ci: build publish and deploy container image

2026-07-28 00:27:37 +03:00
parent 7dc5a1f7f2
commit ee4a1e288d
4 changed files with 127 additions and 29 deletions
--- a/.github/workflows/delivery.yml
+++ b/.github/workflows/delivery.yml
@@ -0,0 +1,99 @@
+name: delivery
+
+on:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+
+concurrency:
+  group: production-delivery
+  cancel-in-progress: false
+
+env:
+  REGISTRY: git.kandrusyak.ru
+  IMAGE: git.kandrusyak.ru/admin/kandrusyak-bot
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements-common.txt -r requirements-dev.txt
+      - name: Lint
+        run: python -m ruff check .
+      - name: Test with coverage
+        run: |
+          python -m coverage run -m unittest discover -v
+          python -m coverage report
+
+  build-and-push:
+    needs: quality
+    runs-on: docker-build
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Log in to the container registry
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          test -n "$REGISTRY_TOKEN"
+          printf '%s' "$REGISTRY_TOKEN" |
+            docker login "$REGISTRY" --username admin --password-stdin
+      - name: Build the cloud image
+        run: |
+          docker build \
+            --target yandex \
+            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
+            --label "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
+            --tag "$IMAGE:$GITHUB_SHA" \
+            --tag "$IMAGE:latest" \
+            .
+      - name: Push immutable and latest tags
+        run: |
+          docker push "$IMAGE:$GITHUB_SHA"
+          docker push "$IMAGE:latest"
+      - name: Log out from the container registry
+        if: ${{ always() }}
+        run: docker logout "$REGISTRY" || true
+
+  deploy:
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Configure the deployment key
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
+        run: |
+          install -d -m 700 "$HOME/.ssh"
+          printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
+          printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          chmod 600 "$HOME/.ssh/deploy_key" "$HOME/.ssh/known_hosts"
+      - name: Deploy the published commit
+        run: |
+          ssh \
+            -i "$HOME/.ssh/deploy_key" \
+            -o IdentitiesOnly=yes \
+            -o BatchMode=yes \
+            -o StrictHostKeyChecking=yes \
+            -p 22 \
+            kandrusyak-bot@hole.kandrusyak.ru \
+            "deploy $GITHUB_SHA"
+      - name: Remove the deployment key
+        if: ${{ always() }}
+        run: rm -f "$HOME/.ssh/deploy_key"