vh
b001d0cb2e
hrafn was handed to infra-ops for uptime ownership with no CI deploy and no commit provenance -- the image was always local/hrafn:v1 and the whole working tree lived in the compose directory. These two files fix both. They are authored here because infra-ops owns hrafn's uptime, but they belong in vh/hrafn; claude-bot is not a collaborator there, so they are handed to the repo holder rather than committed directly. - playbooks-deploy.yaml -> vh/hrafn playbooks/deploy.yaml - gitea-workflows-deploy.yaml -> vh/hrafn .gitea/workflows/deploy.yaml Design calls recorded in the README: the build context travels as one tarball rather than per-file upload steps (nevermore's pattern fails open when a new source file has no matching step), and the playbook refuses to deploy unless .env exists at 0600 -- a guard prompted by it arriving 0644 with a live bearer token in it. Validated with `elway --dry-run`, which caught a real interpolation bug during authoring. No new Actions secrets needed.
88 lines
3.2 KiB
YAML
88 lines
3.2 KiB
YAML
# Gitea Actions workflow for hrafn.
|
|
#
|
|
# Runs on every push to main (and on manual workflow_dispatch). Drives
|
|
# the in-repo elway playbook (playbooks/deploy.yaml) — that file is the
|
|
# single source of truth for "how hrafn is deployed", manual or automated.
|
|
#
|
|
# Replaces the hand-rsync deploy. Two things change as a result:
|
|
# - the image is tagged with the commit SHA rather than a fixed `v1`,
|
|
# so the host can answer "what is running" and a rollback is a retag
|
|
# - only the build context ships (Dockerfile, compose.yaml,
|
|
# pyproject.toml, README.md, src/) instead of the whole working tree,
|
|
# so tests/, docs/, persistent-memory.md and friends stop living in
|
|
# /opt/docker/compose/hrafn on the server
|
|
#
|
|
# Required Actions secrets — both already exist at user scope on vh from
|
|
# the nevermore/task-board wiring, so there is nothing new to provision:
|
|
#
|
|
# DEPLOY_SSH_KEY Private SSH key authorized for lkraven@ana-docker.
|
|
# MGMT_REPO_TOKEN Gitea PAT (read:repository) on vh/esh-pfi-infrastructure.
|
|
# Needed to clone elway from the management repo.
|
|
#
|
|
# NOT handled here: .env. It is host-owned, 0600, holds the bearer token,
|
|
# and is provisioned once from vault item ana-docker/hrafn/bearer-token.
|
|
# The playbook refuses to deploy if it is missing or not 0600.
|
|
|
|
name: Deploy hrafn
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: pfi-fleet
|
|
|
|
steps:
|
|
- name: Install playbook prerequisites
|
|
run: |
|
|
apt-get update -qq
|
|
apt-get install -y --no-install-recommends \
|
|
python3 python3-yaml openssh-client tar
|
|
rm -rf /var/lib/apt/lists/*
|
|
|
|
- name: Checkout hrafn (triggering repo)
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Checkout management repo (for elway)
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: vh/esh-pfi-infrastructure
|
|
token: ${{ secrets.MGMT_REPO_TOKEN }}
|
|
path: _mgmt
|
|
|
|
- name: Configure SSH to ana-docker
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
cat > ~/.ssh/config <<'EOF'
|
|
Host ana-docker
|
|
HostName 10.250.50.70
|
|
User lkraven
|
|
IdentityFile ~/.ssh/id_ed25519
|
|
StrictHostKeyChecking accept-new
|
|
EOF
|
|
chmod 600 ~/.ssh/config
|
|
|
|
- name: Build the deploy context
|
|
# Only what the Dockerfile actually consumes, plus compose.yaml.
|
|
# Deliberately excludes tests/, docs/, persistent-memory.md,
|
|
# ROADMAP.md, CLAUDE.md, LICENSE and .env — none of them belong
|
|
# in a production compose directory.
|
|
run: |
|
|
mkdir -p dist
|
|
tar czf dist/hrafn-context.tgz \
|
|
Dockerfile compose.yaml pyproject.toml README.md src
|
|
echo "context contents:"
|
|
tar tzf dist/hrafn-context.tgz
|
|
|
|
- name: Deploy hrafn (in-repo elway playbook)
|
|
# hrafn_sha becomes the image tag and is written to
|
|
# /opt/docker/compose/hrafn/.deployed on the host.
|
|
run: |
|
|
_mgmt/scripts/elway ana-docker \
|
|
--playbook playbooks/deploy.yaml \
|
|
--var hrafn_sha=${GITHUB_SHA::12}
|