304bbc62ad
Some checks failed
CI / typecheck + vitest (Node 20) (push) Has been cancelled
Keep SSH key material in $RUNNER_TEMP instead of ~/.ssh since a self-hosted runner's home persists across jobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
70 lines
2.6 KiB
YAML
70 lines
2.6 KiB
YAML
name: Deploy mainnet
|
|
|
|
# CD for the vector-marketplace host (91.98.147.172).
|
|
#
|
|
# Trigger: automatically after the "CI" workflow succeeds on main, or manually
|
|
# via workflow_dispatch (Actions tab -> Deploy mainnet -> Run workflow).
|
|
#
|
|
# The runner only SSHes in and executes deploy/mainnet/deploy.sh AT THE NEW
|
|
# COMMIT (fetched server-side via `git show FETCH_HEAD:`), so deploy logic is
|
|
# versioned with the code it deploys. The script itself decides which compose
|
|
# projects to rebuild based on the old..new diff, drains busy suppliers, and
|
|
# health-gates every restart — see deploy/mainnet/deploy.sh.
|
|
#
|
|
# Secrets: DEPLOY_SSH_KEY — ed25519 private key whose public half is in
|
|
# root@vector-marketplace:~/.ssh/authorized_keys.
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ["CI"]
|
|
types: [completed]
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
inputs:
|
|
force:
|
|
description: "Redeploy even if the server is already at origin/main"
|
|
type: boolean
|
|
default: false
|
|
|
|
concurrency:
|
|
group: deploy-mainnet
|
|
cancel-in-progress: false # never kill a deploy mid-rollout
|
|
|
|
env:
|
|
DEPLOY_HOST: 91.98.147.172
|
|
DEPLOY_USER: root
|
|
# Pinned host key (ssh-keyscan -t ed25519 91.98.147.172)
|
|
DEPLOY_HOSTKEY: "91.98.147.172 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJvjM8D+pNUb2Qr4yJbqVcRrUzbpbfyv0/tupUgD5Th0"
|
|
|
|
jobs:
|
|
deploy:
|
|
name: deploy to vector-marketplace
|
|
runs-on: nixos
|
|
# workflow_run fires on failure too — only deploy green main.
|
|
if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
|
|
steps:
|
|
# Self-hosted runner: keep key material in the job's temp dir, not the
|
|
# runner user's ~/.ssh (which persists across jobs).
|
|
- name: Set up SSH
|
|
run: |
|
|
install -m 700 -d "$RUNNER_TEMP/ssh"
|
|
printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > "$RUNNER_TEMP/ssh/id_ed25519"
|
|
chmod 600 "$RUNNER_TEMP/ssh/id_ed25519"
|
|
printf '%s\n' "$DEPLOY_HOSTKEY" > "$RUNNER_TEMP/ssh/known_hosts"
|
|
|
|
- name: Run deploy script on server
|
|
run: |
|
|
FORCE=0
|
|
[ "${{ github.event.inputs.force }}" = "true" ] && FORCE=1
|
|
ssh -o BatchMode=yes \
|
|
-o IdentitiesOnly=yes \
|
|
-i "$RUNNER_TEMP/ssh/id_ed25519" \
|
|
-o UserKnownHostsFile="$RUNNER_TEMP/ssh/known_hosts" \
|
|
"$DEPLOY_USER@$DEPLOY_HOST" "
|
|
set -euo pipefail
|
|
cd /root/agents-marketplace
|
|
git fetch origin main
|
|
git show FETCH_HEAD:deploy/mainnet/deploy.sh > /run/marketplace-deploy.sh
|
|
FORCE=$FORCE bash /run/marketplace-deploy.sh
|
|
"
|