update ci.yaml

.gitea/workflows/ci.yaml

@@ -1,46 +1,47 @@
-name: Test Build Deploy
+name: CI Deploy Laravel
 
 on:
   push:
     branches:
       - master
 
-env:
-  PHP_VERSION: '8.4'
-  NODE_VERSION: '22'
-  ARTIFACT_NAME: laravel-release
-  RELEASE_FILE: laravel-release.tar.gz
-
 jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout code
+      - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: ${{ env.PHP_VERSION }}
-          extensions: pdo, pdo_sqlite, sqlite3
+          php-version: '8.4'
+          extensions: mbstring, ctype, fileinfo, openssl, pdo, tokenizer, xml
           coverage: none
 
-      - name: Copy environment file
-        run: cp .env.example .env
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
 
       - name: Install Composer dependencies
-        run: composer install --no-interaction --prefer-dist --optimize-autoloader
+        run: composer install --no-interaction --no-progress --prefer-dist
 
-      - name: Generate application key
-        run: php artisan key:generate --ansi
+      - name: Prepare environment
+        run: |
+          cp .env.example .env
+          php artisan key:generate --force
+      - name: Install NPM dependencies
+        run: npm ci || npm install --no-audit --no-fund
 
-      - name: Run migrations
-        run: php artisan migrate --no-interaction --force
+      - name: Build frontend assets for tests
+        run: npm run build
 
-      - name: Run Laravel tests
-        run: composer run test
+      - name: Run tests
+        run: php artisan test --compact
 
   build:
     name: Build
@@ -48,52 +49,48 @@ jobs:
     needs: test
 
     steps:
-      - name: Checkout code
+      - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: ${{ env.PHP_VERSION }}
-          extensions: pdo, pdo_sqlite, sqlite3
+          php-version: '8.4'
+          extensions: mbstring, ctype, fileinfo, openssl, pdo, tokenizer, xml
           coverage: none
 
-      - name: Setup Node
+      - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version: '20'
           cache: npm
 
       - name: Install production Composer dependencies
-        run: composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
+        run: composer install --no-dev --no-interaction --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Install Node dependencies
-        run: npm ci
+      - name: Install NPM dependencies
+        run: npm ci || npm install --no-audit --no-fund
 
       - name: Build frontend assets
         run: npm run build
 
-      - name: Create release artifact
-        run: |
-          tar \
-            --exclude='.git' \
-            --exclude='.gitea' \
-            --exclude='.env' \
-            --exclude="${RELEASE_FILE}" \
-            --exclude='node_modules' \
-            --exclude='tests' \
-            --exclude='storage/logs/*' \
-            --exclude='storage/framework/cache/*' \
-            --exclude='storage/framework/sessions/*' \
-            --exclude='storage/framework/views/*' \
-            -czf "/tmp/${RELEASE_FILE}" .
-          mv "/tmp/${RELEASE_FILE}" "${RELEASE_FILE}"
-
-      - name: Upload release artifact
-        uses: actions/upload-artifact@v3
+      - name: Upload deployment artifact
+        uses: actions/upload-artifact@v3.2.2-node20
         with:
-          name: ${{ env.ARTIFACT_NAME }}
-          path: ${{ env.RELEASE_FILE }}
+          name: laravel-build
+          path: |
+            app
+            bootstrap
+            config
+            database
+            public
+            resources
+            routes
+            vendor
+            artisan
+            composer.json
+            package.json
+            vite.config.js
           if-no-files-found: error
 
   deploy:
@@ -101,76 +98,91 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
 
-    env:
-      # Required Gitea secrets:
-      # - SSH_HOST: server hostname or IP address
-      # - SSH_PORT: SSH port, usually 22
-      # - SSH_USER: SSH username for deployment
-      # - SSH_PASSWORD: SSH password for deployment
-      # - DEPLOY_PATH: absolute path on the server where the app will be deployed
-      # - APP_ENV_FILE: full production .env file content, including APP_KEY and DB credentials
-      SSH_HOST: ${{ secrets.SSH_HOST }}
-      SSH_PORT: ${{ secrets.SSH_PORT }}
-      SSH_USER: ${{ secrets.SSH_USER }}
-      SSH_PASSWORD: ${{ secrets.SSH_PASSWORD }}
-      DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
-      APP_ENV_FILE: ${{ secrets.APP_ENV_FILE }}
-
     steps:
-      - name: Download release artifact
-        uses: actions/download-artifact@v3
+      - name: Download build artifact
+        uses: actions/download-artifact@v3-node20
         with:
-          name: ${{ env.ARTIFACT_NAME }}
+          name: laravel-build
+          path: release
 
-      - name: Install SSH deployment tools
-        run: sudo apt-get update && sudo apt-get install -y openssh-client sshpass rsync
+      - name: Install sshpass
+        run: sudo apt-get update && sudo apt-get install -y sshpass
 
