||
|
||||
unit:
|
||||
name: unit
|
||||
runs-on: ubuntu-latest
|
||||
# Postgres is required here (not just in `feature`) because the
|
||||
# Domain/Application coverage gate below runs the Feature suite too: the
|
||||
# App\Application\Queries\Marketing\* classes are only exercised through
|
||||
# Feature (HTTP) tests today, so a Unit-only coverage run would undercount
|
||||
# them well under the 80% threshold.
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:17
|
||||
env:
|
||||
POSTGRES_DB: amare_test
|
||||
POSTGRES_USER: amare
|
||||
POSTGRES_PASSWORD: secret
|
||||
ports:
|
||||
- 5432:5432
|
||||
options: >-
|
||||
--health-cmd "pg_isready -U amare -d amare_test"
|
||||
--health-interval 5s
|
||||
--health-timeout 5s
|
||||
--health-retries 10
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
- run: cp .env.example .env
|
||||
|
||||
- uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: "8.4"
|
||||
extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_pgsql, bcmath, intl, sodium, gd
|
||||
coverage: pcov
|
||||
|
||||
- uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/.composer/cache/files
|
||||
key: composer-${{ runner.os }}-${{ hashFiles('**/composer.lock') }}
|
||||
restore-keys: composer-${{ runner.os }}-
|
||||
|
||||
- uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: npm-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: npm-${{ runner.os }}-
|
||||
|
||||
- run: composer install --no-interaction --prefer-dist
|
||||
- run: npm ci
|
||||
- run: npm run build
|
||||
- run: composer test:unit
|
||||
- run: php artisan migrate --force
|
||||
# Domain/Application coverage gate (SPEC.md L2351, 80% minimum). Scoped
|
||||
# via phpunit.coverage.xml rather than editing the project-wide
|
||||
# phpunit.xml <source> block, which stays covering all of app/ for
|
||||
# every other test/coverage invocation. app/Domain currently holds only
|
||||
# the DomainModule placeholder (zero executable lines), so in practice
|
||||
# this gates app/Application until Domain gains real logic.
|
||||
- run: composer test:coverage
|
||||
|
||||
feature:
|
||||
name: feature
|
||||
runs-on: ubuntu-latest
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:17
|
||||
env:
|
||||
POSTGRES_DB: amare_test
|
||||
POSTGRES_USER: amare
|
||||
POSTGRES_PASSWORD: secret
|
||||
ports:
|
||||
- 5432:5432
|
||||
options: >-
|
||||
--health-cmd "pg_isready -U amare -d amare_test"
|
||||
--health-interval 5s
|
||||
--health-timeout 5s
|
||||
--health-retries 10
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
- run: cp .env.example .env
|
||||
|
||||
- uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: "8.4"
|
||||
extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_pgsql, bcmath, intl, sodium, gd
|
||||
coverage: none
|
||||
|
||||
- uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/.composer/cache/files
|
||||
key: composer-${{ runner.os }}-${{ hashFiles('**/composer.lock') }}
|
||||
restore-keys: composer-${{ runner.os }}-
|
||||
|
||||
- uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: npm-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: npm-${{ runner.os }}-
|
||||
|
||||
- run: composer install --no-interaction --prefer-dist
|
||||
- run: npm ci
|
||||
- run: npm run build
|
||||
- run: php artisan migrate --force
|
||||
- run: composer test:feature
|
||||
|
||||
browser:
|
||||
name: browser
|
||||
runs-on: ubuntu-latest
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:17
|
||||
env:
|
||||
POSTGRES_DB: amare_test
|
||||
POSTGRES_USER: amare
|
||||
POSTGRES_PASSWORD: secret
|
||||
ports:
|
||||
- 5432:5432
|
||||
options: >-
|
||||
--health-cmd "pg_isready -U amare -d amare_test"
|
||||
--health-interval 5s
|
||||
--health-timeout 5s
|
||||
--health-retries 10
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
- run: cp .env.example .env
|
||||
|
||||
- uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: "8.4"
|
||||
extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, pdo_pgsql, bcmath, intl, sodium, gd
|
||||
coverage: none
|
||||
|
||||
- uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/.composer/cache/files
|
||||
key: composer-${{ runner.os }}-${{ hashFiles('**/composer.lock') }}
|
||||
restore-keys: composer-${{ runner.os }}-
|
||||
|
||||
- uses: actions/cache@v5
|
||||
with:
|
||||
path: ~/.npm
|
||||
key: npm-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
|
||||
restore-keys: npm-${{ runner.os }}-
|
||||
|
||||
- run: composer install --no-interaction --prefer-dist
|
||||
- run: npm ci
|
||||
- run: npm run build
|
||||
- run: npx playwright install chromium --with-deps
|
||||
- run: php artisan migrate --force
|
||||
- run: php artisan storage:link
|
||||
|
||||
- name: Build application image
|
||||
run: docker build -t amare-app:ci .
