Skip to content

r009 (#61)

r009 (#61) #71

name: hypnos::deploy_prod
on:
push:
branches:
- main
# on:
# pull_request:
# branches:
# - dev
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
REGION: europe-west2
GAR_LOCATION: europe-west2-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/chain-service/
jobs:
build-and-push-image:
name: hypnos::build_and_push::docker_image
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
attestations: write
id-token: write
steps:
- name: hypnos::deploy_prod::docker::Checkout repository
uses: actions/checkout@v4
- name: hypnos::deploy_prod::docker::Log in to the Container registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: hypnos::deploy_prod::docker::Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
- name: hypnos::deploy_prod::docker::Build and push Docker image
id: push
uses: docker/build-push-action@v6
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
build-args: |
API_URL=${{ secrets.API_URL_PROD }}
APPLE_CLIENT_ID=${{ secrets.APPLE_CLIENT_ID_PROD }}
APPLE_CLIENT_SECRET=${{ secrets.APPLE_CLIENT_SECRET_PROD }}
AUTH_SECRET=${{ secrets.AUTH_SECRET_PROD }}
AUTH_TRUST_HOST=${{ secrets.AUTH_TRUST_HOST_PROD }}
AUTH_URL=${{ secrets.AUTH_URL_PROD }}
AUTH_GITHUB_ID=${{ secrets.AUTH_GITHUB_ID_PROD }}
AUTH_GITHUB_SECRET=${{ secrets.AUTH_GITHUB_SECRET_PROD }}
EMAIL_FROM=${{ secrets.EMAIL_FROM_PROD }}
EMAIL_SERVER=${{ secrets.EMAIL_SERVER_PROD }}
FACEBOOK_CLIENT_ID=${{ secrets.FACEBOOK_CLIENT_ID_PROD }}
FACEBOOK_CLIENT_SECRET=${{ secrets.FACEBOOK_CLIENT_SECRET_PROD }}
GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID_PROD }}
GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET_PROD }}
INSTAGRAM_CLIENT_ID=${{ secrets.INSTAGRAM_CLIENT_ID_PROD }}
INSTAGRAM_CLIENT_SECRET=${{ secrets.INSTAGRAM_CLIENT_SECRET_PROD }}
KV_REST_API_READ_ONLY_TOKEN=${{ secrets.KV_REST_API_READ_ONLY_TOKEN_PROD }}
KV_REST_API_TOKEN=${{ secrets.KV_REST_API_TOKEN_PROD }}
KV_REST_API_URL=${{ secrets.KV_REST_API_URL_PROD }}
KV_URL=${{ secrets.KV_URL_PROD }}
MAIN_URL=${{ secrets.MAIN_URL_PROD }}
MONGODB_DATABASE=${{ secrets.MONGODB_DATABASE_PROD }}
MONGODB_DEFAULT_ORG=${{ secrets.MONGODB_DEFAULT_ORG_PROD }}
MONGODB_ORGS_DATABASE=${{ secrets.MONGODB_ORGS_DATABASE_PROD }}
MONGODB_PRIVATE_URI=${{ secrets.MONGODB_PRIVATE_URI_PROD }}
MONGODB_PUBLIC_URI=${{ secrets.MONGODB_PUBLIC_URI_PROD }}
MONGODB_USERS_DATABASE=${{ secrets.MONGODB_USERS_DATABASE_PROD }}
NEXUS_KEEPALIVE=${{ secrets.NEXUS_KEEPALIVE_PROD }}
NEXUS_MODE=${{ secrets.NEXUS_MODE_PROD }}
NEXUS_STANDALONE=true
PRISMA_PRIVATE_URI=${{ secrets.MONGODB_PRIVATE_URI_PROD }}
PRISMA_PUBLIC_URI=${{ secrets.MONGODB_PUBLIC_URI_PROD }}
SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN_PROD }}
SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN_PROD }}
NEXT_PUBLIC_SENTRY_DSN=${{ secrets.NEXT_PUBLIC_SENTRY_DSN_PROD }}
SENTRY_PROJECT=${{ secrets.SENTRY_PROJECT_PROD }}
SENTRY_ORG=${{ secrets.SENTRY_ORG_PROD }}
VERCEL_GIT_COMMIT_SHA=${{ github.sha }}
- name: hypnos::deploy_prod::docker::Generate artifact attestation
uses: actions/attest-build-provenance@v1
with:
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true
deploy-to-gcp-vm:
needs: build-and-push-image
name: hypnos::deploy_prod::push_to_gcp::vm
runs-on: ubuntu-latest
steps:
- name: hypnos::deploy_prod::push_to_gcp::vm::install ssh keys
run: |
install -m 600 -D /dev/null ~/.ssh/id_rsa
echo "${{ secrets.SSH_PRIVATE_KEY_PROD }}" > ~/.ssh/id_rsa
ssh-keyscan -H ${{ secrets.SSH_HOST_PROD }} > ~/.ssh/known_hosts
- name: hypnos::deploy_prod::push_to_gcp::vm::connect and pull
run: ssh ${{ secrets.SSH_USER_PROD }}@${{ secrets.SSH_HOST_PROD }} "docker login ghcr.io -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }} && docker pull ${{ secrets.IMAGE_TAG_PROD }} && docker stop hypnos && docker rm hypnos && docker run -d --name hypnos --restart unless-stopped -p ${{ secrets.IMAGE_PORT_PROD }}:3001 ${{ secrets.IMAGE_TAG_PROD }} && exit"
- name: cleanup
run: rm -rf ~/.ssh