Mirror mic-check's Gitea/GitHub CI-CD pipeline for novelly

Dual-engine workflow (.github/workflows/ci.yml, read by both GitHub Actions and Gitea Actions): build, test, coverage badge on every push; on Gitea main pushes only, build+push API/web images to the Gitea registry and redeploy the persistent LAN stack via the shared [self-hosted, qa] runner. Replaces the ad hoc docker-compose.deploy.yml manual workflow with deploy/qa/docker-compose.qa.yml, pulled by CI — data volume preserved across deploys (no -v on down), unlike mic-check's throwaway QA stack.
2026-08-18 18:25:01 -07:00
parent 56e64c6f06
commit 44f722019b
16 changed files with 493 additions and 28 deletions
@@ -0,0 +1,75 @@
+# CI/CD pipeline for Novelly. Read by both Gitea Actions and GitHub Actions (both look
+# under .github/workflows/). Every non-checkout step just invokes a bash script under
+# scripts/ci/, so the entire pipeline is reproducible by running the same scripts
+# locally — no marketplace build/test/push actions.
+#
+# Gitea (origin) is the internal remote and runs the full pipeline: build, test,
+# coverage badge, docker push, deploy, health check. GitHub is the public mirror and
+# only needs to prove the code builds and tests pass — it has no registry secrets and
+# no [self-hosted, qa] runner, so the docker push/deploy job is skipped there via the
+# `github.server_url` check below (identical on both engines: https://github.com on
+# GitHub, the Gitea instance URL on Gitea).
+name: CI
+
+on:
+  push:
+    paths-ignore: [badges/**]
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      REGISTRY: ${{ secrets.REGISTRY }}
+      REGISTRY_OWNER: ${{ secrets.REGISTRY_OWNER }}
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build
+        run: ./scripts/ci/build.sh
+
+      - name: Test
+        run: ./scripts/ci/test.sh
+
+      - name: Coverage report
+        run: ./scripts/ci/coverage.sh
+
+      - name: Publish coverage badge
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: ./scripts/ci/publish-coverage-badge.sh
+
+      - name: Build Docker images
+        if: github.server_url != 'https://github.com' && github.ref_name == 'main'
+        run: ./scripts/ci/docker-build.sh
+
+      - name: Push Docker images
+        if: github.server_url != 'https://github.com' && github.ref_name == 'main'
+        run: ./scripts/ci/docker-push.sh
+
+  deploy:
+    needs: build-and-push
+    if: github.server_url != 'https://github.com' && github.ref_name == 'main'
+    runs-on: [self-hosted, qa]
+    env:
+      REGISTRY: ${{ secrets.REGISTRY }}
+      REGISTRY_OWNER: ${{ secrets.REGISTRY_OWNER }}
+      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      WEB_PORT: ${{ vars.WEB_PORT }}
+    steps:
+      # actions/checkout@v4 is a Node-based action; this runner has no node in PATH, so
+      # checkout plain git instead of via marketplace action.
+      - name: Checkout
+        run: |
+          git init -q .
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git -c http.extraheader="AUTHORIZATION: bearer ${{ github.token }}" fetch --depth=1 origin "${{ github.sha }}"
+          git checkout -q FETCH_HEAD
+
+      - name: Deploy
+        run: ./scripts/ci/deploy.sh