|
||||
|
||||
- name: Run browser tests against FrankenPHP container
|
||||
run: |
|
||||
docker run -d --name amare-web \
|
||||
-e APP_ENV=testing \
|
||||
-e APP_KEY="${APP_KEY}" \
|
||||
-e APP_URL=http://127.0.0.1:8000 \
|
||||
-e APP_LOCALE=pt_BR \
|
||||
-e APP_FALLBACK_LOCALE=pt_BR \
|
||||
-e APP_TIMEZONE=America/Sao_Paulo \
|
||||
-e DB_CONNECTION=pgsql \
|
||||
-e DB_HOST=host.docker.internal \
|
||||
-e DB_PORT=5432 \
|
||||
-e DB_DATABASE=amare_test \
|
||||
-e DB_USERNAME=amare \
|
||||
-e DB_PASSWORD=secret \
|
||||
-e SESSION_DRIVER=database \
|
||||
-e CACHE_STORE=database \
|
||||
-e QUEUE_CONNECTION=database \
|
||||
--add-host=host.docker.internal:host-gateway \
|
||||
-v "${GITHUB_WORKSPACE}/storage/app/public:/app/storage/app/public" \
|
||||
-p 8000:8000 \
|
||||
amare-app:ci
|
||||
|
||||
for i in $(seq 1 30); do
|
||||
if curl -fsS http://127.0.0.1:8000/up; then
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
|
||||
curl -fsS http://127.0.0.1:8000/up
|
||||
./vendor/bin/pest --testsuite=Browser
|
||||
|
||||
- name: Collect failure diagnostics
|
||||
if: failure()
|
||||
run: |
|
||||
mkdir -p artifacts/browser
|
||||
docker logs amare-web > artifacts/browser/container.log 2>&1 || true
|
||||
cp -R storage/logs artifacts/browser/app-logs 2>/dev/null || true
|
||||
|
||||
- name: Upload browser failure artifacts
|
||||
if: failure()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: browser-failure-artifacts
|
||||
path: artifacts/browser
|
||||
if-no-files-found: ignore
|
||||
|
||||
container:
|
||||
name: container
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
|
||||
- name: Build production image
|
||||
run: docker build -t amare-app:ci .
|
||||
|
||||
- name: Verify container healthcheck and storage link
|
||||
run: |
|
||||
docker run -d --name amare-health \
|
||||
-e APP_ENV=production \
|
||||
-e APP_KEY="${{ env.APP_KEY }}" \
|
||||
-e APP_URL=http://127.0.0.1:8000 \
|
||||
-e APP_DEBUG=false \
|
||||
-e DB_CONNECTION=pgsql \
|
||||
-e DB_HOST=127.0.0.1 \
|
||||
-e DB_PORT=5432 \
|
||||
-e DB_DATABASE=amare \
|
||||
-e DB_USERNAME=amare \
|
||||
-e DB_PASSWORD=secret \
|
||||
-p 8000:8000 \
|
||||
amare-app:ci
|
||||
|
||||
for i in $(seq 1 30); do
|
||||
if curl -fsS http://127.0.0.1:8000/up; then
|
||||
docker exec amare-health test -L /app/public/storage
|
||||
exit 0
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
|
||||
docker logs amare-health
|
||||
exit 1
|
||||
84
.gitea/workflows/deploy-staging.yml
Normal file
84
.gitea/workflows/deploy-staging.yml
Normal file
@@ -0,0 +1,84 @@
|
||||
name: Deploy staging
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: [CI]
|
||||
types: [completed]
|
||||
branches: [main]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
concurrency:
|
||||
group: deploy-staging
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
REGISTRY: git.hellomanoel.com
|
||||
IMAGE_NAME: ${{ gitea.repository }}
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
name: publish-and-deploy-staging
|
||||
if: >-
|
||||
gitea.event.workflow_run.conclusion == 'success' &&
|
||||
gitea.event.workflow_run.event == 'push' &&
|
||||
gitea.event.workflow_run.head_branch == 'main'
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout deployed SHA
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ gitea.event.workflow_run.head_sha }}
|
||||
|
||||
- name: Set image metadata
|
||||
id: meta
|
||||
run: |
|
||||
SHA="${{ gitea.event.workflow_run.head_sha }}"
|
||||
SHORT_SHA="${SHA:0:7}"
|
||||
IMAGE="${REGISTRY}/${IMAGE_NAME}"
|
||||
IMAGE="$(echo "$IMAGE" | tr '[:upper:]' '[:lower:]')"
|
||||
echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
|
||||
echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
|
||||
echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Log in to Gitea registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
