From 34b3b8f56b5debb25561076c93847c8f82e96669 Mon Sep 17 00:00:00 2001 From: asepharyana Date: Fri, 21 Aug 2026 16:16:53 +0700 Subject: [PATCH] ci: fix nix-build SSH args, web.nix path handling, NIX_SSHOPTS inline --- .github/workflows/ci.yml | 112 +++++++++++++++++++++------------------ 1 file changed, 61 insertions(+), 51 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 83d9b3b..520469c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -41,12 +41,11 @@ jobs: # Build .next for web — done here because Next.js/Turbopack has a # Bun incompatibility in the Nix sandbox. The web derivation packages - # this pre-built .next (see build-and-deploy matrix below). + # this pre-built .next (see deploy-web job below). - name: Build Next.js .next working-directory: apps/web run: bun run build - # Upload .next for the web Nix derivation - name: Tar .next run: tar -C apps/web --exclude='.next/cache' -czf web-next.tar.gz .next @@ -58,7 +57,7 @@ jobs: if-no-files-found: error build-and-deploy: - name: build + deploy (Nix) + name: build + deploy (Nix) — ${{ matrix.service }} needs: test if: github.ref == 'refs/heads/main' runs-on: ubuntu-latest @@ -86,17 +85,10 @@ jobs: with: use-flakehub: false - - name: Build ${{ matrix.service }} - id: build - run: | - nix build .#${{ matrix.service }} --impure --option sandbox false --print-build-logs - STORE_PATH=$(readlink result) - echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT" - echo "Build OK ${{ matrix.service }}: $STORE_PATH" - - name: Setup SSH key env: SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} + VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} run: | mkdir -p ~/.ssh echo "$SSH_KEY" > ~/.ssh/id_ed25519 @@ -104,35 +96,47 @@ jobs: sed -i 's/\r$//' ~/.ssh/id_ed25519 ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; } ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null + # nix copy uses NIX_SSHOPTS for SSH + echo "NIX_SSHOPTS=-i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o IdentitiesOnly=yes" >> "$GITHUB_ENV" + + - name: Build ${{ matrix.service }} + id: build + run: | + nix build ".#${{ matrix.service }}" --impure --option sandbox false --print-build-logs + STORE_PATH=$(readlink result) + echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT" + echo "Build OK ${{ matrix.service }}: $STORE_PATH" - name: Copy to VPS & deploy env: - SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} + VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} + VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} + STORE_PATH: ${{ steps.build.outputs.store-path }} + SERVICE: ${{ matrix.service }} run: | - STORE_PATH="${{ steps.build.outputs.store-path }}" - SERVICE="${{ matrix.service }}" PROFILE="mcpedia-${SERVICE}" - - nix copy --to "ssh://***@$VPS_HOST" "$STORE_PATH" + export NIX_SSHOPTS="-i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o IdentitiesOnly=yes" + nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "${STORE_PATH}" ssh "$VPS_USER@$VPS_HOST" \ "sudo /nix/var/nix/profiles/default/bin/nix-env \ - --profile /nix/var/nix/profiles/$PROFILE \ - --set '$STORE_PATH' && \ - sudo systemctl restart $PROFILE && \ + --profile /nix/var/nix/profiles/\$PROFILE \ + --set '${STORE_PATH}' && \ + sudo systemctl restart \$PROFILE && \ sleep 3 && \ - sudo systemctl status $PROFILE --no-pager --no-legend | head -5" + sudo systemctl status \$PROFILE --no-pager --no-legend | head -5" - name: Verify service env: - SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} + VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} + VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} + SERVICE: ${{ matrix.service }} run: | - SERVICE="${{ matrix.service }}" PORT_MAP="api:4017 mcp:4021 worker:4018" PORT=$(echo "$PORT_MAP" | grep "$SERVICE" | awk -F: '{print $2}') ssh "$VPS_USER@$VPS_HOST" \ "curl -s -o /dev/null -w '%{http_code}' http://localhost:$PORT/health 2>/dev/null \ - || systemctl is-active $PROFILE" + || systemctl is-active \"mcpedia-$SERVICE\"" deploy-web: name: build + deploy (web) @@ -145,6 +149,11 @@ jobs: with: fetch-depth: 0 + - name: Set up Bun + uses: oven-sh/setup-bun@v2 + with: + bun-version: "1.3.14" + - name: Install Nix uses: DeterminateSystems/nix-installer-action@v16 with: @@ -158,6 +167,19 @@ jobs: with: use-flakehub: false + - name: Setup SSH key + env: + SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} + VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} + run: | + mkdir -p ~/.ssh + echo "$SSH_KEY" > ~/.ssh/id_ed25519 + chmod 600 ~/.ssh/id_ed25519 + sed -i 's/\r$//' ~/.ssh/id_ed25519 + ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; } + ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null + echo "NIX_SSHOPTS=-i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o IdentitiesOnly=yes" >> "$GITHUB_ENV" + - name: Download web .next artifact uses: actions/download-artifact@v4 with: @@ -166,58 +188,46 @@ jobs: - name: Unpack .next run: | - mkdir -p apps/web/.next tar -xzf /tmp/web-next/web-next.tar.gz -C apps/web/ - # Full monorepo install (needed for node_modules + workspace symlinks) - - name: Install deps + - name: Install deps (for node_modules in web.nix) run: bun install --frozen-lockfile - name: Build web Nix derivation id: build run: | nix-build -E \ - "let pkgs = import {}; in pkgs.callPackage ./web.nix { - webNextDir = /home/runner/work/mcpedia/mcpedia/apps/web/.next; - webPkgDir = /home/runner/work/mcpedia/mcpedia/apps/web; - nodeModulesPath = /home/runner/work/mcpedia/mcpedia; + "with import {}; callPackage ./web.nix { + webNextDir = ./apps/web/.next; + webPkgDir = ./apps/web; + nodeModulesPath = .; }" \ --impure --option sandbox false STORE_PATH=$(readlink result) echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT" echo "Build OK web: $STORE_PATH" - - name: Setup SSH key - env: - SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} - run: | - mkdir -p ~/.ssh - echo "$SSH_KEY" > ~/.ssh/id_ed25519 - chmod 600 ~/.ssh/id_ed25519 - sed -i 's/\r$//' ~/.ssh/id_ed25519 - ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; } - ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null - - name: Copy to VPS & deploy env: - SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} + VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} + VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} + STORE_PATH: ${{ steps.build.outputs.store-path }} run: | - STORE_PATH="${{ steps.build.outputs.store-path }}" - PROFILE="mcpedia-web" - - nix copy --to "ssh://***@$VPS_HOST" "$STORE_PATH" + export NIX_SSHOPTS="-i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o IdentitiesOnly=yes" + nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "${STORE_PATH}" ssh "$VPS_USER@$VPS_HOST" \ "sudo /nix/var/nix/profiles/default/bin/nix-env \ - --profile /nix/var/nix/profiles/$PROFILE \ - --set '$STORE_PATH' && \ - sudo systemctl restart $PROFILE && \ + --profile /nix/var/nix/profiles/mcpedia-web \ + --set '${STORE_PATH}' && \ + sudo systemctl restart mcpedia-web && \ sleep 3 && \ - sudo systemctl status $PROFILE --no-pager --no-legend | head -5" + sudo systemctl status mcpedia-web --no-pager --no-legend | head -5" - name: Verify public URL env: - SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} + VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} + VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} run: | ssh "$VPS_USER@$VPS_HOST" \ "curl -sk -o /dev/null -w '%{http_code}' https://wiki.asepharyana.my.id/"