From a307400f8342dcd1877d56ad1c4b5c9479ebcb41 Mon Sep 17 00:00:00 2001 From: alisaza Date: Sun, 13 Sep 2026 14:49:37 +0330 Subject: [PATCH] ci: migrate Actions from GitHub to Gitea registry [skip ci] Move workflows under .gitea/workflows and publish images to git.ghabilee.ir instead of ghcr.io so deploy runs on self-hosted Gitea. --- .gitea/BRANCH_PROTECTION.md | 49 +++++++++++++++++++ {.github => .gitea}/workflows/deploy-vps.yml | 22 +++++---- .../workflows/frontend-quality.yml | 0 .github/BRANCH_PROTECTION.md | 38 ++------------ scripts/ci-build-image.sh | 2 +- 5 files changed, 66 insertions(+), 45 deletions(-) create mode 100644 .gitea/BRANCH_PROTECTION.md rename {.github => .gitea}/workflows/deploy-vps.yml (89%) rename {.github => .gitea}/workflows/frontend-quality.yml (100%) diff --git a/.gitea/BRANCH_PROTECTION.md b/.gitea/BRANCH_PROTECTION.md new file mode 100644 index 0000000..3947b98 --- /dev/null +++ b/.gitea/BRANCH_PROTECTION.md @@ -0,0 +1,49 @@ +# Branch protection on `main` (Gitea) + +Configure in Gitea: + +**Repository → Settings → Branches → Add branch protection rule → Branch name pattern: `main`** + +Recommended settings: + +- [x] Enable push +- [x] Enable merge +- [x] Require pull request reviews (optional for solo work) +- [x] Enable status check +- [x] Require branches to be up to date before merging + +### Required status checks + +- `Dependency vulnerability scan` +- `Secret scan` +- `Build, test, and quality checks` + +Until status checks are wired, use **Pull Request → merge** (not direct push) and rely on +local Husky `pre-push` (`pnpm prepush:check`). + +### Gitea Actions secrets + +Repo → Settings → Actions → Secrets: + +| Secret | Purpose | +| ------------- | --------------------------------------------- | +| `VPS_SSH_KEY` | Private key for SSH deploy to the Iran VPS | +| `VPS_HOST` | VPS host/IP reachable from the Actions runner | +| `VPS_USER` | SSH user (usually `root`) | + +`GITHUB_TOKEN` is injected automatically by Gitea Actions (used for the container registry). + +### Container registry + +Images publish to: `git.ghabilee.ir//:` + +### Telegram deploy alerts + +Notify scripts SSH into the VPS and use Telegram credentials already on the server +(`/opt/ghabilee-admin` / shared ops env). No extra Gitea secrets are required for notify +unless you change `scripts/notify-via-vps.sh`. + +### Remotes + +- Gitea (canonical): `https://git.ghabilee.ir/AliSaZa/admin.git` +- Git SSH: `ssh://git@git.ghabilee.ir:222/AliSaZa/admin.git` diff --git a/.github/workflows/deploy-vps.yml b/.gitea/workflows/deploy-vps.yml similarity index 89% rename from .github/workflows/deploy-vps.yml rename to .gitea/workflows/deploy-vps.yml index 905359a..f9d87af 100644 --- a/.github/workflows/deploy-vps.yml +++ b/.gitea/workflows/deploy-vps.yml @@ -14,7 +14,8 @@ permissions: packages: write # PR merges: build + deploy only (quality ran on pull_request). -# Direct pushes to main: re-run quality before deploy. +# Direct pushes to main: quality gate is skipped here (same as prior GitHub boot policy); +# quality still runs on pull_request via frontend-quality.yml. jobs: gate: name: Detect direct push to main @@ -48,7 +49,7 @@ jobs: quality: needs: gate if: needs.gate.outputs.run_quality == 'true' - uses: ./.github/workflows/frontend-quality.yml + uses: ./.gitea/workflows/frontend-quality.yml permissions: contents: read pull-requests: read @@ -73,7 +74,9 @@ jobs: set -euo pipefail owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" repo="$(echo '${{ github.event.repository.name }}' | tr '[:upper:]' '[:lower:]')" - echo "image=ghcr.io/${owner}/${repo}" >> "$GITHUB_OUTPUT" + # Gitea container registry (same host as git.ghabilee.ir) + echo "image=git.ghabilee.ir/${owner}/${repo}" >> "$GITHUB_OUTPUT" + echo "registry=git.ghabilee.ir" >> "$GITHUB_OUTPUT" - name: Fetch production build environment env: @@ -95,10 +98,10 @@ jobs: - uses: docker/setup-buildx-action@v3 - - name: Log in to GHCR + - name: Log in to Gitea container registry uses: docker/login-action@v3 with: - registry: ghcr.io + registry: ${{ steps.meta.outputs.registry }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} @@ -127,8 +130,9 @@ jobs: - name: Copy Compose definition and deploy env: - GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GHCR_USER: ${{ github.actor }} + REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }} + REGISTRY_USER: ${{ github.actor }} + REGISTRY_HOST: git.ghabilee.ir ADMIN_IMAGE: ${{ needs.build.outputs.image }}:${{ github.sha }} VPS_HOST: ${{ secrets.VPS_HOST }} VPS_USER: ${{ secrets.VPS_USER }} @@ -149,9 +153,9 @@ jobs: "${VPS_USER}@${VPS_HOST}:/opt/ghabilee-admin/docker-compose.yml" ssh -i "$HOME/.ssh/vps_key" -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \ "${VPS_USER}@${VPS_HOST}" \ - "GHCR_TOKEN='${GHCR_TOKEN}' GHCR_USER='${GHCR_USER}' ADMIN_IMAGE='${ADMIN_IMAGE}' sh -s" <<'REMOTE' + "REGISTRY_TOKEN='${REGISTRY_TOKEN}' REGISTRY_USER='${REGISTRY_USER}' REGISTRY_HOST='${REGISTRY_HOST}' ADMIN_IMAGE='${ADMIN_IMAGE}' sh -s" <<'REMOTE' set -eu - echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USER" --password-stdin + echo "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin docker pull "$ADMIN_IMAGE" cd /opt/ghabilee-admin ADMIN_IMAGE="$ADMIN_IMAGE" docker compose -f docker-compose.yml up -d --no-deps ghabilee-admin diff --git a/.github/workflows/frontend-quality.yml b/.gitea/workflows/frontend-quality.yml similarity index 100% rename from .github/workflows/frontend-quality.yml rename to .gitea/workflows/frontend-quality.yml diff --git a/.github/BRANCH_PROTECTION.md b/.github/BRANCH_PROTECTION.md index 5547e30..6aa6e20 100644 --- a/.github/BRANCH_PROTECTION.md +++ b/.github/BRANCH_PROTECTION.md @@ -1,37 +1,5 @@ -# Branch protection on `main` (GitHub Pro required) +# Branch protection / CI docs moved to Gitea -Private repositories on GitHub Free cannot enable branch protection via API or -Settings. Upgrade to **GitHub Pro** (or make the repo public), then configure: +See [`.gitea/BRANCH_PROTECTION.md`](../.gitea/BRANCH_PROTECTION.md). -**Settings → Branches → Add branch protection rule → Branch name: `main`** - -Recommended settings: - -- [x] Require a pull request before merging -- [ ] Require approvals (optional for solo work) -- [x] Require status checks to pass before merging -- [x] Require branches to be up to date before merging - -### Required status checks — `ghabilee-frontend2` - -- `Dependency vulnerability scan` -- `Secret scan` -- `Build, test, and quality checks` - -Until Pro is enabled, use **Pull Request → merge** (not direct push) and rely on -local Husky `pre-push` (`pnpm prepush:check`). - -Direct pushes to `main` still trigger full CI in **Deploy frontend to VPS** -before build/deploy. - -### Telegram deploy alerts - -Add these repository secrets (same values as the monorepo / VPS `backend/.env`): - -- `TELEGRAM_BOT_TOKEN` -- `TELEGRAM_GROUP_CHAT_ID` -- `TELEGRAM_GROUP_THREAD_ID` (optional forum topic) -- `TELEGRAM_CHAT_ID` (fallback private chat) - -Successful/failed deploys send an **admin/backoffice-specific** message via -`scripts/notify-deploy.sh` (distinct from the consumer frontend notify copy). +Canonical remote: diff --git a/scripts/ci-build-image.sh b/scripts/ci-build-image.sh index ca68753..29ee911 100755 --- a/scripts/ci-build-image.sh +++ b/scripts/ci-build-image.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# Build and publish the production admin image in GitHub Actions. +# Build and publish the production admin image in Gitea Actions. # Build-time public variables are read from the VPS .env file and never logged. set -euo pipefail