# Gitea's GITEA_TOKEN cannot push OCI packages (gitea#23642); a PAT
|
||||
# with read:package/write:package scopes is required instead.
|
||||
username: ${{ secrets.GITEA_REGISTRY_USER }}
|
||||
password: ${{ secrets.GITEA_PAT }}
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Build and push SHA + staging tags
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
tags: |
|
||||
${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.sha }}
|
||||
${{ steps.meta.outputs.image }}:staging
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
|
||||
- name: Deploy staging on Dokploy
|
||||
env:
|
||||
DOKPLOY_URL: ${{ secrets.DOKPLOY_URL }}
|
||||
DOKPLOY_API_KEY: ${{ secrets.DOKPLOY_API_KEY }}
|
||||
DOKPLOY_COMPOSE_ID: ${{ secrets.DOKPLOY_STAGING_COMPOSE_ID }}
|
||||
DEPLOY_TITLE: "staging ${{ steps.meta.outputs.short_sha }}"
|
||||
run: |
|
||||
chmod +x scripts/deploy/dokploy-deploy.sh
|
||||
./scripts/deploy/dokploy-deploy.sh
|
||||
|
||||
- name: Smoke staging
|
||||
env:
|
||||
SMOKE_BASE_URL: ${{ secrets.STAGING_URL }}
|
||||
run: |
|
||||
chmod +x scripts/deploy/smoke.sh
|
||||
./scripts/deploy/smoke.sh
|
||||
86
.gitea/workflows/promote-production.yml
Normal file
86
.gitea/workflows/promote-production.yml
Normal file
@@ -0,0 +1,86 @@
|
||||
name: Promote production
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
sha:
|
||||
description: Full git SHA already published to the Gitea registry (same digest used by staging)
|
||||
required: true
|
||||
type: string
|
||||
confirm:
|
||||
description: Type PRODUCTION to confirm promotion of the given SHA
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
concurrency:
|
||||
group: deploy-production
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
REGISTRY: git.hellomanoel.com
|
||||
IMAGE_NAME: ${{ gitea.repository }}
|
||||
|
||||
jobs:
|
||||
promote:
|
||||
name: promote-production
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Guard confirmation
|
||||
run: |
|
||||
if [ "${{ inputs.confirm }}" != "PRODUCTION" ]; then
|
||||
echo "Confirmation must be exactly PRODUCTION" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Checkout repository scripts
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set image metadata
|
||||
id: meta
|
||||
run: |
|
||||
SHA="${{ inputs.sha }}"
|
||||
SHORT_SHA="${SHA:0:7}"
|
||||
IMAGE="${REGISTRY}/${IMAGE_NAME}"
|
||||
IMAGE="$(echo "$IMAGE" | tr '[:upper:]' '[:lower:]')"
|
||||
echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
|
||||
echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
|
||||
echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Log in to Gitea registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
# Gitea's GITEA_TOKEN cannot push OCI packages (gitea#23642); a PAT
|
||||
# with read:package/write:package scopes is required instead.
|
||||
username: ${{ secrets.GITEA_REGISTRY_USER }}
|
||||
password: ${{ secrets.GITEA_PAT }}
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Point :production at existing SHA digest (no rebuild)
|
||||
run: |
|
||||
docker buildx imagetools create \
|
||||
--tag "${{ steps.meta.outputs.image }}:production" \
|
||||
"${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.sha }}"
|
||||
|
||||
- name: Deploy production on Dokploy
|
||||
env:
|
||||
DOKPLOY_URL: ${{ secrets.DOKPLOY_URL }}
|
||||
DOKPLOY_API_KEY: ${{ secrets.DOKPLOY_API_KEY }}
|
||||
DOKPLOY_COMPOSE_ID: ${{ secrets.DOKPLOY_PRODUCTION_COMPOSE_ID }}
|
||||
DEPLOY_TITLE: "production ${{ steps.meta.outputs.short_sha }}"
|
||||
run: |
|
||||
chmod +x scripts/deploy/dokploy-deploy.sh
|
||||
./scripts/deploy/dokploy-deploy.sh
|
||||
|
||||
- name: Smoke production
|
||||
env:
|
||||
SMOKE_BASE_URL: ${{ secrets.PRODUCTION_URL }}
|
||||
run: |
|
||||
chmod +x scripts/deploy/smoke.sh
|
||||
./scripts/deploy/smoke.sh
|
||||
Reference in New Issue
Block a user