fix: use server-side canton parties proxy, fix API route format #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to Production | |
| on: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| packages: write | |
| jobs: | |
| test: | |
| name: Types & Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: "pnpm" | |
| - run: pnpm install --frozen-lockfile | |
| - uses: actions/cache@v4 | |
| with: | |
| path: .turbo | |
| key: ${{ runner.os }}-turbo-${{ github.sha }} | |
| restore-keys: ${{ runner.os }}-turbo- | |
| - run: pnpm run check | |
| migrate: | |
| name: Run DB Migrations | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: "pnpm" | |
| - run: pnpm install --frozen-lockfile | |
| - name: Run migrations | |
| run: pnpm --filter=@nexus/db db:migrate | |
| env: | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }} | |
| build-and-push: | |
| name: Build & Push Docker Image | |
| runs-on: ubuntu-latest | |
| needs: migrate | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/${{ github.repository_owner }}/signuit-web | |
| tags: | | |
| type=sha,prefix=,format=long | |
| type=raw,value=latest | |
| - name: Build and push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| target: runner | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=signuit-web-production | |
| cache-to: type=gha,mode=max,scope=signuit-web-production | |
| deploy: | |
| name: Deploy to Production | |
| runs-on: ubuntu-latest | |
| needs: build-and-push | |
| steps: | |
| - name: Deploy via SSH | |
| uses: appleboy/[email protected] | |
| env: | |
| GIT_COMMIT_HASH: ${{ github.sha }} | |
| GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }} | |
| GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GHCR_USER: ${{ github.actor }} | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| TURSO_AUTH_TOKEN: ${{ secrets.TURSO_AUTH_TOKEN }} | |
| BETTER_AUTH_SECRET: ${{ secrets.BETTER_AUTH_SECRET }} | |
| SESSION_SECRET: ${{ secrets.SESSION_SECRET }} | |
| SANDBOX_SECRET: ${{ secrets.SANDBOX_SECRET }} | |
| DOMAIN: ${{ secrets.DOMAIN }} | |
| ACME_EMAIL: ${{ secrets.ACME_EMAIL }} | |
| with: | |
| host: ${{ secrets.DEPLOY_HOST }} | |
| username: ${{ secrets.DEPLOY_USER }} | |
| key: ${{ secrets.DEPLOY_SSH_KEY }} | |
| envs: GIT_COMMIT_HASH,GITHUB_REPOSITORY_OWNER,GHCR_TOKEN,GHCR_USER,DATABASE_URL,TURSO_AUTH_TOKEN,BETTER_AUTH_SECRET,SESSION_SECRET,SANDBOX_SECRET,DOMAIN,ACME_EMAIL | |
| script: | | |
| echo "${GHCR_TOKEN}" | docker login ghcr.io -u "${GHCR_USER}" --password-stdin | |
| cd /opt/signuit | |
| git fetch origin | |
| git checkout main | |
| git pull origin main | |
| cat > .env << EOF | |
| DOMAIN=${DOMAIN} | |
| ACME_EMAIL=${ACME_EMAIL} | |
| DATABASE_URL=${DATABASE_URL} | |
| TURSO_AUTH_TOKEN=${TURSO_AUTH_TOKEN} | |
| BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET} | |
| SESSION_SECRET=${SESSION_SECRET} | |
| SANDBOX_SECRET=${SANDBOX_SECRET} | |
| OPERATOR_PARTY_ID=SignUIT | |
| NODE_ENV=production | |
| EOF | |
| OWNER=$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]') | |
| docker pull ghcr.io/${OWNER}/signuit-web:${GIT_COMMIT_HASH} | |
| # Rebuild canton-sandbox so DAR is always in sync with Daml source. | |
| # The Dockerfile now runs `daml build` + `daml codegen js` at build time, | |
| # and the entrypoint uploads the DAR on first start. | |
| docker compose build canton-sandbox | |
| docker compose up -d canton-sandbox | |
| WEB_IMAGE=ghcr.io/${OWNER}/signuit-web:${GIT_COMMIT_HASH} \ | |
| docker compose up -d --no-build web | |
| echo "✅ Production deploy tamamlandı: https://${DOMAIN}" | |
| - name: Cleanup old images | |
| uses: appleboy/[email protected] | |
| with: | |
| host: ${{ secrets.DEPLOY_HOST }} | |
| username: ${{ secrets.DEPLOY_USER }} | |
| key: ${{ secrets.DEPLOY_SSH_KEY }} | |
| script: | | |
| docker images --format "{{.Repository}}:{{.Tag}}" \ | |
| --filter "reference=ghcr.io/*/signuit-web" | \ | |
| grep -v "latest" | tail -n +3 | xargs -r docker rmi -f || true | |
| docker image prune -f && docker container prune -f |