thepraandClaude Opus 5.5
a097338121
Builds used to download the Tailwind binary and the daisyUI plugins from GitHub releases. They are now committed in tools/tailwind/: - the Tailwind 4.3.3 standalone binary for linux-x64, xz -9e compressed (28 MB); - daisyui.mjs and daisyui-theme.mjs 5.7.47; - daisyUI's llms.txt component reference; - Tailwind's MIT license. tools/tailwind.sh no longer touches the network. "prepare" checks every file against its pinned sha256 and unpacks the binary into .tools/. MSBuild reruns it only when the archive or the script changes. A build from scratch was checked inside a network namespace with no network at all. .gitattributes keeps the vendored files byte-exact, and Tailwind no longer scans tools/, whose llms.txt names every daisyUI class. Both workflows used actions/checkout, which a Gitea runner downloads from github.com. They now git fetch the commit from this Gitea, as they already did for SocialPub. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw
80 lines
3.3 KiB
YAML
80 lines
3.3 KiB
YAML
name: Deploy
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
env:
|
|
WEB_ROOT: /var/www/decepub.thepra.dev
|
|
BACKUPS: /var/backups/decepub.thepra.dev
|
|
PUBLIC_URL: https://decepub.thepra.dev
|
|
|
|
jobs:
|
|
site:
|
|
name: decepub.thepra.dev
|
|
runs-on: build
|
|
steps:
|
|
# A plain fetch from this Gitea rather than actions/checkout, which the runner would download from github.com.
|
|
- name: Check out this commit
|
|
env:
|
|
READ_TOKEN: ${{ secrets.THEPRA_READ_TOKEN }}
|
|
run: |
|
|
rm -rf decePubClient
|
|
git init -q decePubClient
|
|
git -C decePubClient -c http.extraHeader="Authorization: token $READ_TOKEN" fetch -q --depth 1 \
|
|
"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY.git" "$GITHUB_SHA"
|
|
git -C decePubClient checkout -q FETCH_HEAD
|
|
|
|
- name: Fetch PrivaPub's client models beside it
|
|
env:
|
|
READ_TOKEN: ${{ secrets.THEPRA_READ_TOKEN }}
|
|
run: |
|
|
rm -rf SocialPub
|
|
git -c http.extraHeader="Authorization: token $READ_TOKEN" clone -q --depth 1 \
|
|
https://git.thepra.dev/thepra/SocialPub.git SocialPub
|
|
|
|
- name: Resolve the build identity
|
|
run: |
|
|
echo "BUILD_COMMIT=$(echo "$GITHUB_SHA" | cut -c1-8)" >> "$GITHUB_ENV"
|
|
echo "BUILD_REF=${GITHUB_REF_NAME:-master}" >> "$GITHUB_ENV"
|
|
echo "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
|
|
|
|
- name: Publish
|
|
run: |
|
|
rm -rf "$GITHUB_WORKSPACE/publish"
|
|
dotnet publish decePubClient/decePubClient.csproj -c Release -o "$GITHUB_WORKSPACE/publish"
|
|
printf '{"commit":"%s","buildRef":"%s","builtAt":"%s"}\n' "$BUILD_COMMIT" "$BUILD_REF" "$BUILD_TIME" \
|
|
> "$GITHUB_WORKSPACE/publish/wwwroot/build.json"
|
|
|
|
- name: Assert the publish actually produced a site
|
|
run: |
|
|
W="$GITHUB_WORKSPACE/publish/wwwroot"
|
|
for f in index.html appsettings.json build.json _framework/blazor.webassembly.js css/app.css css/app.css.gz js/theme.js; do
|
|
[ -e "$W/$f" ] || { echo "::error::publish output is missing $f"; exit 1; }
|
|
done
|
|
ls "$W/_framework" | grep -q '\.wasm$' || { echo "::error::no .wasm in _framework"; exit 1; }
|
|
echo "publish OK, $(du -sh "$W" | cut -f1)"
|
|
|
|
- name: Snapshot the live directory
|
|
run: |
|
|
STAMP=$(date +%Y%m%d-%H%M%S)
|
|
rsync -a "$WEB_ROOT/" "$BACKUPS/site-$STAMP/"
|
|
echo "SNAPSHOT=$BACKUPS/site-$STAMP" >> "$GITHUB_ENV"
|
|
ls -1dt "$BACKUPS"/site-* 2>/dev/null | tail -n +4 | xargs -r rm -rf || true
|
|
|
|
- name: Sync
|
|
run: rsync -a --delete "$GITHUB_WORKSPACE/publish/wwwroot/" "$WEB_ROOT/"
|
|
|
|
- name: Verify what is being served, roll back on failure
|
|
run: |
|
|
served=$(curl -fsS "$PUBLIC_URL/build.json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('commit',''))" || true)
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' "$PUBLIC_URL/some/client/route")
|
|
if [ "$served" != "$BUILD_COMMIT" ] || [ "$code" != "200" ]; then
|
|
echo "::error::served build '$served' (expected '$BUILD_COMMIT'), fallback route answered $code - rolling back"
|
|
rsync -a --delete "$SNAPSHOT/" "$WEB_ROOT/"
|
|
exit 1
|
|
fi
|
|
echo "::notice::serving $served"
|