fix(db): transactional index builds for async alembic env #137
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy Backend to Server | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Build the frontend image on the CI runner (7+GB RAM) and push it to | |
| # GHCR, so the 3.8GB prod box never runs the RAM-heavy `vite build` that | |
| # used to OOM on-server. deploy.sh pulls this image instead of building | |
| # it (with an on-server build fallback if the pull fails). | |
| build-frontend: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Resolve lowercase owner | |
| id: owner | |
| run: echo "owner=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT" | |
| - name: Build and push frontend image | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./frontend | |
| push: true | |
| tags: | | |
| ghcr.io/${{ steps.owner.outputs.owner }}/dotsound-frontend:latest | |
| ghcr.io/${{ steps.owner.outputs.owner }}/dotsound-frontend:${{ github.sha }} | |
| cache-from: type=gha,scope=dotsound-frontend | |
| cache-to: type=gha,scope=dotsound-frontend,mode=max | |
| deploy: | |
| needs: build-frontend | |
| # Run even if the frontend image build/push failed: deploy.sh falls | |
| # back to building the frontend on the server, so a CI push hiccup | |
| # never blocks the deploy entirely. | |
| if: ${{ !cancelled() }} | |
| runs-on: ubuntu-latest | |
| concurrency: | |
| group: deploy-dotsound-backend | |
| cancel-in-progress: false | |
| steps: | |
| - name: Check deploy secrets | |
| env: | |
| SERVER_HOST: ${{ secrets.SERVER_HOST }} | |
| SERVER_USER: ${{ secrets.SERVER_USER }} | |
| SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} | |
| run: | | |
| test -n "$SERVER_HOST" || { echo "::error::Missing required secret SERVER_HOST"; exit 1; } | |
| test -n "$SERVER_USER" || { echo "::error::Missing required secret SERVER_USER"; exit 1; } | |
| test -n "$SSH_PRIVATE_KEY" || { echo "::error::Missing required secret SSH_PRIVATE_KEY"; exit 1; } | |
| - name: Deploy via SSH | |
| uses: appleboy/ssh-action@v1.0.3 | |
| with: | |
| host: ${{ secrets.SERVER_HOST }} | |
| username: ${{ secrets.SERVER_USER }} | |
| key: ${{ secrets.SSH_PRIVATE_KEY }} | |
| port: ${{ secrets.SERVER_SSH_PORT || 22 }} | |
| command_timeout: 60m | |
| script: | | |
| set -e | |
| cd /opt/dotsound/DotSoundBackend | |
| chmod +x ./scripts/deploy.sh | |
| # OBSERVABILITY отключён намеренно: на 3.8GB боксе стек мониторинга | |
| # (Grafana/Prometheus/Loki/Tempo/cAdvisor/...) не оставляет памяти | |
| # под сборку frontend и валит деплой в OOM. Вернуть OBSERVABILITY=1 | |
| # только после апгрейда RAM. | |
| ./scripts/deploy.sh full |