beeeeg update

.gitea/workflows/build.yml

@@ -1,40 +1,52 @@
-name: build
+name: Test and deploy staging
 on:
   push:
-    branches: [main, staging]
+    branches: [staging]
 
 jobs:
-  build:
+  staging:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.0
+      - name: Install and test
+        run: |
+          bun install --frozen-lockfile
+          bun run test:unit -- --run
+
+      # Build once. The same SHA-tagged image stays on the deployment host for
+      # one-click promotion to production; the production workflow never rebuilds it.
       - uses: docker/build-push-action@v5
         with:
           context: .
           push: false
           load: true
           tags: git.stanrunge.dev/stan/personal-website:${{ github.sha }}
+          build-args: |
+            GIT_SHA=${{ github.sha }}
 
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - name: setup key
+      - name: Configure deployment SSH key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
         run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/id_ed25519
+          set -euo pipefail
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -H 172.17.0.1 >> ~/.ssh/known_hosts
 
-      - name: pick target
+      - name: Transfer tested image
         run: |
-          if [ "${{ github.ref_name }}" = "main" ]; then
-            echo "DIR=/opt/personal-website" >> $GITHUB_ENV
-          else
-            echo "DIR=/opt/personal-website-staging" >> $GITHUB_ENV
-          fi
+          set -euo pipefail
+          image="git.stanrunge.dev/stan/personal-website:${{ github.sha }}"
+          docker save "$image" | ssh -o BatchMode=yes deploy@172.17.0.1 'sudo docker load'
 
-      - name: deploy
+      - name: Deploy staging
         run: |
-          ssh deploy@172.17.0.1 "echo IMAGE_TAG=${{ github.sha }} | sudo tee $DIR/.env && sudo docker compose -f $DIR/compose.prod.yml up -d"
+          set -euo pipefail
+          ssh -o BatchMode=yes deploy@172.17.0.1 \
+            "bash -s -- '${{ github.sha }}' '/opt/personal-website-staging' 'https://staging.stanrunge.dev'" \
+            < scripts/deploy-remote.sh

.gitea/workflows/deploy-production.yml

@@ -0,0 +1,41 @@
+name: Deploy production
+on:
+  workflow_dispatch:
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+    steps:
+      # Always test the staging branch, regardless of which branch the button
+      # appears on in Gitea's Actions UI.
+      - uses: actions/checkout@v4
+        with:
+          ref: staging
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.0
+      - name: Check staging source
+        run: |
+          bun install --frozen-lockfile
+          bun run test:unit -- --run
+
+      - name: Configure deployment SSH key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+        run: |
+          set -euo pipefail
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H 172.17.0.1 >> ~/.ssh/known_hosts
+
+      - name: Promote the exact staging image
+        run: |
+          set -euo pipefail
+          commit=$(git rev-parse HEAD)
+          ssh -o BatchMode=yes deploy@172.17.0.1 "bash -s -- '$commit'" \
+            < scripts/verify-staging-image.sh
+          ssh -o BatchMode=yes deploy@172.17.0.1 \
+            "bash -s -- '$commit' '/opt/personal-website' 'https://stanrunge.dev'" \
+            < scripts/deploy-remote.sh