Update .gitea/workflows/deploy.yaml

Signed-off-by: Simo <[email protected]>

.gitea/workflows/deploy.yaml

@@ -11,69 +11,130 @@ concurrency:
 
 jobs:
   deploy:
-    runs-on: shell
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
 
     steps:
-      - name: Check out pushed commit
+      - name: Check out exact commit
         uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
-      - name: Deploy AtomCMS
+      - name: Create release archive
         shell: bash
         run: |
           set -Eeuo pipefail
 
+          git archive \
+            --format=tar.gz \
+            --output=atomcms-release.tar.gz \
+            HEAD
+
+          test -s atomcms-release.tar.gz
+          sha256sum atomcms-release.tar.gz > atomcms-release.tar.gz.sha256
+
+      - name: Upload release to VPS
+        uses: appleboy/[email protected]
+        with:
+          host: "172.20.2.1"
+          username: "root"
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          port: 22
+          source: "atomcms-release.tar.gz,atomcms-release.tar.gz.sha256"
+          target: "/tmp"
+          overwrite: true
+          timeout: 120s
+          command_timeout: 10m
+
+      - name: Deploy through SSH
+        uses: appleboy/[email protected]
+        with:
+          host: "172.20.2.1"
+          username: "root"
+          key: ${{ secrets.SSH_PRIVATE_KEY }}
+          port: 22
+          timeout: 120s
+          command_timeout: 25m
+          script: |
+            set -Eeuo pipefail
+
             readonly APP_DIR="/var/www/atom-nexst"
-          readonly SOURCE_DIR="${GITHUB_WORKSPACE}"
+            readonly RELEASE="/tmp/atomcms-release.tar.gz"
+            readonly CHECKSUM="/tmp/atomcms-release.tar.gz.sha256"
+            readonly BACKUP_DIR="/var/backups/atom-nexst"
+            readonly TIMESTAMP="$(date +%Y%m%d-%H%M%S)"
+
+            failure() {
+              local exit_code=$?
+              echo "--- DEPLOYMENT FAILED with code ${exit_code} ---"
+              systemctl status atom-nexst.service --no-pager || true
+              exit "$exit_code"
+            }
+
+            trap failure ERR
 
             echo "--- Starting EPIC WEB CONTROL Deployment ---"
 
-          test -n "$SOURCE_DIR"
+            test "$APP_DIR" = "/var/www/atom-nexst"
-          test -d "$SOURCE_DIR/src"
-          test -f "$SOURCE_DIR/package.json"
-          test -f "$SOURCE_DIR/pnpm-lock.yaml"
-
             test -d "$APP_DIR"
             test -f "$APP_DIR/.env"
-          test "$APP_DIR" = "/var/www/atom-nexst"
+            test -s "$RELEASE"
+            test -s "$CHECKSUM"
 
-          echo "--- Synchronizing Application Files ---"
+            cd /tmp
+            sha256sum --check "$CHECKSUM"
 
-          sudo rsync -a --delete \
+            mkdir -p "$BACKUP_DIR"
-            --exclude=".git/" \
+
+            echo "--- Creating rollback backup ---"
+            tar \
+              --exclude=".next" \
+              --exclude="node_modules" \
+              --exclude="storage" \
               --exclude=".env" \
-            --exclude=".next/" \
+              -czf "$BACKUP_DIR/release-$TIMESTAMP.tar.gz" \
-            --exclude="node_modules/" \
+              -C "$APP_DIR" .
-            --exclude="storage/" \
-            --exclude="docs/" \
-            "$SOURCE_DIR/" "$APP_DIR/"
 
             cd "$APP_DIR"
             test "$PWD" = "$APP_DIR"
 
+            echo "--- Replacing tracked application files ---"
+
+            # These directories come entirely from Git.
+            # Persistent .env, storage and node_modules remain untouched.
+            rm -rf -- src public prisma scripts .gitea
+
+            tar -xzf "$RELEASE" -C "$APP_DIR"
+
+            rm -f -- "$RELEASE" "$CHECKSUM"
+
             echo "--- Preparing pnpm ---"
-          sudo corepack enable
+            corepack enable
-          sudo corepack prepare [email protected] --activate
+            corepack prepare [email protected] --activate
 
-          echo "--- Installing Locked Dependencies ---"
+            echo "--- Installing locked dependencies ---"
-          sudo pnpm install --frozen-lockfile --prod=false
+            pnpm install --frozen-lockfile --prod=false
 
-          echo "--- Generating Prisma Client ---"
+            echo "--- Generating Prisma client ---"
-          sudo pnpm prisma:generate
+            pnpm prisma:generate
 
-          echo "--- Running Database Migrations ---"
+            echo "--- Running database migrations ---"
-          sudo pnpm db:migrate
+            pnpm db:migrate
 
-          echo "--- Building Application ---"
+            echo "--- Building application ---"
-          sudo rm -rf -- "$APP_DIR/.next"
+            rm -rf -- "$APP_DIR/.next"
-          sudo pnpm build
+            pnpm build
 
-          echo "--- Restarting Atom Nexst Service ---"
+            echo "--- Restarting service ---"
-          sudo systemctl restart atom-nexst.service
+            systemctl restart atom-nexst.service
-          sudo systemctl is-active --quiet atom-nexst.service
+            systemctl is-active --quiet atom-nexst.service
 
-          echo "--- Verifying Deployed Revision ---"
+            echo "--- Cleaning old backups ---"
-          echo "DEPLOYED_COMMIT=${GITHUB_SHA}"
+            find "$BACKUP_DIR" \
+              -maxdepth 1 \
+              -type f \
+              -name "release-*.tar.gz" \
+              -mtime +7 \
+              -delete
 
             echo "--- Deployment Completed Successfully ---"