mirror of
https://github.com/Memo-2023/mana-monorepo.git
synced 2026-05-15 01:21:09 +02:00
8e8b6ac65f
This commit bundles two unrelated changes that were swept together by an
accidental `git add -A` in another working session. Documented here so the
history reflects what's actually inside.
═══════════════════════════════════════════════════════════════════════
1. fix(mana-auth): /api/v1/auth/login mints JWT via auth.handler instead
of api.signInEmail
═══════════════════════════════════════════════════════════════════════
Previous attempt (commit 55cc75e7d) tried to fix the broken JWT mint in
/api/v1/auth/login by switching the cookie name from `mana.session_token`
to `__Secure-mana.session_token` for production. That was necessary but
not sufficient: Better Auth's session cookie value isn't just the raw
session token, it's `<token>.<HMAC>` where the HMAC is derived from the
better-auth secret. Reconstructing the cookie from auth.api.signInEmail's
JSON response only gave us the raw token, so /api/auth/token's
get-session middleware still couldn't validate it and the JWT mint kept
silently failing.
Real fix: do the sign-in via auth.handler (the HTTP path) rather than
auth.api.signInEmail (the SDK path). The handler returns a real fetch
Response with a Set-Cookie header containing the fully signed cookie
envelope. We capture that header verbatim and forward it as the cookie
on the /api/auth/token request, which now passes validation and mints
the JWT correctly.
Verified end-to-end on auth.mana.how:
$ curl -X POST https://auth.mana.how/api/v1/auth/login \
-d '{"email":"...","password":"..."}'
{
"user": {...},
"token": "<session token>",
"accessToken": "eyJhbGciOiJFZERTQSI...", ← real JWT now
"refreshToken": "<session token>"
}
Side benefits:
- Email-not-verified path is now handled by checking
signInResponse.status === 403 directly, no more catching APIError
with the comment-noted async-stream footgun.
- X-Forwarded-For is forwarded explicitly so Better Auth's rate limiter
and our security log see the real client IP.
- The leftover catch block now only handles unexpected exceptions
(network errors etc); the FORBIDDEN-checking logic in it is dead but
harmless and left in for defense in depth.
═══════════════════════════════════════════════════════════════════════
2. chore: remove the entire self-hosted Matrix stack (Synapse, Element,
Manalink, mana-matrix-bot)
═══════════════════════════════════════════════════════════════════════
The Matrix subsystem ran parallel to the main Mana product without any
load-bearing integration: the unified web app never imported matrix-js-sdk,
the chat module uses mana-sync (local-first), and mana-matrix-bot's
plugins duplicated features the unified app already ships natively.
Keeping it alive cost a Synapse + Element + matrix-web + bot container
quartet, three Cloudflare routes, an OIDC provider plugin in mana-auth,
and a steady drip of devlog/dependency churn.
Removed:
- apps/matrix (Manalink web + mobile, ~150 files)
- services/mana-matrix-bot (Go bot with ~20 plugins)
- docker/matrix configs (Synapse + Element)
- synapse/element-web/matrix-web/mana-matrix-bot services in
docker-compose.macmini.yml
- matrix.mana.how/element.mana.how/link.mana.how Cloudflare tunnel routes
- OIDC provider plugin + matrix-synapse trustedClient + matrixUserLinks
table from mana-auth (oauth_* schema definitions also removed)
- MatrixService import path in mana-media (importFromMatrix endpoint)
- Matrix notification channel in mana-notify (worker, metrics, config,
channel_type enum, MatrixOptions handler)
- Matrix entries from shared-branding (mana-apps + app-icons),
notify-client, the i18n bundle, the observatory map, the credits
app-label list, the landing footer/apps page, the prometheus + alerts
+ promtail tier mappings, and the matrix-related deploy paths in
cd-macmini.yml + ci.yml
Devlog/manascore/blueprint entries that mention Matrix are left intact
as historical record. The oauth_* + matrix_user_links Postgres tables
stay on existing prod databases — code can no longer write to them, drop
them in a follow-up migration if you want them gone for real.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
