feat: update deployment configuration and encrypted env loader
- Update Ansible playbooks and roles for application deployment - Add new Gitea/Traefik troubleshooting playbooks - Update Docker Compose configurations (base, local, staging, production) - Enhance EncryptedEnvLoader with improved error handling - Add deployment scripts (autossh setup, migration, secret testing) - Update CI/CD workflows and documentation - Add Semaphore stack configuration
This commit is contained in:
@@ -11,7 +11,120 @@ on:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
check-changes:
|
||||
name: Check for Dependency Changes
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
dependencies_changed: ${{ steps.filter.outputs.dependencies_changed }}
|
||||
steps:
|
||||
- name: Download CI helpers
|
||||
shell: bash
|
||||
env:
|
||||
CI_TOKEN: ${{ secrets.CI_TOKEN }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
REF="${{ github.sha }}"
|
||||
if [ -z "$REF" ]; then
|
||||
REF="${{ github.ref_name }}"
|
||||
fi
|
||||
if [ -z "$REF" ]; then
|
||||
REF="${{ github.head_ref }}"
|
||||
fi
|
||||
if [ -z "$REF" ]; then
|
||||
REF="main"
|
||||
fi
|
||||
URL="https://git.michaelschiemer.de/${{ github.repository }}/raw/${REF}/scripts/ci/clone_repo.sh"
|
||||
mkdir -p /tmp/ci-tools
|
||||
if [ -n "$CI_TOKEN" ]; then
|
||||
curl -sfL -u "$CI_TOKEN:x-oauth-basic" "$URL" -o /tmp/ci-tools/clone_repo.sh
|
||||
else
|
||||
curl -sfL "$URL" -o /tmp/ci-tools/clone_repo.sh
|
||||
fi
|
||||
chmod +x /tmp/ci-tools/clone_repo.sh
|
||||
|
||||
- name: Analyse changed files
|
||||
id: filter
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
REF_NAME="${{ github.ref_name }}"
|
||||
if [ -z "$REF_NAME" ]; then
|
||||
REF_NAME="${{ github.head_ref }}"
|
||||
fi
|
||||
if [ -z "$REF_NAME" ]; then
|
||||
REF_NAME="main"
|
||||
fi
|
||||
|
||||
REPO="${{ github.repository }}"
|
||||
WORKDIR="/workspace/repo"
|
||||
|
||||
export CI_REPOSITORY="$REPO"
|
||||
export CI_TOKEN="${{ secrets.CI_TOKEN }}"
|
||||
export CI_REF_NAME="$REF_NAME"
|
||||
export CI_DEFAULT_BRANCH="main"
|
||||
export CI_TARGET_DIR="$WORKDIR"
|
||||
export CI_FETCH_DEPTH="2"
|
||||
|
||||
/tmp/ci-tools/clone_repo.sh
|
||||
|
||||
cd "$WORKDIR"
|
||||
|
||||
# For scheduled or manual runs, always run the scan
|
||||
if [ "${{ github.event_name }}" = "schedule" ] || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
||||
echo "dependencies_changed=true" >> "$GITHUB_OUTPUT"
|
||||
echo "ℹ️ Scheduled/manual run - will scan dependencies"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
CHANGED_FILES=""
|
||||
EVENT_BEFORE="${{ github.event.before }}"
|
||||
|
||||
if [ "${{ github.event_name }}" = "push" ] && [ -n "$EVENT_BEFORE" ]; then
|
||||
if git rev-parse "$EVENT_BEFORE" >/dev/null 2>&1; then
|
||||
CHANGED_FILES="$(git diff --name-only "$EVENT_BEFORE" HEAD || true)"
|
||||
else
|
||||
git fetch origin "$EVENT_BEFORE" --depth 1 || true
|
||||
if git rev-parse "$EVENT_BEFORE" >/dev/null 2>&1; then
|
||||
CHANGED_FILES="$(git diff --name-only "$EVENT_BEFORE" HEAD || true)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$CHANGED_FILES" ]; then
|
||||
if git rev-parse HEAD^ >/dev/null 2>&1; then
|
||||
CHANGED_FILES="$(git diff --name-only HEAD^ HEAD || true)"
|
||||
else
|
||||
git fetch origin "$REF_NAME" --depth 50 || true
|
||||
if git rev-parse HEAD^ >/dev/null 2>&1; then
|
||||
CHANGED_FILES="$(git diff --name-only HEAD^ HEAD || true)"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
DEPENDENCIES_CHANGED=false
|
||||
|
||||
if [ -n "$CHANGED_FILES" ]; then
|
||||
while IFS= read -r FILE; do
|
||||
[ -z "$FILE" ] && continue
|
||||
if echo "$FILE" | grep -Eq "^(composer\.json|composer\.lock)$"; then
|
||||
DEPENDENCIES_CHANGED=true
|
||||
break
|
||||
fi
|
||||
done <<< "$CHANGED_FILES"
|
||||
fi
|
||||
|
||||
echo "dependencies_changed=$DEPENDENCIES_CHANGED" >> "$GITHUB_OUTPUT"
|
||||
|
||||
if [ "$DEPENDENCIES_CHANGED" = "true" ]; then
|
||||
echo "ℹ️ Dependencies changed - security scan will run"
|
||||
else
|
||||
echo "ℹ️ No dependency changes detected - skipping security scan"
|
||||
fi
|
||||
|
||||
security-audit:
|
||||
needs: check-changes
|
||||
if: needs.check-changes.outputs.dependencies_changed == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
|
||||
name: Composer Security Audit
|
||||
runs-on: php-ci # Uses pre-built PHP 8.5 CI image with Composer pre-installed
|
||||
|
||||
@@ -55,6 +168,22 @@ jobs:
|
||||
|
||||
cd /workspace/repo
|
||||
|
||||
- name: Get Composer cache directory
|
||||
id: composer-cache
|
||||
shell: bash
|
||||
run: |
|
||||
echo "dir=$(composer global config cache-dir 2>/dev/null | cut -d' ' -f3 || echo "$HOME/.composer/cache")" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Cache Composer dependencies
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
${{ steps.composer-cache.outputs.dir }}
|
||||
vendor/
|
||||
key: ${{ runner.os }}-composer-security-${{ hashFiles('**/composer.lock') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-composer-security-
|
||||
|
||||
- name: Validate composer.json and composer.lock
|
||||
run: |
|
||||
cd /workspace/repo
|
||||
@@ -63,13 +192,6 @@ jobs:
|
||||
# Try to update lock file if needed
|
||||
composer update --lock --no-interaction || echo "⚠️ Could not update lock file, but continuing..."
|
||||
|
||||
- name: Cache Composer packages (simple)
|
||||
run: |
|
||||
if [ -d "/tmp/composer-cache/vendor" ]; then
|
||||
echo "📦 Restoring cached dependencies..."
|
||||
cp -r /tmp/composer-cache/vendor /workspace/repo/vendor || true
|
||||
fi
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
cd /workspace/repo
|
||||
@@ -77,11 +199,6 @@ jobs:
|
||||
# TODO: Remove --ignore-platform-req=php when dependencies are updated (estimated: 1 month)
|
||||
composer install --prefer-dist --no-progress --no-dev --ignore-platform-req=php
|
||||
|
||||
- name: Save Composer cache
|
||||
run: |
|
||||
mkdir -p /tmp/composer-cache
|
||||
cp -r /workspace/repo/vendor /tmp/composer-cache/vendor || true
|
||||
|
||||
- name: Run Composer Security Audit
|
||||
id: security-audit
|
||||
run: |
|
||||
|
||||
Reference in New Issue
Block a user