1c335e8daa
new workflow joins the tailnet via tailscale oauth then triggers the coolify deploy endpoint. path filter scoped to web app + every package transpiled into it, so broker/cli/docs changes skip it. concurrency group coalesces rapid pushes. requires three repo secrets: COOLIFY_TOKEN, TS_OAUTH_CLIENT_ID, TS_OAUTH_SECRET (the OAuth client needs the devices:write scope and the tag:ci tag in tailnet ACL tagOwners). inline coolify token removed from CLAUDE.md — it now references the repo secret. broker deploy is unchanged: it runs through the gitea-vps webhook. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
72 lines
2.3 KiB
YAML
72 lines
2.3 KiB
YAML
name: Deploy claudemesh-web
|
|
|
|
# Triggers a Coolify deploy of the apps/web Next.js app on the OVH VPS.
|
|
# Coolify only auto-deploys the broker (it watches the gitea-vps mirror);
|
|
# the web app needs an explicit poke. This workflow is the poke.
|
|
#
|
|
# The Coolify dashboard is bound to a Tailscale-only address
|
|
# (100.122.34.28:8000), so the runner first joins the tailnet via
|
|
# an OAuth-issued ephemeral node, then hits Coolify's deploy API.
|
|
#
|
|
# Path filter: redeploy on changes to the web app, the API package
|
|
# (bundled into the web build), or any shared package the web app
|
|
# transpiles. Anything else (broker-only, cli-only, docs) skips it.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "apps/web/**"
|
|
- "packages/api/**"
|
|
- "packages/db/**"
|
|
- "packages/auth/**"
|
|
- "packages/ui/**"
|
|
- "packages/i18n/**"
|
|
- "packages/shared/**"
|
|
- "packages/email/**"
|
|
- "packages/billing/**"
|
|
- "packages/storage/**"
|
|
- "packages/monitoring-web/**"
|
|
- "pnpm-lock.yaml"
|
|
- ".github/workflows/deploy-web.yml"
|
|
workflow_dispatch:
|
|
|
|
# Coalesce rapid pushes — only one deploy in flight at a time, and
|
|
# if a newer push lands while one is queued, the older one is
|
|
# cancelled. Avoids the "5 commits, 5 deploys" stampede.
|
|
concurrency:
|
|
group: deploy-web
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Connect to Tailscale
|
|
uses: tailscale/github-action@v3
|
|
with:
|
|
oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
|
|
oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
|
|
tags: tag:ci
|
|
|
|
- name: Trigger Coolify deploy
|
|
env:
|
|
COOLIFY_TOKEN: ${{ secrets.COOLIFY_TOKEN }}
|
|
APP_UUID: p68x1e3k4xmrjmblca5ybe09
|
|
run: |
|
|
if [ -z "$COOLIFY_TOKEN" ]; then
|
|
echo "::error::COOLIFY_TOKEN secret is not set"
|
|
exit 1
|
|
fi
|
|
response=$(curl -sS -w "\n%{http_code}" -X GET \
|
|
"http://100.122.34.28:8000/api/v1/deploy?uuid=${APP_UUID}" \
|
|
-H "Authorization: Bearer ${COOLIFY_TOKEN}")
|
|
status=$(echo "$response" | tail -n1)
|
|
body=$(echo "$response" | sed '$d')
|
|
echo "HTTP $status"
|
|
echo "$body"
|
|
if [ "$status" != "200" ]; then
|
|
echo "::error::Coolify returned HTTP $status"
|
|
exit 1
|
|
fi
|