556 lines
25 KiB
YAML
556 lines
25 KiB
YAML
# CD Pipeline: Auto-deploy to Mac Mini on push to main
|
|
#
|
|
# Requires a self-hosted GitHub Actions runner on the Mac Mini.
|
|
# Setup: see docs/MAC_MINI_RUNNER_SETUP.md
|
|
#
|
|
# Flow:
|
|
# Push → main : Detects changed services → rebuilds & restarts only those containers
|
|
#
|
|
# The runner executes directly on the Mac Mini, so it has access to
|
|
# Docker, docker-compose, and the local project directory.
|
|
|
|
name: CD Mac Mini
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
inputs:
|
|
service:
|
|
description: 'Service to deploy (or "all" for everything)'
|
|
required: false
|
|
default: 'all'
|
|
type: choice
|
|
options:
|
|
- all
|
|
- mana-auth
|
|
- mana-sync
|
|
- mana-media
|
|
- mana-notify
|
|
- mana-api-gateway
|
|
- mana-crawler
|
|
- mana-credits
|
|
- mana-search
|
|
- chat-backend
|
|
- chat-web
|
|
- todo-backend
|
|
- todo-web
|
|
- calendar-backend
|
|
- calendar-web
|
|
- clock-web
|
|
- contacts-backend
|
|
- contacts-web
|
|
- music-backend
|
|
- music-web
|
|
- storage-backend
|
|
- storage-web
|
|
- memoro-server
|
|
- memoro-audio-server
|
|
- memoro-web
|
|
|
|
concurrency:
|
|
group: cd-macmini
|
|
cancel-in-progress: false # Don't cancel in-progress deploys
|
|
|
|
env:
|
|
PROJECT_DIR: /Users/mana/projects/mana-monorepo
|
|
COMPOSE_FILE: docker-compose.macmini.yml
|
|
ENV_FILE: .env.macmini
|
|
DOCKER_BUILDKIT: 1
|
|
PATH: /usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin
|
|
|
|
jobs:
|
|
# ===========================================
|
|
# Detect what changed
|
|
# ===========================================
|
|
detect-changes:
|
|
name: Detect Changes
|
|
runs-on: self-hosted
|
|
if: github.event_name == 'push'
|
|
outputs:
|
|
mana-auth: ${{ steps.changes.outputs.mana-auth }}
|
|
mana-sync: ${{ steps.changes.outputs.mana-sync }}
|
|
mana-media: ${{ steps.changes.outputs.mana-media }}
|
|
mana-notify: ${{ steps.changes.outputs.mana-notify }}
|
|
mana-api-gateway: ${{ steps.changes.outputs.mana-api-gateway }}
|
|
mana-crawler: ${{ steps.changes.outputs.mana-crawler }}
|
|
mana-credits: ${{ steps.changes.outputs.mana-credits }}
|
|
mana-search: ${{ steps.changes.outputs.mana-search }}
|
|
chat-backend: ${{ steps.changes.outputs.chat-backend }}
|
|
chat-web: ${{ steps.changes.outputs.chat-web }}
|
|
todo-backend: ${{ steps.changes.outputs.todo-backend }}
|
|
todo-web: ${{ steps.changes.outputs.todo-web }}
|
|
calendar-backend: ${{ steps.changes.outputs.calendar-backend }}
|
|
calendar-web: ${{ steps.changes.outputs.calendar-web }}
|
|
clock-web: ${{ steps.changes.outputs.clock-web }}
|
|
contacts-backend: ${{ steps.changes.outputs.contacts-backend }}
|
|
contacts-web: ${{ steps.changes.outputs.contacts-web }}
|
|
music-backend: ${{ steps.changes.outputs.music-backend }}
|
|
music-web: ${{ steps.changes.outputs.music-web }}
|
|
storage-backend: ${{ steps.changes.outputs.storage-backend }}
|
|
storage-web: ${{ steps.changes.outputs.storage-web }}
|
|
memoro-server: ${{ steps.changes.outputs.memoro-server }}
|
|
memoro-audio-server: ${{ steps.changes.outputs.memoro-audio-server }}
|
|
