Deploy active PushPlus relay #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy active PushPlus relay | |
| on: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: pushplus-sms-to-telegram-deploy | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | |
| CALLBACK_TOKEN: ${{ secrets.CALLBACK_TOKEN }} | |
| RELAY_TOKEN: ${{ secrets.RELAY_TOKEN }} | |
| FORWARDED_KV_NAMESPACE_ID: ${{ secrets.FORWARDED_KV_NAMESPACE_ID }} | |
| INBOX_TOKEN: ${{ secrets.INBOX_TOKEN }} | |
| TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }} | |
| TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }} | |
| STATE_SECRET: ${{ secrets.STATE_SECRET }} | |
| PUSHPLUS_TOKEN: ${{ secrets.PUSHPLUS_TOKEN }} | |
| PUSHPLUS_SECRET_KEY: ${{ secrets.PUSHPLUS_SECRET_KEY }} | |
| PUSHPLUS_WEBHOOK_URL: https://pushplus-sms-to-telegram.pages.dev/pushplus/webhook/${{ secrets.RELAY_TOKEN }} | |
| PUSHPLUS_WEBHOOK_BASE_URL: ${{ vars.PUSHPLUS_WEBHOOK_BASE_URL || '' }} | |
| PUSHPLUS_SET_USER_DEFAULT: ${{ vars.PUSHPLUS_SET_USER_DEFAULT || 'true' }} | |
| SMS_INTERCEPT_PRESETS: ${{ vars.SMS_INTERCEPT_PRESETS || '' }} | |
| SMS_INTERCEPT_RULES: ${{ vars.SMS_INTERCEPT_RULES || '' }} | |
| TELECOM_SMS_SENDER: ${{ vars.TELECOM_SMS_SENDER || '' }} | |
| TELECOM_SUCCESS_SMS_SENDER: ${{ vars.TELECOM_SUCCESS_SMS_SENDER || '10000' }} | |
| TELECOM_CONFIRM_PRODUCT_KEYWORD: ${{ vars.TELECOM_CONFIRM_PRODUCT_KEYWORD || '' }} | |
| TELECOM_CONFIRM_PLAN_ID: ${{ vars.TELECOM_CONFIRM_PLAN_ID || '' }} | |
| PUSHPLUS_RECOVERY_ENABLED: ${{ vars.PUSHPLUS_RECOVERY_ENABLED || '' }} | |
| PUSHPLUS_RECOVERY_NOT_BEFORE: ${{ vars.PUSHPLUS_RECOVERY_NOT_BEFORE || '' }} | |
| PUSHPLUS_RECOVERY_LOOKBACK_HOURS: ${{ vars.PUSHPLUS_RECOVERY_LOOKBACK_HOURS || '' }} | |
| PUSHPLUS_RECOVERY_MIN_AGE_MINUTES: ${{ vars.PUSHPLUS_RECOVERY_MIN_AGE_MINUTES || '' }} | |
| PUSHPLUS_RECOVERY_PAGE_SIZE: ${{ vars.PUSHPLUS_RECOVERY_PAGE_SIZE || '' }} | |
| PUSHPLUS_RECOVERY_MAX_PAGES: ${{ vars.PUSHPLUS_RECOVERY_MAX_PAGES || '' }} | |
| PUSHPLUS_RECOVERY_MAX_MESSAGES: ${{ vars.PUSHPLUS_RECOVERY_MAX_MESSAGES || '' }} | |
| PUSHPLUS_RECOVERY_TITLE_KEYWORD: ${{ vars.PUSHPLUS_RECOVERY_TITLE_KEYWORD || '' }} | |
| PUSHPLUS_RECOVERY_ALERT_ENABLED: ${{ vars.PUSHPLUS_RECOVERY_ALERT_ENABLED || '' }} | |
| PUSHPLUS_CLEANUP_ENABLED: ${{ vars.PUSHPLUS_CLEANUP_ENABLED || '' }} | |
| PUSHPLUS_CLEANUP_RETENTION_DAYS: ${{ vars.PUSHPLUS_CLEANUP_RETENTION_DAYS || '' }} | |
| PUSHPLUS_CLEANUP_PAGE_SIZE: ${{ vars.PUSHPLUS_CLEANUP_PAGE_SIZE || '' }} | |
| PUSHPLUS_CLEANUP_MAX_PAGES: ${{ vars.PUSHPLUS_CLEANUP_MAX_PAGES || '' }} | |
| PUSHPLUS_CLEANUP_MAX_DELETES: ${{ vars.PUSHPLUS_CLEANUP_MAX_DELETES || '' }} | |
| PUSHPLUS_CLEANUP_TITLE_KEYWORD: ${{ vars.PUSHPLUS_CLEANUP_TITLE_KEYWORD || '' }} | |
| PUSHPLUS_CLEANUP_REQUIRE_FORWARDED: ${{ vars.PUSHPLUS_CLEANUP_REQUIRE_FORWARDED || '' }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm test | |
| - run: npm run lint | |
| - name: Deploy Worker | |
| run: | | |
| set -euo pipefail | |
| test -n "$FORWARDED_KV_NAMESPACE_ID" | |
| cp wrangler.example.toml wrangler.toml | |
| python3 - <<'PY' | |
| import os | |
| import json | |
| from pathlib import Path | |
| path = Path('wrangler.toml') | |
| text = path.read_text() | |
| text = text.replace('replace-with-your-kv-namespace-id', os.environ['FORWARDED_KV_NAMESPACE_ID']) | |
| optional_vars = [ | |
| 'SMS_INTERCEPT_PRESETS', | |
| 'SMS_INTERCEPT_RULES', | |
| 'TELECOM_SMS_SENDER', | |
| 'TELECOM_SUCCESS_SMS_SENDER', | |
| 'TELECOM_CONFIRM_PRODUCT_KEYWORD', | |