-      - name: Validate deployment secrets
+      - name: Install rsync
+        run: sudo apt-get install -y rsync
+
+      - name: Add SSH host to known_hosts
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
         run: |
-          test -n "${SSH_HOST}" || (echo "Missing required secret: SSH_HOST" && exit 1)
-          test -n "${SSH_USER}" || (echo "Missing required secret: SSH_USER" && exit 1)
-          test -n "${SSH_PASSWORD}" || (echo "Missing required secret: SSH_PASSWORD" && exit 1)
-          test -n "${DEPLOY_PATH}" || (echo "Missing required secret: DEPLOY_PATH" && exit 1)
-
-      - name: Configure SSH
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-
-      - name: Create deployment environment file
-        if: env.APP_ENV_FILE != ''
-        run: printf '%s\n' "${APP_ENV_FILE}" > .env.deploy
-
-      - name: Upload release to server
-        run: |
-          SSHPASS="${SSH_PASSWORD}" sshpass -e rsync -avz \
-            -e "ssh -p ${SSH_PORT:-22} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \
-            "${RELEASE_FILE}" "${SSH_USER}@${SSH_HOST}:/tmp/${RELEASE_FILE}"
-
-      - name: Upload environment file to server
-        if: env.APP_ENV_FILE != ''
-        run: |
-          SSHPASS="${SSH_PASSWORD}" sshpass -e rsync -avz \
-            -e "ssh -p ${SSH_PORT:-22} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \
-            .env.deploy "${SSH_USER}@${SSH_HOST}:/tmp/.env.deploy"
-
-      - name: Extract release and finalize deployment
-        run: |
-          SSHPASS="${SSH_PASSWORD}" sshpass -e ssh \
-            -p "${SSH_PORT:-22}" \
-            -o StrictHostKeyChecking=no \
-            -o UserKnownHostsFile=/dev/null \
-            "${SSH_USER}@${SSH_HOST}" << EOF
-          set -e
-          mkdir -p "${DEPLOY_PATH}"
-          tar -xzf "/tmp/${RELEASE_FILE}" -C "${DEPLOY_PATH}"
-          rm -f "/tmp/${RELEASE_FILE}"
-          cd "${DEPLOY_PATH}"
-          if [ -f /tmp/.env.deploy ]; then
-            mv /tmp/.env.deploy .env
-            chmod 600 .env
+          if [ -n "$DEPLOY_KNOWN_HOSTS" ]; then
+            echo "$DEPLOY_KNOWN_HOSTS" >> ~/.ssh/known_hosts
+          else
+            ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" >> ~/.ssh/known_hosts
           fi
-          php artisan storage:link || true
-          php artisan migrate --force
-          php artisan optimize
-          EOF
+      - name: Deploy files with rsync over SSH
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          if [ -z "$DEPLOY_PASSWORD" ]; then
+            echo "DEPLOY_PASSWORD secret is empty."
+            exit 1
+          fi
+          mkdir -p ~/.ssh
+          rsync -az --delete \
+            -e "sshpass -e ssh -p ${DEPLOY_PORT:-22}" \
+            --exclude='.env' \
+            --exclude='storage/' \
+            --exclude='storage/logs/*' \
+            --exclude='storage/framework/cache/*' \
+            --exclude='storage/framework/sessions/*' \
+            --exclude='storage/framework/views/*' \
+            release/ "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_PATH}"
+      - name: Create .env on server from secret
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          DEPLOY_ENV_FILE: ${{ secrets.DEPLOY_ENV_FILE }}
+          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          if [ -z "$DEPLOY_ENV_FILE" ]; then
+            echo "DEPLOY_ENV_FILE secret is empty."
+            exit 1
+          fi
+          if [ -z "$DEPLOY_PASSWORD" ]; then
+            echo "DEPLOY_PASSWORD secret is empty."
+            exit 1
+          fi
+          printf '%s' "$DEPLOY_ENV_FILE" | sshpass -e ssh -p "${DEPLOY_PORT:-22}" "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p \"${DEPLOY_PATH}\" && cat > \"${DEPLOY_PATH}/.env\" && chmod 600 \"${DEPLOY_PATH}/.env\""
+      - name: Run post-deploy Laravel commands
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PASSWORD: ${{ secrets.DEPLOY_PASSWORD }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          SSHPASS: ${{ secrets.DEPLOY_PASSWORD }}
+        run: |
+          if [ -z "$DEPLOY_PASSWORD" ]; then
+            echo "DEPLOY_PASSWORD secret is empty."
+            exit 1
+          fi
+          sshpass -e ssh -p "${DEPLOY_PORT:-22}" "${DEPLOY_USER}@${DEPLOY_HOST}" "cd ${DEPLOY_PATH} && mkdir -p storage/framework/cache/data storage/framework/sessions storage/framework/views storage/logs bootstrap/cache && chmod -R ug+rw storage bootstrap/cache && php artisan optimize:clear && php artisan config:cache && php artisan route:cache && php artisan view:cache"
+# Required repository secrets:
+# - DEPLOY_HOST: Server hostname or IP.
+# - DEPLOY_PORT: SSH port (optional, defaults to 22).
+# - DEPLOY_USER: SSH user for deployment.
+# - DEPLOY_PASSWORD: SSH password for deployment user.
+# - DEPLOY_PATH: Absolute path of the Laravel app on the server.
+# - DEPLOY_KNOWN_HOSTS: Optional pinned known_hosts line(s) for stricter host verification.
+# - DEPLOY_ENV_FILE: Full .env content as a multiline secret (contains APP_KEY, DB_*, etc).