memoro-web: ${{ steps.changes.outputs.memoro-web }}
|
|
any-changes: ${{ steps.changes.outputs.any-changes }}
|
|
steps:
|
|
- name: Check for changes
|
|
id: changes
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
|
|
# Get changed files between previous and current commit
|
|
CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || echo "")
|
|
|
|
# Shared packages trigger rebuilds for all services that use them
|
|
SHARED_CHANGED="false"
|
|
if echo "$CHANGED" | grep -qE "^packages/(shared-ui|shared-theme|shared-icons|shared-tailwind|shared-auth|shared-branding|shared-i18n|shared-utils|shared-types)/"; then
|
|
SHARED_CHANGED="true"
|
|
fi
|
|
|
|
check_changes() {
|
|
local name=$1
|
|
shift
|
|
local result="false"
|
|
for path in "$@"; do
|
|
if echo "$CHANGED" | grep -q "^$path"; then
|
|
result="true"
|
|
break
|
|
fi
|
|
done
|
|
# Shared package changes trigger rebuild
|
|
if [ "$SHARED_CHANGED" == "true" ]; then
|
|
result="true"
|
|
fi
|
|
echo "$name=$result" >> $GITHUB_OUTPUT
|
|
echo " $name: $result"
|
|
}
|
|
|
|
echo "Changed files:"
|
|
echo "$CHANGED" | head -20
|
|
echo ""
|
|
echo "Shared packages changed: $SHARED_CHANGED"
|
|
echo ""
|
|
|
|
check_changes "mana-auth" "services/mana-auth/"
|
|
check_changes "mana-sync" "services/mana-sync/" "packages/shared-go/"
|
|
check_changes "mana-media" "services/mana-media/"
|
|
check_changes "mana-notify" "services/mana-notify/" "packages/shared-go/"
|
|
check_changes "mana-api-gateway" "services/mana-api-gateway/" "packages/shared-go/"
|
|
check_changes "mana-crawler" "services/mana-crawler/" "packages/shared-go/"
|
|
check_changes "mana-credits" "services/mana-credits/"
|
|
check_changes "mana-search" "services/mana-search/" "packages/shared-go/"
|
|
check_changes "chat-backend" "apps/chat/apps/backend/" "apps/chat/packages/"
|
|
check_changes "chat-web" "apps/chat/apps/web/" "apps/chat/packages/"
|
|
check_changes "todo-backend" "apps/todo/apps/backend/" "apps/todo/packages/"
|
|
check_changes "todo-web" "apps/todo/apps/web/" "apps/todo/packages/"
|
|
check_changes "calendar-backend" "apps/calendar/apps/backend/" "apps/calendar/packages/"
|
|
check_changes "calendar-web" "apps/calendar/apps/web/" "apps/calendar/packages/"
|
|
# clock-backend: REMOVED — migrated to local-first
|
|
check_changes "clock-web" "apps/clock/apps/web/" "apps/clock/packages/"
|
|
check_changes "contacts-backend" "apps/contacts/apps/backend/" "apps/contacts/packages/"
|
|
check_changes "contacts-web" "apps/contacts/apps/web/" "apps/contacts/packages/"
|
|
check_changes "music-backend" "apps/mukke/apps/backend/" "apps/mukke/packages/"
|
|
check_changes "music-web" "apps/mukke/apps/web/" "apps/mukke/packages/"
|
|
check_changes "storage-backend" "apps/storage/apps/backend/" "apps/storage/packages/"
|
|
check_changes "storage-web" "apps/storage/apps/web/" "apps/storage/packages/"
|
|
check_changes "memoro-server" "apps/memoro/apps/server/" "apps/memoro/packages/"
|
|
check_changes "memoro-audio-server" "apps/memoro/apps/audio-server/"
|
|
check_changes "memoro-web" "apps/memoro/apps/web/" "apps/memoro/packages/"
|
|
check_changes "mana-landing-builder" "services/mana-landing-builder/" "packages/shared-types/" "packages/shared-landing-ui/"
