rakazo/.github/workflows/ci.yml at main · NodeOps-app/rakazo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
name: ci
on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint

  check:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm db:generate
        env:
          DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
      - run: pnpm check

  build:
    name: Production builds
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v5
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build
        env:
          DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
          BETTER_AUTH_SECRET: ci-build-auth-secret-at-least-32-characters
          ENCRYPTION_KEY: ci-build-encryption-key-at-least-32-characters
      - name: Electron smoke
        run: xvfb-run --auto-servernum pnpm --filter @rakazo/desktop exec playwright test --config e2e/playwright.config.ts

  test:
    name: Unit tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm db:generate
        env:
          DATABASE_URL: postgres://rakazo:rakazo@127.0.0.1:5433/rakazo
      - run: pnpm test

  test-integration:
    name: Postgres journeys
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v5
      - uses: pnpm/action-setup@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm test:integration

  test-e2e:
    name: Web E2E
    uses: ./.github/workflows/playwright.yml
    with:
      upload_artifacts: true

  deploy-production:
    if: >-
      github.event_name == 'push' &&
      github.ref == 'refs/heads/main' &&
      vars.PRODUCTION_DEPLOY_ENABLED == 'true'
    needs: [lint, check, build, test, test-integration, test-e2e]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency:
      group: production
      cancel-in-progress: false
    environment:
      name: production
      url: https://app.rakazo.com
    steps:
      - name: Configure production SSH identity
        env:
          SSH_PRIVATE_KEY: ${{ secrets.PRODUCTION_SSH_PRIVATE_KEY }}
          SSH_KNOWN_HOSTS: ${{ secrets.PRODUCTION_SSH_KNOWN_HOSTS }}
        run: |
          test -n "$SSH_PRIVATE_KEY"
          test -n "$SSH_KNOWN_HOSTS"
          install -d -m 700 "$HOME/.ssh"
          printf '%s\n' "$SSH_PRIVATE_KEY" > "$HOME/.ssh/rakazo-production"
          printf '%s\n' "$SSH_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
          chmod 600 "$HOME/.ssh/rakazo-production" "$HOME/.ssh/known_hosts"
          ssh-keygen -y -f "$HOME/.ssh/rakazo-production" >/dev/null

      - name: Deploy successful main revision
        env:
          SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
          SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
        run: |
          test -n "$SSH_HOST"
          test -n "$SSH_USER"
          ssh -F /dev/null \
            -i "$HOME/.ssh/rakazo-production" \
            -o BatchMode=yes \
            -o ConnectTimeout=15 \
            -o IdentitiesOnly=yes \
            -o StrictHostKeyChecking=yes \
            -o UserKnownHostsFile="$HOME/.ssh/known_hosts" \
            "$SSH_USER@$SSH_HOST" deploy-main