chore(deps): Update react to v19.2.8 (#186) #142
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 Andrey Kotlyar <[email protected]> | |
| # | |
| # SPDX-License-Identifier: AGPL-3.0-or-later | |
| name: Deploy | |
| on: | |
| push: | |
| branches: [main] | |
| tags: | |
| - "v*.*.*" | |
| permissions: | |
| contents: read | |
| security-events: write | |
| env: | |
| DOCKER_IMAGE: kotlyar562/guitar0net-web | |
| jobs: | |
| build: | |
| name: Build and Push | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.meta.outputs.version }} | |
| git_sha: ${{ steps.sha.outputs.short }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to Docker Hub | |
| uses: docker/login-action@v4 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Get short SHA | |
| id: sha | |
| run: echo "short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT" | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ${{ env.DOCKER_IMAGE }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=raw,value=staging,enable={{is_default_branch}} | |
| - name: Build and push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| platforms: linux/amd64 | |
| pull: true | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| VERSION=${{ github.ref_name }} | |
| GIT_SHA=${{ steps.sha.outputs.short }} | |
| BUILD_DATETIME=${{ github.run_id }} | |
| NEXT_PUBLIC_API_URL=${{ startsWith(github.ref, 'refs/tags/') && 'https://api.guitar0.net' || 'https://api.staging.guitar0.net' }} | |
| NEXT_PUBLIC_POSTHOG_KEY=${{ vars.NEXT_PUBLIC_POSTHOG_KEY }} | |
| NEXT_PUBLIC_SITE_URL=${{ startsWith(github.ref, 'refs/tags/') && 'https://guitar0.net' || 'https://staging.guitar0.net' }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| security-scan: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| needs: build | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/[email protected] | |
| with: | |
| image-ref: "${{ env.DOCKER_IMAGE }}:${{ needs.build.outputs.version }}" | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| exit-code: "1" | |
| ignore-unfixed: true | |
| trivyignores: ".trivyignore" | |
| limit-severities-for-sarif: true | |
| - name: Upload Trivy scan results | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| dispatch-staging: | |
| name: Trigger staging deploy | |
| if: github.ref == 'refs/heads/main' | |
| needs: [build, security-scan] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Dispatch deploy to infrastructure repo | |
| uses: peter-evans/repository-dispatch@v4 | |
| with: | |
| token: ${{ secrets.INFRA_DISPATCH_TOKEN }} | |
| repository: guitar0-net/infrastructure | |
| event-type: deploy-frontend | |
| client-payload: | | |
| { | |
| "environment": "staging", | |
| "version": "${{ needs.build.outputs.version }}", | |
| "git_sha": "${{ needs.build.outputs.git_sha }}" | |
| } | |
| dispatch-production: | |
| name: Trigger production deploy | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: [build, security-scan] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Dispatch deploy to infrastructure repo | |
| uses: peter-evans/repository-dispatch@v4 | |
| with: | |
| token: ${{ secrets.INFRA_DISPATCH_TOKEN }} | |
| repository: guitar0-net/infrastructure | |
| event-type: deploy-frontend | |
| client-payload: | | |
| { | |
| "environment": "production", | |
| "version": "${{ needs.build.outputs.version }}", | |
| "git_sha": "${{ needs.build.outputs.git_sha }}" | |
| } |