36cb742ce7
Three things, one subject: making CI say the truth about this repo.
## The red on every run was ours, not the runners'
Every docker-build run came back success, success, failure — the same
shape for weeks. The failing job was `deploy`, and it was failing to
*not run*:
if: ${{ github.event.inputs.deploy == 'true' }}
On a push there is no github.event.inputs at all. This Forgejo does not
treat that as false and skip; it dispatches the job, the runner cannot
resolve it, and the task ends in "Early termination". The runners were
never at fault, and nothing about them needed changing.
The `'runs-on' key not defined` line is a red herring: the `build` job
prints it too and succeeds. It names the job's *needs* target, not the
job, and the old android-apk workflow used `needs:` happily for months.
Deploy is now its own workflow with only workflow_dispatch — no
condition to evaluate, so nothing can be dispatched by mistake. No job
in either file now carries a job-level `if`. The one conditional left is
a *step* (push to registry), and step conditions are evaluated by the
runner once the job is already running, which is why that one has always
worked.
## dev and main
docker-build now runs on `dev` as well. Both branches prove the same two
things — tests pass, image builds — and only `main` publishes the image,
so nothing on `dev` can be mistaken for something deployable. Deploying
stays a person pressing a button after looking at the change.
CONTRIBUTING.md documents the flow.
## Android
Removed: the mobile/ Capacitor project, docs/mobile-build.md, and the
Android bits of scripts/release.sh. All of it is in git history — 4613a278
is the last commit that had it — for when it is rebuilt.
src/utils/platform.js stays. isMobileClient only decides token lifetime,
it is twelve lines, and it is the contract a future app would come back
to; deleting it would be a change to auth for no gain.
.github/workflows/ went too — all five. There is no GitHub remote on
this repository, so none of them has ever run, and two of them wrote
into mobile/ paths that no longer exist.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
55 lines
2.3 KiB
YAML
55 lines
2.3 KiB
YAML
name: Deploy
|
|
|
|
# Its own workflow, and workflow_dispatch only — there is no push trigger, so
|
|
# there is nothing to skip. Deploying used to be a job inside the build
|
|
# workflow behind `if: github.event.inputs.deploy == 'true'`. On a push there
|
|
# is no github.event.inputs at all; this Forgejo dispatched the job regardless,
|
|
# the runner could not resolve it, and it reported "Early termination". Every
|
|
# run of that workflow showed a failure for a job that was never meant to run.
|
|
#
|
|
# A separate file also matches what deploying is: a deliberate act, taken after
|
|
# someone has looked at the change, not a consequence of pushing.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
revision:
|
|
description: Full commit SHA to deploy. Leave blank for the branch tip.
|
|
required: false
|
|
default: ''
|
|
|
|
jobs:
|
|
deploy:
|
|
name: Deploy to the host
|
|
runs-on: forgejo-local
|
|
env:
|
|
DEPLOY_DIR: ${{ vars.DEPLOY_DIR || '/home/danvics/docker/ped-ai' }}
|
|
steps:
|
|
# The deploy directory is also a working tree. This refuses rather than
|
|
# resetting over someone's uncommitted work.
|
|
- name: Refuse to deploy over uncommitted work
|
|
run: |
|
|
if [ -n "$(git -C "$DEPLOY_DIR" status --porcelain)" ]; then
|
|
echo "$DEPLOY_DIR has uncommitted changes; commit or stash them first." >&2
|
|
git -C "$DEPLOY_DIR" status --short >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Detaches HEAD at the deployed revision, which is what a deployed tree
|
|
# should be. If DEPLOY_DIR is also where you write code, point this at a
|
|
# checkout of its own instead — vars.DEPLOY_DIR.
|
|
- name: Move the deploy checkout to this revision
|
|
run: |
|
|
REVISION="${{ github.event.inputs.revision }}"
|
|
[ -n "$REVISION" ] || REVISION="${{ github.sha }}"
|
|
echo "REVISION=$REVISION" >> "$GITHUB_ENV"
|
|
git -C "$DEPLOY_DIR" fetch --quiet --all
|
|
git -C "$DEPLOY_DIR" checkout --quiet --detach "$REVISION"
|
|
|
|
# deploy.sh pins the image, waits for health, asks /api/build what is
|
|
# actually running, and rolls back if it disagrees. Schema migrations are
|
|
# applied by the container's own entrypoint before the app starts.
|
|
- name: Deploy and verify
|
|
run: |
|
|
IMAGE="git.danvics.com/danvics/pediatric-ai-scribe-v3"
|
|
"$DEPLOY_DIR/scripts/deploy.sh" "$IMAGE:$REVISION" "$REVISION"
|