101 lines
4.3 KiB
YAML
101 lines
4.3 KiB
YAML
name: Verify Frame Flow
|
|
on:
|
|
push:
|
|
# Branch verification gates releases; tags do not duplicate the same build.
|
|
branches: ["**"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
deploy_action:
|
|
description: Production action (deploy requires explicit enabled Variable)
|
|
type: choice
|
|
options: [plan, bootstrap, deploy, rollback]
|
|
default: plan
|
|
jobs:
|
|
verify:
|
|
# The NAS Docker runner must never execute code from external forks.
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
DOCKER_PIP_INDEX_URL: ${{ vars.DOCKER_PIP_INDEX_URL }}
|
|
DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
|
|
CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
|
|
CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
|
|
DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
|
|
DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: '3.14'
|
|
- name: Install CI dependencies with index diagnostics and fallback
|
|
run: python scripts/ci-install.py
|
|
- run: python -m ruff check pigway_frame_flow tests scripts
|
|
- run: python -m ruff format --check pigway_frame_flow tests scripts
|
|
- run: python -m mypy pigway_frame_flow
|
|
- run: python -m pytest -q
|
|
- name: Complete vulnerability audit with bounded network retries
|
|
run: python scripts/ci-audit.py
|
|
- name: Isolated Docker build, smoke and restart verification
|
|
run: |
|
|
. ./deploy/build-cn.env
|
|
python scripts/ci-compose-verify.py
|
|
- name: Cleanup isolated Docker resources
|
|
if: always()
|
|
run: |
|
|
if [ -n "${FRAME_FLOW_CI_COMPOSE:-}" ] && [ -f "$FRAME_FLOW_CI_COMPOSE" ]; then
|
|
python scripts/ci-compose-verify.py --cleanup
|
|
fi
|
|
|
|
deploy:
|
|
needs: verify
|
|
if: success() && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
|
|
runs-on: ubuntu-latest
|
|
concurrency:
|
|
group: frame-flow-production
|
|
cancel-in-progress: false
|
|
env:
|
|
CD_ACTION: ${{ github.event.inputs.deploy_action }}
|
|
PROD_DEPLOY_ENABLED: ${{ vars.PROD_DEPLOY_ENABLED }}
|
|
PROD_PROJECT: ${{ vars.PROD_PROJECT }}
|
|
PROD_CONTAINER: ${{ vars.PROD_CONTAINER }}
|
|
PROD_IMAGE_REPO: ${{ vars.PROD_IMAGE_REPO }}
|
|
PROD_DATA_DIR: ${{ secrets.PROD_DATA_DIR }}
|
|
PROD_CONFIG_DIR: ${{ secrets.PROD_CONFIG_DIR }}
|
|
PROD_PHOTOS_DIR: ${{ secrets.PROD_PHOTOS_DIR }}
|
|
SYNOLOGY_PHOTOS_URL: ${{ secrets.SYNOLOGY_PHOTOS_URL }}
|
|
SYNOLOGY_PHOTOS_CERT_SHA256: ${{ secrets.SYNOLOGY_PHOTOS_CERT_SHA256 }}
|
|
PROD_WEB_BIND: ${{ secrets.PROD_WEB_BIND }}
|
|
PROD_WEB_PORT: ${{ vars.PROD_WEB_PORT }}
|
|
FRAME_FLOW_STORAGE_NAME: ${{ vars.FRAME_FLOW_STORAGE_NAME }}
|
|
PROD_STATE_VOLUME: ${{ vars.PROD_STATE_VOLUME }}
|
|
PROD_MOCK: ${{ vars.PROD_MOCK }}
|
|
PROD_WRITE_ENABLED: ${{ vars.PROD_WRITE_ENABLED }}
|
|
DOCKER_PIP_INDEX_URL: ${{ vars.DOCKER_PIP_INDEX_URL }}
|
|
DOCKER_PIP_FALLBACK_INDEX_URL: ${{ vars.DOCKER_PIP_FALLBACK_INDEX_URL }}
|
|
CI_PIP_INDEX_URL: ${{ vars.CI_PIP_INDEX_URL }}
|
|
CI_PIP_FALLBACK_INDEX_URL: ${{ vars.CI_PIP_FALLBACK_INDEX_URL }}
|
|
DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
|
|
DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: '3.14'
|
|
- name: Install deploy tooling
|
|
run: python scripts/ci-install.py
|
|
- name: Plan or deploy production (default is plan)
|
|
env:
|
|
PRODUCTION_ENV: ${{ secrets.PRODUCTION_ENV }}
|
|
run: |
|
|
. ./deploy/build-cn.env
|
|
python scripts/production-deploy.py
|
|
- name: Recover interrupted production deployment
|
|
if: always()
|
|
env:
|
|
CD_ACTION: recover
|
|
run: |
|
|
if [ -n "${FRAME_FLOW_DEPLOY_OWNER:-}" ]; then
|
|
python scripts/production-deploy.py
|
|
fi
|