98 lines
3.1 KiB
YAML
98 lines
3.1 KiB
YAML
name: Docker Build & Publish UI
|
|
|
|
on:
|
|
push:
|
|
branches: [ prod, dev ]
|
|
|
|
env:
|
|
REGISTRY: gitea.biz360.me
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
PROJECT_SECRET_KEY: "MASTERADMINUI"
|
|
# Target the base environment file directly
|
|
ENV_FILE_PATH: "src/environments/environment.ts"
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Determine Environment
|
|
id: env_config
|
|
run: |
|
|
if [[ "${GITHUB_REF##*/}" == "dev" ]]; then
|
|
echo "INFISICAL_ENV=dev" >> $GITHUB_OUTPUT
|
|
elif [[ "${GITHUB_REF##*/}" == "prod" ]]; then
|
|
echo "INFISICAL_ENV=prod" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Fetch secrets from Infisical
|
|
uses: Infisical/secrets-action@v1.0.9
|
|
with:
|
|
client-id: ${{ secrets.INFISICAL_CLIENT_ID }}
|
|
client-secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
|
|
env-slug: ${{ steps.env_config.outputs.INFISICAL_ENV }}
|
|
project-slug: "syscom-xpq-0"
|
|
domain: "https://infisical.biz360.me/"
|
|
# export-type: "file"
|
|
# file-output-path: "/infisical.env"
|
|
export-type: "json" # Changed from "file"
|
|
file-output-path: "infisical.json" # Changed to .json
|
|
|
|
# - name: Brute-force overwrite environment.ts
|
|
# run: |
|
|
# source infisical.env
|
|
|
|
# # Forcefully overwrite the file the developers are importing
|
|
# echo "${!PROJECT_SECRET_KEY}" > "$ENV_FILE_PATH"
|
|
|
|
# # Clean up
|
|
# rm -f infisical.env
|
|
|
|
- name: Brute-force overwrite environment.ts
|
|
run: |
|
|
# Use jq to extract the exact string value, preserving all quotes and newlines
|
|
jq -r '.MASTERADMINUI' infisical.json > "$ENV_FILE_PATH"
|
|
|
|
# Clean up
|
|
rm -f infisical.json
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Log in to Gitea Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
- name: Docker metadata
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
tags: |
|
|
type=ref,event=branch
|
|
type=raw,value=dev-{{date 'YYYYMMDDTHHmm'}},enable=${{ github.ref == 'refs/heads/dev' }}
|
|
type=raw,value=prod-{{date 'YYYYMMDDTHHmm'}},enable=${{ github.ref == 'refs/heads/prod' }}
|
|
|
|
- name: Build and push Docker image
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: ./docker/Dockerfile
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
# Optional: Revert the file so the runner stays completely clean
|
|
- name: Clean up modified workspace
|
|
if: always()
|
|
run: git checkout -- "$ENV_FILE_PATH" |