|
|
|
|
# Check if anything needs deploying
|
|
ANY="false"
|
|
for svc in mana-auth mana-sync mana-media mana-notify mana-api-gateway mana-crawler mana-credits mana-search chat-backend chat-web todo-backend todo-web calendar-backend calendar-web clock-web contacts-backend contacts-web music-backend music-web storage-backend storage-web memoro-server memoro-audio-server memoro-web mana-landing-builder; do
|
|
val=$(grep "^$svc=" $GITHUB_OUTPUT | tail -1 | cut -d= -f2)
|
|
if [ "$val" == "true" ]; then
|
|
ANY="true"
|
|
break
|
|
fi
|
|
done
|
|
echo "any-changes=$ANY" >> $GITHUB_OUTPUT
|
|
|
|
# ===========================================
|
|
# Deploy changed services
|
|
# ===========================================
|
|
deploy:
|
|
name: Deploy
|
|
runs-on: self-hosted
|
|
needs: [detect-changes]
|
|
if: |
|
|
always() &&
|
|
(needs.detect-changes.result == 'success' && needs.detect-changes.outputs.any-changes == 'true') ||
|
|
github.event_name == 'workflow_dispatch'
|
|
steps:
|
|
- name: Pull latest code
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
git pull origin main
|
|
|
|
- name: Init deploy tracking
|
|
id: init
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
source scripts/deploy-metrics.sh
|
|
deploy_timer_start
|
|
echo "start_epoch=$DEPLOY_START_EPOCH" >> $GITHUB_OUTPUT
|
|
ensure_deploy_schema
|
|
|
|
- name: Ensure env vars exist
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
# Add CALENDAR_ENCRYPTION_KEY if not present
|
|
if ! grep -q "CALENDAR_ENCRYPTION_KEY" "${{ env.ENV_FILE }}" 2>/dev/null; then
|
|
echo "CALENDAR_ENCRYPTION_KEY=$(openssl rand -base64 32)" >> "${{ env.ENV_FILE }}"
|
|
echo "Added CALENDAR_ENCRYPTION_KEY to ${{ env.ENV_FILE }}"
|
|
fi
|
|
|
|
- name: Determine services to deploy
|
|
id: services
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
SERVICES=""
|
|
|
|
if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
|
|
INPUT="${{ inputs.service }}"
|
|
if [ "$INPUT" == "all" ]; then
|
|
echo "Manual deploy: all services"
|
|
echo "deploy-all=true" >> $GITHUB_OUTPUT
|
|
exit 0
|
|
else
|
|
SERVICES="$INPUT"
|
|
fi
|
|
else
|
|
# Build list from detected changes
|
|
if [ "${{ needs.detect-changes.outputs.mana-auth }}" == "true" ]; then SERVICES="$SERVICES mana-auth"; fi
|
|
if [ "${{ needs.detect-changes.outputs.mana-sync }}" == "true" ]; then SERVICES="$SERVICES mana-sync"; fi
|
|
if [ "${{ needs.detect-changes.outputs.mana-media }}" == "true" ]; then SERVICES="$SERVICES mana-media"; fi
|
|
if [ "${{ needs.detect-changes.outputs.mana-notify }}" == "true" ]; then SERVICES="$SERVICES mana-notify"; fi
|
|
if [ "${{ needs.detect-changes.outputs.mana-api-gateway }}" == "true" ]; then SERVICES="$SERVICES mana-api-gateway"; fi
|
|
if [ "${{ needs.detect-changes.outputs.mana-crawler }}" == "true" ]; then SERVICES="$SERVICES mana-crawler"; fi
|
|
if [ "${{ needs.detect-changes.outputs.mana-credits }}" == "true" ]; then SERVICES="$SERVICES mana-credits"; fi
|
|
if [ "${{ needs.detect-changes.outputs.mana-search }}" == "true" ]; then SERVICES="$SERVICES mana-search"; fi
|
|
