snapshot

.forgejo/workflows/ci.yml

@@ -0,0 +1,84 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | sh
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Sync dependencies
+        working-directory: backend
+        run: uv sync
+
+      - name: Run tests
+        working-directory: backend
+        run: uv run pytest -v
+
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Lint (if configured)
+        working-directory: frontend
+        run: |
+          if [ -f eslint.config.js ] || [ -f .eslintrc.json ] || [ -f .eslintrc.js ]; then
+            npm run lint
+          else
+            echo "No ESLint config found, skipping lint"
+          fi
+
+      - name: Build
+        working-directory: frontend
+        run: npm run build
+
+      - name: Test
+        working-directory: frontend
+        run: npm test
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: [backend, frontend]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build Docker image
+        run: docker build -t life-towers:${{ github.sha }} .
+
+      - name: Push to registry
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        env:
+          REGISTRY_URL: ${{ secrets.REGISTRY_URL }}
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          if [ -z "$REGISTRY_URL" ] || [ -z "$REGISTRY_USER" ] || [ -z "$REGISTRY_PASSWORD" ]; then
+            echo "Registry secrets not configured, skipping push"
+            exit 0
+          fi
+          echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY_URL" -u "$REGISTRY_USER" --password-stdin
+          docker tag life-towers:${{ github.sha }} "$REGISTRY_URL/life-towers:${{ github.sha }}"
+          docker tag life-towers:${{ github.sha }} "$REGISTRY_URL/life-towers:latest"
+          docker push "$REGISTRY_URL/life-towers:${{ github.sha }}"
+          docker push "$REGISTRY_URL/life-towers:latest"

.forgejo/workflows/deploy.yml

@@ -0,0 +1,52 @@
+# IMPORTANT: Before this workflow will function, configure the following
+# repository secrets in Forgejo (Settings → Secrets):
+#   DEPLOY_HOST        — hostname or IP of the target server
+#   DEPLOY_USER        — SSH user on the target server
+#   DEPLOY_SSH_KEY     — private SSH key (PEM or OpenSSH format)
+#   DEPLOY_PATH        — absolute path to the project directory on the server
+#                        (must contain a docker-compose.yml + a .env file
+#                        that sets LIFE_TOWERS_IMAGE to the registry tag,
+#                        e.g. LIFE_TOWERS_IMAGE=registry.example.com/life-towers:latest)
+
+name: Deploy
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install SSH key
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -H "${{ secrets.DEPLOY_HOST }}" >> ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Deploy via SSH
+        run: |
+          set -euo pipefail
+          # Pulls the new image referenced by $LIFE_TOWERS_IMAGE in the
+          # server's .env, restarts the service, then verifies health.
+          ssh -i ~/.ssh/deploy_key \
+              -o StrictHostKeyChecking=yes \
+              "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
+              "set -euo pipefail
+               cd '${{ secrets.DEPLOY_PATH }}'
+               docker compose pull
+               docker compose up -d --remove-orphans
+               # Wait for healthcheck (max ~60s)
+               for i in \$(seq 1 30); do
+                 status=\$(docker compose ps --format json life-towers | python3 -c 'import sys,json;[print(json.loads(l).get(\"Health\",\"\")) for l in sys.stdin]' || true)
+                 if [ \"\$status\" = healthy ]; then echo deploy_healthy; exit 0; fi
+                 sleep 2
+               done
+               echo deploy_unhealthy >&2
+               docker compose logs --tail 50 life-towers >&2
+               exit 1"