name: CI on: push: branches: [main] pull_request: branches: [main] concurrency: group: ci-${{ github.ref }} cancel-in-progress: true env: VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} permissions: contents: read jobs: test: name: typecheck + tests runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v5 - name: Set up Bun uses: oven-sh/setup-bun@v2 with: bun-version: "1.3.14" - name: Install dependencies run: bun install --frozen-lockfile - name: Typecheck run: bun run typecheck - name: Test run: bun run test # Build .next for web — done here because Next.js/Turbopack has a # Bun incompatibility in the Nix sandbox. The web derivation packages # this pre-built .next (see deploy-web job below). - name: Build Next.js .next working-directory: apps/web run: bun run build - name: Tar .next run: tar -C apps/web --exclude='.next/cache' -czf web-next.tar.gz .next - name: Upload web .next artifact uses: actions/upload-artifact@v4 with: name: mcpedia-web-next path: web-next.tar.gz if-no-files-found: error build-and-deploy: name: build + deploy (Nix) — ${{ matrix.service }} needs: test if: github.ref == 'refs/heads/main' runs-on: ubuntu-latest strategy: fail-fast: false matrix: service: [api, mcp, worker] steps: - name: Checkout uses: actions/checkout@v5 with: fetch-depth: 0 - name: Install Nix uses: DeterminateSystems/nix-installer-action@v16 with: determinate: false extra-conf: | sandbox = false accept-flake-config = true - name: Cache Nix uses: DeterminateSystems/magic-nix-cache-action@v14 with: use-flakehub: false - name: Setup SSH key env: SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} run: | mkdir -p ~/.ssh echo "$SSH_KEY" > ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 sed -i 's/\r$//' ~/.ssh/id_ed25519 ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; } ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null # nix copy uses NIX_SSHOPTS for SSH echo "NIX_SSHOPTS=-i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o IdentitiesOnly=yes" >> "$GITHUB_ENV" - name: Build ${{ matrix.service }} id: build run: | nix build ".#${{ matrix.service }}" --impure --option sandbox false --print-build-logs STORE_PATH=$(readlink result) echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT" echo "Build OK ${{ matrix.service }}: $STORE_PATH" - name: Copy to VPS & deploy env: VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} STORE_PATH: ${{ steps.build.outputs.store-path }} SERVICE: ${{ matrix.service }} run: | PROFILE="mcpedia-${SERVICE}" export NIX_SSHOPTS="-i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o IdentitiesOnly=yes" nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "${STORE_PATH}" ssh "$VPS_USER@$VPS_HOST" \ "sudo /nix/var/nix/profiles/default/bin/nix-env \ --profile /nix/var/nix/profiles/\$PROFILE \ --set '${STORE_PATH}' && \ sudo systemctl restart \$PROFILE && \ sleep 3 && \ sudo systemctl status \$PROFILE --no-pager --no-legend | head -5" - name: Verify service env: VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} SERVICE: ${{ matrix.service }} run: | PORT_MAP="api:4017 mcp:4021 worker:4018" PORT=$(echo "$PORT_MAP" | grep "$SERVICE" | awk -F: '{print $2}') ssh "$VPS_USER@$VPS_HOST" \ "curl -s -o /dev/null -w '%{http_code}' http://localhost:$PORT/health 2>/dev/null \ || systemctl is-active \"mcpedia-$SERVICE\"" deploy-web: name: build + deploy (web) needs: test if: github.ref == 'refs/heads/main' runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v5 with: fetch-depth: 0 - name: Set up Bun uses: oven-sh/setup-bun@v2 with: bun-version: "1.3.14" - name: Install Nix uses: DeterminateSystems/nix-installer-action@v16 with: determinate: false extra-conf: | sandbox = false accept-flake-config = true - name: Cache Nix uses: DeterminateSystems/magic-nix-cache-action@v14 with: use-flakehub: false - name: Setup SSH key env: SSH_KEY: ${{ secrets.SSH_DEPLOY_KEY }} VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} run: | mkdir -p ~/.ssh echo "$SSH_KEY" > ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 sed -i 's/\r$//' ~/.ssh/id_ed25519 ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; } ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null echo "NIX_SSHOPTS=-i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o IdentitiesOnly=yes" >> "$GITHUB_ENV" - name: Download web .next artifact uses: actions/download-artifact@v4 with: name: mcpedia-web-next path: /tmp/web-next - name: Unpack .next run: | tar -xzf /tmp/web-next/web-next.tar.gz -C apps/web/ - name: Install deps (for node_modules in web.nix) run: bun install --frozen-lockfile - name: Build web Nix derivation id: build run: | nix-build -E \ "with import {}; callPackage ./web.nix { webNextDir = ./apps/web/.next; webPkgDir = ./apps/web; nodeModulesPath = .; }" \ --impure --option sandbox false STORE_PATH=$(readlink result) echo "store-path=$STORE_PATH" >> "$GITHUB_OUTPUT" echo "Build OK web: $STORE_PATH" - name: Copy to VPS & deploy env: VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} STORE_PATH: ${{ steps.build.outputs.store-path }} run: | export NIX_SSHOPTS="-i ~/.ssh/id_ed25519 -o StrictHostKeyChecking=no -o IdentitiesOnly=yes" nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "${STORE_PATH}" ssh "$VPS_USER@$VPS_HOST" \ "sudo /nix/var/nix/profiles/default/bin/nix-env \ --profile /nix/var/nix/profiles/mcpedia-web \ --set '${STORE_PATH}' && \ sudo systemctl restart mcpedia-web && \ sleep 3 && \ sudo systemctl status mcpedia-web --no-pager --no-legend | head -5" - name: Verify public URL env: VPS_HOST: ${{ secrets.SSH_DEPLOY_HOST }} VPS_USER: ${{ secrets.SSH_DEPLOY_USER }} run: | ssh "$VPS_USER@$VPS_HOST" \ "curl -sk -o /dev/null -w '%{http_code}' https://wiki.asepharyana.my.id/"