Add opt-in production CD with daemon lock, verified rollback and safe planning

2026-10-07 23:15:31 +08:00
parent f7e65de0a2
commit 2e8251abef
5 changed files with 1061 additions and 1 deletions
@@ -1,5 +1,14 @@
 name: Verify Frame Flow
-on: [push, pull_request, workflow_dispatch]
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      deploy_action:
+        description: Production action (deploy requires explicit enabled Variable)
+        type: choice
+        options: [plan, deploy, rollback]
+        default: plan
 jobs:
  verify:
    runs-on: ubuntu-latest
@@ -30,3 +39,50 @@ jobs:
          if [ -n "${FRAME_FLOW_CI_COMPOSE:-}" ] && [ -f "$FRAME_FLOW_CI_COMPOSE" ]; then
            python scripts/ci-compose-verify.py --cleanup
          fi
+
+  deploy:
+    needs: verify
+    if: success() && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    concurrency:
+      group: frame-flow-production
+      cancel-in-progress: false
+    env:
+      CD_ACTION: ${{ github.event.inputs.deploy_action }}
+      PROD_DEPLOY_ENABLED: ${{ vars.PROD_DEPLOY_ENABLED }}
+      PROD_PROJECT: ${{ vars.PROD_PROJECT }}
+      PROD_CONTAINER: ${{ vars.PROD_CONTAINER }}
+      PROD_IMAGE_REPO: ${{ vars.PROD_IMAGE_REPO }}
+      PROD_DATA_DIR: ${{ vars.PROD_DATA_DIR }}
+      PROD_CONFIG_DIR: ${{ vars.PROD_CONFIG_DIR }}
+      PROD_PHOTOS_DIR: ${{ vars.PROD_PHOTOS_DIR }}
+      PROD_WEB_BIND: ${{ vars.PROD_WEB_BIND }}
+      PROD_WEB_PORT: ${{ vars.PROD_WEB_PORT }}
+      PROD_STATE_VOLUME: ${{ vars.PROD_STATE_VOLUME }}
+      PROD_MOCK: ${{ vars.PROD_MOCK }}
+      PROD_WRITE_ENABLED: ${{ vars.PROD_WRITE_ENABLED }}
+      CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
+      CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
+      DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
+      DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.14'
+      - name: Install deploy tooling
+        run: python scripts/ci-install.py
+      - name: Plan or deploy production (default is plan)
+        env:
+          PRODUCTION_ENV: ${{ secrets.PRODUCTION_ENV }}
+        run: |
+          . ./deploy/build-cn.env
+          python scripts/production-deploy.py
+      - name: Recover interrupted production deployment
+        if: always()
+        env:
+          CD_ACTION: recover
+        run: |
+          if [ -n "${FRAME_FLOW_DEPLOY_OWNER:-}" ]; then
+            python scripts/production-deploy.py
+          fi