if [ "${{ needs.detect-changes.outputs.chat-backend }}" == "true" ]; then SERVICES="$SERVICES chat-backend"; fi
|
|
if [ "${{ needs.detect-changes.outputs.chat-web }}" == "true" ]; then SERVICES="$SERVICES chat-web"; fi
|
|
if [ "${{ needs.detect-changes.outputs.todo-backend }}" == "true" ]; then SERVICES="$SERVICES todo-backend"; fi
|
|
if [ "${{ needs.detect-changes.outputs.todo-web }}" == "true" ]; then SERVICES="$SERVICES todo-web"; fi
|
|
if [ "${{ needs.detect-changes.outputs.calendar-backend }}" == "true" ]; then SERVICES="$SERVICES calendar-backend"; fi
|
|
if [ "${{ needs.detect-changes.outputs.calendar-web }}" == "true" ]; then SERVICES="$SERVICES calendar-web"; fi
|
|
# clock-backend: REMOVED
|
|
if [ "${{ needs.detect-changes.outputs.clock-web }}" == "true" ]; then SERVICES="$SERVICES clock-web"; fi
|
|
if [ "${{ needs.detect-changes.outputs.contacts-backend }}" == "true" ]; then SERVICES="$SERVICES contacts-backend"; fi
|
|
if [ "${{ needs.detect-changes.outputs.contacts-web }}" == "true" ]; then SERVICES="$SERVICES contacts-web"; fi
|
|
if [ "${{ needs.detect-changes.outputs.music-backend }}" == "true" ]; then SERVICES="$SERVICES music-backend"; fi
|
|
if [ "${{ needs.detect-changes.outputs.music-web }}" == "true" ]; then SERVICES="$SERVICES music-web"; fi
|
|
if [ "${{ needs.detect-changes.outputs.storage-backend }}" == "true" ]; then SERVICES="$SERVICES storage-backend"; fi
|
|
if [ "${{ needs.detect-changes.outputs.storage-web }}" == "true" ]; then SERVICES="$SERVICES storage-web"; fi
|
|
if [ "${{ needs.detect-changes.outputs.memoro-server }}" == "true" ]; then SERVICES="$SERVICES memoro-server"; fi
|
|
if [ "${{ needs.detect-changes.outputs.memoro-audio-server }}" == "true" ]; then SERVICES="$SERVICES memoro-audio-server"; fi
|
|
if [ "${{ needs.detect-changes.outputs.memoro-web }}" == "true" ]; then SERVICES="$SERVICES memoro-web"; fi
|
|
if [ "${{ needs.detect-changes.outputs.mana-landing-builder }}" == "true" ]; then SERVICES="$SERVICES mana-landing-builder"; fi
|
|
fi
|
|
|
|
echo "services=$SERVICES" >> $GITHUB_OUTPUT
|
|
echo "deploy-all=false" >> $GITHUB_OUTPUT
|
|
echo "Services to deploy: $SERVICES"
|
|
|
|
- name: Build shared base image
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
SERVICES="${{ steps.services.outputs.services }}"
|
|
DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
|
|
|
|
NEEDS_WEB_BASE=false
|
|
if [ "$DEPLOY_ALL" == "true" ]; then
|
|
NEEDS_WEB_BASE=true
|
|
else
|
|
for svc in $SERVICES; do
|
|
case "$svc" in *-web) NEEDS_WEB_BASE=true; break ;; esac
|
|
done
|
|
fi
|
|
|
|
if [ "$NEEDS_WEB_BASE" == "true" ]; then
|
|
echo "=== Building shared SvelteKit base image ==="
|
|
docker build -f docker/Dockerfile.sveltekit-base -t sveltekit-base:local . 2>&1 | tail -5
|
|
echo "SvelteKit base image built"
|
|
else
|
|
echo "No web apps to deploy, skipping SvelteKit base image"
|
|
fi
|
|
|
|
- name: Build and deploy services
|
|
id: build
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
source scripts/deploy-metrics.sh
|
|
|
|
DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
|
|
SERVICES="${{ steps.services.outputs.services }}"
|
|
|
|
# Determine final service list
|
