ci: migrate image registry to GHCR (drop :5000 insecure-registry steps) #85
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: backend-ci-cd | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: "21" | |
| - name: Setup Gradle | |
| uses: gradle/actions/setup-gradle@v3 | |
| - name: Ensure Gradle wrapper executable | |
| run: | | |
| sed -i 's/\r$//' gradlew | |
| chmod +x gradlew | |
| - name: Run tests | |
| run: ./gradlew test | |
| build-push: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| if: ${{ github.event_name != 'pull_request' }} | |
| env: | |
| REGISTRY_IMAGE: ${{ secrets.REGISTRY_IMAGE }} | |
| REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} | |
| REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Resolve registry host | |
| run: | | |
| if [ -z "${REGISTRY_IMAGE}" ]; then | |
| echo "REGISTRY_IMAGE is required" | |
| exit 1 | |
| fi | |
| echo "REGISTRY_HOST=${REGISTRY_IMAGE%%/*}" >> $GITHUB_ENV | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY_HOST }} | |
| username: ${{ env.REGISTRY_USERNAME }} | |
| password: ${{ env.REGISTRY_PASSWORD }} | |
| - name: Build and push | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| push: true | |
| platforms: linux/arm64 | |
| tags: | | |
| ${{ env.REGISTRY_IMAGE }}:latest | |
| ${{ env.REGISTRY_IMAGE }}:${{ github.sha }} | |
| deploy: | |
| runs-on: ubuntu-latest | |
| needs: build-push | |
| if: ${{ github.event_name != 'pull_request' }} | |
| env: | |
| DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} | |
| REGISTRY_IMAGE: ${{ secrets.REGISTRY_IMAGE }} | |
| REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} | |
| REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} | |
| steps: | |
| - name: Deploy via SSH | |
| if: ${{ env.DEPLOY_HOST != '' }} | |
| uses: appleboy/ssh-action@v1.0.3 | |
| with: | |
| host: ${{ env.DEPLOY_HOST }} | |
| username: ${{ secrets.DEPLOY_USER }} | |
| key: ${{ secrets.DEPLOY_KEY }} | |
| envs: REGISTRY_IMAGE,REGISTRY_USERNAME,REGISTRY_PASSWORD | |
| script: | | |
| set -e | |
| REGISTRY_HOST="${REGISTRY_IMAGE%%/*}" | |
| if [ -n "${REGISTRY_USERNAME}" ] && [ -n "${REGISTRY_PASSWORD}" ]; then | |
| echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY_HOST}" -u "${REGISTRY_USERNAME}" --password-stdin | |
| fi | |
| cd /apps/algorithm-blog | |
| docker compose --env-file .env pull algorithm-blog | |
| docker compose --env-file .env up -d --no-deps algorithm-blog | |
| docker image prune -f |