newsfeed/.gitea/workflows/deploy.yml

# CI-driven deploy for newsfeed (architecture deployment-gitea-actions.md).
#
# The workflow is the source of infra truth — hosts/ports/paths live here, not in a
# manifest. Build-and-rsync model: build static musl binaries + the SPA bundle, then
# rsync straight to the targets as the scoped `gitea_ci` user.
#
#   api + worker  -> slartibartfast.kosherinata.internal  (share one SQLite file)
#   web (SPA)     -> oolon.kosherinata.internal           (nginx serves + proxies /v1)
#
# One-time host prep (gitea_ci user, sudoers, service account, dirs, cert, vhost) is done
# by script/infra-setup.sh. Only secret required here: RSYNC_SSH_KEY (the runner's private
# key). newsfeed has no app secrets — SQLite has no password and tokens are hashed at rest.

name: deploy
on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy
  cancel-in-progress: false

env:
  API_HOST: slartibartfast.kosherinata.internal
  WEB_HOST: oolon.kosherinata.internal
  API_PORT: "8081"
  TARGET: x86_64-unknown-linux-musl
  SSH_OPTS: -o StrictHostKeyChecking=accept-new

jobs:
  build:
    # Toolchain runner: rustup with the musl target + musl-gcc, node+pnpm baked into the
    # image (deployment-gitea-actions.md §5). Adjust the label to a registered runner.
    runs-on: fedora-43
    steps:
      - uses: actions/checkout@v4

      # --- lint/test gate: a broken commit never deploys ---
      - name: fmt
        run: cargo fmt --all --check
      - name: clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
      - name: test
        run: cargo test --workspace

      # --- build static binaries ---
      - name: build binaries
        run: |
          rustup target add "$TARGET"
          cargo build --release --target "$TARGET" -p newsfeed-api -p newsfeed-worker
          mkdir -p dist/bin
          cp "target/$TARGET/release/newsfeed-api" dist/bin/
          cp "target/$TARGET/release/newsfeed-worker" dist/bin/

      # --- build SPA bundle ---
      - name: build web
        working-directory: web
        run: |
          corepack enable
          pnpm install --frozen-lockfile
          pnpm build

      - uses: actions/upload-artifact@v3
        with:
          name: binaries
          path: dist/bin/
      - uses: actions/upload-artifact@v3
        with:
          name: web
          path: web/dist/

  deploy-api:
    needs: build
    runs-on: fedora-43
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v3
        with:
          name: binaries
          path: bin
      - name: write ssh key
        run: |
          install -d -m 0700 ~/.ssh
          echo "${{ secrets.RSYNC_SSH_KEY }}" > ~/.ssh/id_deploy
          chmod 0600 ~/.ssh/id_deploy
      - name: reachability check
        run: ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$API_HOST" hostname -f

      - name: rsync binaries
        run: |
          chmod +x bin/*
          for b in newsfeed-api newsfeed-worker; do
            rsync -az -e "ssh $SSH_OPTS -i ~/.ssh/id_deploy" \
              --rsync-path='sudo rsync' --chown=root:root --chmod=0755 --mkpath \
              "bin/$b" gitea_ci@"$API_HOST":/usr/local/bin/"$b"
          done

      - name: rsync config
        run: |
          rsync -az -e "ssh $SSH_OPTS -i ~/.ssh/id_deploy" \
            --rsync-path='sudo rsync' --chown=root:newsfeed --chmod=0640 --mkpath \
            asset/config/config.toml.tmpl gitea_ci@"$API_HOST":/etc/newsfeed/config.toml
          rsync -az -e "ssh $SSH_OPTS -i ~/.ssh/id_deploy" \
            --rsync-path='sudo rsync' --chown=root:newsfeed --chmod=0640 --mkpath \
            asset/config/worker.toml.tmpl gitea_ci@"$API_HOST":/etc/newsfeed/worker.toml

      - name: apply system state
        run: |
          ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$API_HOST" '
            sudo restorecon -R /usr/local/bin/newsfeed-api /usr/local/bin/newsfeed-worker /etc/newsfeed /var/lib/newsfeed
            sudo systemctl daemon-reload
            sudo systemctl restart newsfeed-api.service
            sudo systemctl restart newsfeed-worker.service
          '

      - name: health probe
        run: |
          for i in $(seq 1 10); do
            code=$(curl -fsS -o /dev/null -w '%{http_code}' "http://$API_HOST:$API_PORT/health") && [ "$code" = 200 ] && exit 0
            sleep 2
          done
          echo "api did not become healthy" >&2; exit 1

      - name: capture journal
        if: always()
        run: |
          ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$API_HOST" \
            'journalctl -u newsfeed-api.service -u newsfeed-worker.service -n 80 --no-pager' || true

  deploy-web:
    needs: build
    runs-on: fedora-43
    steps:
      - uses: actions/download-artifact@v3
        with:
          name: web
          path: dist
      - name: write ssh key
        run: |
          install -d -m 0700 ~/.ssh
          echo "${{ secrets.RSYNC_SSH_KEY }}" > ~/.ssh/id_deploy
          chmod 0600 ~/.ssh/id_deploy
      - name: reachability check
        run: ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$WEB_HOST" hostname -f

      - name: rsync SPA
        run: |
          rsync -az --delete -e "ssh $SSH_OPTS -i ~/.ssh/id_deploy" \
            --rsync-path='sudo rsync' --chown=nginx:nginx --mkpath \
            dist/ gitea_ci@"$WEB_HOST":/var/www/newsfeed/

      - name: relabel + reload nginx
        run: |
          ssh $SSH_OPTS -i ~/.ssh/id_deploy gitea_ci@"$WEB_HOST" '
            sudo restorecon -R /var/www/newsfeed
            sudo nginx -t
            sudo systemctl reload nginx.service
          '