|
if [ "$DEPLOY_ALL" == "true" ]; then
|
|
# Get all service names from compose file
|
|
SERVICES=$(docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" config --services | tr '\n' ' ')
|
|
echo "=== Rebuilding ALL services ==="
|
|
elif [ -z "$SERVICES" ]; then
|
|
echo "No services to deploy"
|
|
echo "build-times=" >> $GITHUB_OUTPUT
|
|
exit 0
|
|
else
|
|
echo "=== Rebuilding: $SERVICES ==="
|
|
fi
|
|
|
|
# Build each service individually to capture build times
|
|
BUILD_TIMES=""
|
|
for svc in $SERVICES; do
|
|
echo "--- Building $svc ---"
|
|
build_start=$(date +%s)
|
|
docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" build "$svc" 2>&1 || true
|
|
build_end=$(date +%s)
|
|
build_dur=$(( build_end - build_start ))
|
|
BUILD_TIMES="$BUILD_TIMES $svc:$build_dur"
|
|
echo " $svc built in ${build_dur}s"
|
|
done
|
|
|
|
# Start all services at once (no rebuild, images already built)
|
|
echo "=== Starting services ==="
|
|
if [ "$DEPLOY_ALL" == "true" ]; then
|
|
docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d
|
|
else
|
|
docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" up -d --no-deps $SERVICES
|
|
fi
|
|
echo "=== Waiting for services to start ==="
|
|
sleep 10
|
|
|
|
echo "build-times=$BUILD_TIMES" >> $GITHUB_OUTPUT
|
|
|
|
- name: Health checks
|
|
id: health
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
source scripts/deploy-metrics.sh
|
|
|
|
# Service -> health URL mapping
|
|
health_url_for() {
|
|
case "$1" in
|
|
mana-auth) echo "http://localhost:3001/health" ;;
|
|
chat-backend) echo "http://localhost:3030/health" ;;
|
|
chat-web) echo "http://localhost:5010/health" ;;
|
|
todo-backend) echo "http://localhost:3031/health" ;;
|
|
todo-web) echo "http://localhost:5011/health" ;;
|
|
calendar-backend) echo "http://localhost:3032/health" ;;
|
|
calendar-web) echo "http://localhost:5012/health" ;;
|
|
# clock-backend: REMOVED
|
|
clock-web) echo "http://localhost:5013/health" ;;
|
|
contacts-backend) echo "http://localhost:3034/health" ;;
|
|
contacts-web) echo "http://localhost:5014/health" ;;
|
|
music-backend) echo "http://localhost:3010/health" ;;
|
|
music-web) echo "http://localhost:5180/health" ;;
|
|
storage-backend) echo "http://localhost:3035/api/v1/health" ;;
|
|
storage-web) echo "http://localhost:5015/health" ;;
|
|
memoro-server) echo "http://localhost:3015/health" ;;
|
|
memoro-audio-server) echo "http://localhost:3016/health" ;;
|
|
memoro-web) echo "http://localhost:5038/health" ;;
|
|
*) echo "" ;;
|
|
esac
|
|
}
|
|
|
|
# Only check services that were actually deployed
|
|
DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
|
|
SERVICES="${{ steps.services.outputs.services }}"
|
|
|
|
if [ "$DEPLOY_ALL" == "true" ]; then
|
|
SERVICES="mana-auth chat-backend chat-web todo-backend todo-web calendar-backend calendar-web clock-web contacts-backend contacts-web music-backend music-web storage-backend storage-web memoro-server memoro-audio-server memoro-web"
|
|
fi
|
|
|
|
HEALTH_RESULTS=""
|
|
echo "=== Health Checks ==="
|
|
|
|
for svc in $SERVICES; do
|
|
url=$(health_url_for "$svc")
|
|
if [ -z "$url" ]; then
|
|
echo " - $svc: no health endpoint configured"
