95b814b751
* Reduce dependence on third-party build scripts in release pipeline This removes one third-party build script from the release pipeline for the release tar.gz, though one is still used in the now-separate netlify deploy. * Reduce GITHUB_TOKEN perms in actions when using 3rd party scripts This avoids allowing third parties to arbitrarily overwrite the repository. * Replace PGP signing action with the bash script from the same The PGP signing action ultimately just calls gpg with arguments set in https://github.com/actionhippie/gpgsign/blob/v1/overlay/usr/local/bin/entrypoint so its rather trivial to simply take the required arguments and put them directly in CI. This is substantially safer than the PGP signing action used as the action currently downloads, unverified and un-pinned, a docker image in order to access PGP.
82 lines
2.9 KiB
YAML
82 lines
2.9 KiB
YAML
name: 'Production deploy'
|
|
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
jobs:
|
|
create-release:
|
|
name: 'Create release tar'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out the repo
|
|
uses: actions/checkout@v3.0.2
|
|
- name: Build
|
|
run: |
|
|
npm ci
|
|
npm run build
|
|
- name: Get version from tag
|
|
id: vars
|
|
run: echo ::set-output name=tag::${GITHUB_REF#refs/*/}
|
|
- name: Create tar.gz
|
|
run: tar -czvf cinny-${{ steps.vars.outputs.tag }}.tar.gz dist
|
|
- name: Sign tar.gz
|
|
run: |
|
|
echo '${{ secrets.GNUPG_KEY }}' | gpg --batch --import
|
|
# Sadly a few lines in the private key match a few lines in the public key,
|
|
# As a result just --export --armor gives us a few lines replaced with ***
|
|
# making it useless for importing the signing key. Instead, we dump it as
|
|
# non-armored and hex-encode it so that its printable.
|
|
echo "PGP Signing key, in raw PGP format in hex. Import with cat ... | xxd -r -p - | gpg --import"
|
|
gpg --export | xxd -p
|
|
echo '${{ secrets.GNUPG_PASSPHRASE }}' | gpg --batch --yes --pinentry-mode loopback --passphrase-fd 0 --armor --detach-sign cinny-${{ steps.vars.outputs.tag }}.tar.gz
|
|
- name: Upload tagged release
|
|
uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5
|
|
with:
|
|
files: |
|
|
cinny-${{ steps.vars.outputs.tag }}.tar.gz
|
|
cinny-${{ steps.vars.outputs.tag }}.tar.gz.asc
|
|
|
|
deploy-to-netlify:
|
|
name: 'Deploy to Netlify'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3.0.2
|
|
- name: Build and deploy to Netlify
|
|
uses: jsmrcaga/action-netlify-deploy@fb6a5f936a4b06a8f7793e69fc5a022ffe39807a
|
|
with:
|
|
install_command: "npm ci"
|
|
NETLIFY_AUTH_TOKEN: ${{ secrets.NETLIFY_AUTH_TOKEN }}
|
|
NETLIFY_SITE_ID: ${{ secrets.NETLIFY_SITE_ID }}
|
|
BUILD_DIRECTORY: "dist"
|
|
NETLIFY_DEPLOY_MESSAGE: "Prod deploy v${{ github.ref }}"
|
|
NETLIFY_DEPLOY_TO_PROD: true
|
|
|
|
push_to_dockerhub:
|
|
name: Push Docker image to Docker Hub
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3.0.2
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@v2.0.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
- name: Extract metadata (tags, labels) for Docker
|
|
id: meta
|
|
uses: docker/metadata-action@v4.0.1
|
|
with:
|
|
images: ajbura/cinny
|
|
- name: Build and push Docker image
|
|
uses: docker/build-push-action@v3.0.0
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|