| 'TELECOM_CONFIRM_PLAN_ID', | |
| 'PUSHPLUS_RECOVERY_ENABLED', | |
| 'PUSHPLUS_RECOVERY_NOT_BEFORE', | |
| 'PUSHPLUS_RECOVERY_LOOKBACK_HOURS', | |
| 'PUSHPLUS_RECOVERY_MIN_AGE_MINUTES', | |
| 'PUSHPLUS_RECOVERY_PAGE_SIZE', | |
| 'PUSHPLUS_RECOVERY_MAX_PAGES', | |
| 'PUSHPLUS_RECOVERY_MAX_MESSAGES', | |
| 'PUSHPLUS_RECOVERY_TITLE_KEYWORD', | |
| 'PUSHPLUS_RECOVERY_ALERT_ENABLED', | |
| 'PUSHPLUS_CLEANUP_ENABLED', | |
| 'PUSHPLUS_CLEANUP_RETENTION_DAYS', | |
| 'PUSHPLUS_CLEANUP_PAGE_SIZE', | |
| 'PUSHPLUS_CLEANUP_MAX_PAGES', | |
| 'PUSHPLUS_CLEANUP_MAX_DELETES', | |
| 'PUSHPLUS_CLEANUP_TITLE_KEYWORD', | |
| 'PUSHPLUS_CLEANUP_REQUIRE_FORWARDED', | |
| ] | |
| extra_vars = ''.join( | |
| f'{name} = {json.dumps(os.environ[name], ensure_ascii=False)}\n' | |
| for name in optional_vars | |
| if os.environ.get(name) | |
| ) | |
| if extra_vars: | |
| text = text.replace('[vars]\n', f'[vars]\n{extra_vars}', 1) | |
| path.write_text(text) | |
| PY | |
| printf '%s' "$CALLBACK_TOKEN" | npx wrangler secret put CALLBACK_TOKEN | |
| if [ -n "${INBOX_TOKEN:-}" ]; then | |
| printf '%s' "$INBOX_TOKEN" | npx wrangler secret put INBOX_TOKEN | |
| fi | |
| if [ -n "${TELEGRAM_BOT_TOKEN:-}" ]; then | |
| printf '%s' "$TELEGRAM_BOT_TOKEN" | npx wrangler secret put TELEGRAM_BOT_TOKEN | |
| fi | |
| if [ -n "${TELEGRAM_CHAT_ID:-}" ]; then | |
| printf '%s' "$TELEGRAM_CHAT_ID" | npx wrangler secret put TELEGRAM_CHAT_ID | |
| fi | |
| if [ -n "${STATE_SECRET:-}" ]; then | |
| printf '%s' "$STATE_SECRET" | npx wrangler secret put STATE_SECRET | |
| fi | |
| if [ -n "${PUSHPLUS_TOKEN:-}" ]; then | |
| printf '%s' "$PUSHPLUS_TOKEN" | npx wrangler secret put PUSHPLUS_TOKEN | |
| fi | |
| if [ -n "${PUSHPLUS_SECRET_KEY:-}" ]; then | |
| printf '%s' "$PUSHPLUS_SECRET_KEY" | npx wrangler secret put PUSHPLUS_SECRET_KEY | |
| fi | |
| npx wrangler deploy | |
| if [ -n "${INBOX_TOKEN:-}" ]; then | |
| lease_id="deploy-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" | |
| lease_url="https://pushplus-sms-to-telegram.pigbibi.workers.dev/intercepts/leases/telecom-claim-silent/${lease_id}" | |
| release_lease() { | |
| curl -fsS --connect-timeout 8 --max-time 20 \ | |
| -X DELETE \ | |
| -H "Authorization: Bearer $INBOX_TOKEN" \ | |
| "$lease_url" >/dev/null || true | |
| } | |
| trap release_lease EXIT | |
| curl -fsS --connect-timeout 8 --max-time 20 \ | |
| --retry 8 --retry-delay 2 --retry-all-errors \ | |
| -X PUT \ | |
| -H "Authorization: Bearer $INBOX_TOKEN" \ | |
| -H 'Content-Type: application/json' \ | |
| --data '{"ttlSeconds":60}' \ | |
| "$lease_url" >/dev/null | |
| release_lease | |
| trap - EXIT | |
| echo "Intercept lease smoke test passed." | |
| fi | |
| - name: Deploy Pages relay | |
| run: | | |
| set -euo pipefail | |
| npx wrangler pages project create pushplus-sms-to-telegram --production-branch main --compatibility-date 2026-05-31 || true | |
| cd pages-relay | |
| printf '%s' "$RELAY_TOKEN" | npx wrangler pages secret put RELAY_TOKEN --project-name pushplus-sms-to-telegram | |
| npx wrangler pages deploy dist --project-name pushplus-sms-to-telegram --branch main --commit-dirty=true | |
| - name: Configure PushPlus webhook | |
| run: | | |
| set -euo pipefail | |
| if [ -n "${PUSHPLUS_WEBHOOK_BASE_URL:-}" ]; then | |
| case "$PUSHPLUS_WEBHOOK_BASE_URL" in | |
| https://*) ;; | |
| *) echo "PUSHPLUS_WEBHOOK_BASE_URL must use HTTPS" >&2; exit 1 ;; | |
| esac | |
| export PUSHPLUS_WEBHOOK_URL="${PUSHPLUS_WEBHOOK_BASE_URL%/}/${RELAY_TOKEN}" | |
| fi | |
| npm run configure:pushplus |