|
|
HEALTH_RESULTS="$HEALTH_RESULTS $svc:skipped:0:0"
|
|
continue
|
|
fi
|
|
|
|
result=$(check_health_timed "$svc" "$url" 2>/dev/null) || true
|
|
status=$(echo "$result" | awk '{print $1}')
|
|
elapsed=$(echo "$result" | awk '{print $2}')
|
|
http_code=$(echo "$result" | awk '{print $3}')
|
|
|
|
if [ -z "$status" ]; then
|
|
status="skipped"
|
|
elapsed="0"
|
|
http_code="0"
|
|
fi
|
|
|
|
if [ "$status" = "ok" ]; then
|
|
echo " ✓ $svc: OK (${elapsed}s)"
|
|
else
|
|
echo " ✗ $svc: $status (HTTP $http_code, ${elapsed}s)"
|
|
fi
|
|
|
|
HEALTH_RESULTS="$HEALTH_RESULTS $svc:$status:$http_code:$elapsed"
|
|
done
|
|
|
|
echo "health-results=$HEALTH_RESULTS" >> $GITHUB_OUTPUT
|
|
|
|
- name: Record deploy metrics
|
|
if: always()
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
source scripts/deploy-metrics.sh
|
|
|
|
START_EPOCH="${{ steps.init.outputs.start_epoch }}"
|
|
NOW=$(date +%s)
|
|
DURATION=$(( NOW - START_EPOCH ))
|
|
|
|
# Determine overall status
|
|
STATUS="success"
|
|
if [ "${{ job.status }}" != "success" ]; then
|
|
STATUS="failure"
|
|
fi
|
|
|
|
# Determine services list
|
|
DEPLOY_ALL="${{ steps.services.outputs.deploy-all }}"
|
|
SERVICES="${{ steps.services.outputs.services }}"
|
|
if [ "$DEPLOY_ALL" == "true" ]; then
|
|
SERVICES_CSV="all"
|
|
else
|
|
SERVICES_CSV=$(echo "$SERVICES" | tr ' ' ',')
|
|
fi
|
|
|
|
COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null | head -c 200 || echo "unknown")
|
|
BRANCH="${{ github.ref_name }}"
|
|
|
|
# Insert deployment row
|
|
DEPLOY_ID=$(insert_deployment \
|
|
"${{ github.run_id }}" \
|
|
"${{ github.run_attempt }}" \
|
|
"${{ github.sha }}" \
|
|
"$COMMIT_MSG" \
|
|
"$BRANCH" \
|
|
"${{ github.event_name }}" \
|
|
"${{ github.actor }}" \
|
|
"$SERVICES_CSV" \
|
|
"$STATUS" 2>/dev/null) || DEPLOY_ID=""
|
|
|
|
if [ -n "$DEPLOY_ID" ]; then
|
|
# Finalise with duration
|
|
finalise_deployment "$DEPLOY_ID" "$STATUS" "$DURATION" 2>/dev/null || true
|
|
|
|
# Helper: lookup value from "key:val key2:val2" string
|
|
# Usage: lookup "key" "key:val key2:val2" [field_index] (default: 2nd field)
|
|
lookup() {
|
|
local needle="$1" haystack="$2" field="${3:-2}"
|
|
for item in $haystack; do
|
|
if [ "${item%%:*}" = "$needle" ]; then
|
|
echo "$item" | cut -d: -f"$field"
|
|
return
|
|
fi
|
|
done
|
|
echo ""
|
|
}
|
|
|
|
BUILD_TIMES="${{ steps.build.outputs.build-times }}"
|
|
HEALTH_RESULTS="${{ steps.health.outputs.health-results }}"
|
|
|
|
# Collect unique service names from both build and health data
|
|
ALL_SVCS=$(echo "$BUILD_TIMES $HEALTH_RESULTS" | tr ' ' '\n' | cut -d: -f1 | sort -u | tr '\n' ' ')
|
|
for svc in $ALL_SVCS; do
|
|
[ -z "$svc" ] && continue
|
|
build_dur=$(lookup "$svc" "$BUILD_TIMES" 2)
|
|
build_dur="${build_dur:-0}"
|
|
img_mb=$(get_image_size_mb "$svc" 2>/dev/null || echo "0")
|
|
startup=$(lookup "$svc" "$HEALTH_RESULTS" 4)
|
|
startup="${startup:-0}"
|
|
health=$(lookup "$svc" "$HEALTH_RESULTS" 2)
|
|
health="${health:-skipped}"
|
|
http_code=$(lookup "$svc" "$HEALTH_RESULTS" 3)
|
|
http_code="${http_code:-0}"
|
|
|
|
insert_deploy_service "$DEPLOY_ID" "$svc" "$build_dur" "$img_mb" "$startup" "$health" "$http_code" 2>/dev/null || true
