willow/.github/workflows/deploy.yml at main · intendednull/willow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: Deploy

on:
  push:
    branches: [main]

env:
  CARGO_TERM_COLOR: always

permissions:
  contents: read

jobs:
  ci:
    name: CI
    uses: ./.github/workflows/ci.yml

  deploy:
    name: Deploy
    needs: ci
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install Rust
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          targets: wasm32-unknown-unknown

      - name: Cache cargo
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: deploy-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: deploy-

      - name: Install trunk
        uses: taiki-e/install-action@50b4a718b59c718df4ef27a3b445f86cd57b9f00 # v2.79.3 trunk
        with:
          tool: trunk@0.21.14

      - name: Install sshpass
        run: sudo apt-get update && sudo apt-get install -y sshpass

      - name: Build relay server
        run: cargo build --release -p willow-relay

      - name: Build web app
        run: cd crates/web && trunk build --release

      - name: Upload relay binary
        run: >
          sshpass -p '${{ secrets.DEPLOY_PASSWORD }}'
          scp -o StrictHostKeyChecking=no
          target/release/willow-relay
          root@willow.intendednull.com:/usr/local/bin/willow-relay

      - name: Upload web app
        run: >
          sshpass -p '${{ secrets.DEPLOY_PASSWORD }}'
          scp -o StrictHostKeyChecking=no -r
          crates/web/dist/*
          root@willow.intendednull.com:/var/www/willow/

      - name: Fix permissions and restart relay
        run: >
          sshpass -p '${{ secrets.DEPLOY_PASSWORD }}'
          ssh -o StrictHostKeyChecking=no
          root@willow.intendednull.com
          'chmod 644 /var/www/willow/* && systemctl restart willow-relay'

      - name: Verify deployment
        run: |
          # Poll the web endpoint until it serves (max ~30s) instead of a
          # blind 3s sleep — avoids flaking when the relay takes longer to
          # bind and masking a silent deploy failure.
          for i in $(seq 1 15); do
            if curl -sf -o /dev/null -w "Web: HTTP %{http_code}\n" https://willow.intendednull.com/; then
              break
            fi
            if [ "$i" -eq 15 ]; then
              echo "verify: HTTP probe never succeeded after 15 attempts (~30s)" >&2
              exit 1
            fi
            sleep 2
          done
          sshpass -p '${{ secrets.DEPLOY_PASSWORD }}' ssh -o StrictHostKeyChecking=no root@willow.intendednull.com 'systemctl is-active willow-relay'