pi-agent
de48918acf
- Webhook polar/route: block direct ?userId=&tier= upgrades in production (NODE_ENV guard) - Seed route: require ADMIN_SECRET via x-admin-secret header - Feedback route: require FEEDBACK_ADMIN_TOKEN env var in production - CORS middleware: add Vary: Origin header for caching correctness - MOCK_PAYMENTS: add NODE_ENV production guard - Wallet top-up: add production guard for mock mode when POLAR_ACCESS_TOKEN unset
55 lines
1.5 KiB
YAML
55 lines
1.5 KiB
YAML
name: Deploy Staging
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: ghcr.io
|
|
IMAGE_NAME: falah-mobile
|
|
STAGING_HOST: 192.168.0.17
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Generate Prisma client
|
|
run: npx prisma generate
|
|
|
|
- name: Build Next.js app
|
|
run: npm run build
|
|
env:
|
|
DATABASE_URL: "file:./prisma/dev.db"
|
|
|
|
- name: Build Docker image
|
|
run: |
|
|
docker build -t ${{ env.IMAGE_NAME }}:staging .
|
|
docker save ${{ env.IMAGE_NAME }}:staging | gzip > /tmp/${{ env.IMAGE_NAME }}.tar.gz
|
|
|
|
- name: Deploy to staging
|
|
run: |
|
|
scp /tmp/${{ env.IMAGE_NAME }}.tar.gz root@${{ env.STAGING_HOST }}:/opt/${{ env.IMAGE_NAME }}/
|
|
ssh root@${{ env.STAGING_HOST }} << 'EOF'
|
|
cd /opt/${{ env.IMAGE_NAME }}
|
|
docker load < ${{ env.IMAGE_NAME }}.tar.gz
|
|
docker compose -f docker-compose.staging.yml down
|
|
docker compose -f docker-compose.staging.yml up -d
|
|
for i in $(seq 1 30); do
|
|
sleep 2
|
|
curl -sf http://localhost:4014/mobile/api/health && echo "✅ Staging is healthy" && break
|
|
done
|
|
EOF
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|