|
|
push_service_metrics "$svc" "$build_dur" "$img_mb" "$health" 2>/dev/null || true
|
|
done
|
|
fi
|
|
|
|
# Push overall metrics to Pushgateway
|
|
push_deploy_metrics "$STATUS" "$DURATION" "$BRANCH" 2>/dev/null || true
|
|
echo "Deploy tracking recorded: status=$STATUS duration=${DURATION}s"
|
|
|
|
- name: Notify on failure
|
|
if: failure()
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
SERVICES="${{ steps.services.outputs.services }}"
|
|
[ "${{ steps.services.outputs.deploy-all }}" == "true" ] && SERVICES="all"
|
|
COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null | head -c 100)
|
|
RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
|
|
|
|
MSG="⚠️ Deploy failed: ${SERVICES} (commit ${COMMIT_MSG} by ${{ github.actor }}) — ${RUN_URL}"
|
|
echo "$MSG"
|
|
|
|
- name: Cleanup old images
|
|
if: always()
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
echo "=== Pruning dangling images ==="
|
|
docker image prune -f 2>/dev/null || true
|
|
echo "=== Pruning unused images older than 7 days ==="
|
|
docker image prune -a -f --filter "until=168h" 2>/dev/null || true
|
|
|
|
- name: Summary
|
|
if: always()
|
|
run: |
|
|
cd "${{ env.PROJECT_DIR }}"
|
|
|
|
START_EPOCH="${{ steps.init.outputs.start_epoch }}"
|
|
NOW=$(date +%s)
|
|
DURATION=$(( NOW - START_EPOCH ))
|
|
|
|
echo "## Deployment Summary" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "**Trigger:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
|
|
echo "**Commit:** \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY
|
|
echo "**Duration:** ${DURATION}s" >> $GITHUB_STEP_SUMMARY
|
|
echo "**Status:** ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
|
|
if [ "${{ steps.services.outputs.deploy-all }}" == "true" ]; then
|
|
echo "**Services:** All" >> $GITHUB_STEP_SUMMARY
|
|
else
|
|
echo "**Services:** ${{ steps.services.outputs.services }}" >> $GITHUB_STEP_SUMMARY
|
|
fi
|
|
|
|
# Build times table
|
|
BUILD_TIMES="${{ steps.build.outputs.build-times }}"
|
|
if [ -n "$BUILD_TIMES" ]; then
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "### Build Times" >> $GITHUB_STEP_SUMMARY
|
|
echo "| Service | Duration |" >> $GITHUB_STEP_SUMMARY
|
|
echo "|---------|----------|" >> $GITHUB_STEP_SUMMARY
|
|
for entry in $BUILD_TIMES; do
|
|
svc="${entry%%:*}"
|
|
dur="${entry#*:}"
|
|
echo "| $svc | ${dur}s |" >> $GITHUB_STEP_SUMMARY
|
|
done
|
|
fi
|
|
|
|
# Health results table
|
|
HEALTH_RESULTS="${{ steps.health.outputs.health-results }}"
|
|
if [ -n "$HEALTH_RESULTS" ]; then
|
|
echo "" >> $GITHUB_STEP_SUMMARY
|
|
echo "### Health Checks" >> $GITHUB_STEP_SUMMARY
|
|
echo "| Service | Status | HTTP | Startup |" >> $GITHUB_STEP_SUMMARY
|
|
echo "|---------|--------|------|---------|" >> $GITHUB_STEP_SUMMARY
|
|
for entry in $HEALTH_RESULTS; do
|
|
svc=$(echo "$entry" | cut -d: -f1)
|
|
h_status=$(echo "$entry" | cut -d: -f2)
|
|
h_code=$(echo "$entry" | cut -d: -f3)
|
|
h_time=$(echo "$entry" | cut -d: -f4)
|
|
icon="✓"
|
|
[ "$h_status" != "ok" ] && icon="✗"
|
|
echo "| $svc | $icon $h_status | $h_code | ${h_time}s |" >> $GITHUB_STEP_SUMMARY
|
|
done
|
|
fi
|