Update GitHub Actions

mythz · mythz · commit 3b2babff4245 · 2025-11-29T00:03:52.000+08:00
diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml
@@ -15,8 +15,7 @@ on:
 # Only update envs here if you need to change them for this workflow
 env:
   DOCKER_BUILDKIT: 1
-  KAMAL_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-  KAMAL_REGISTRY_USERNAME: ${{ github.actor }}
+  KAMAL_DEPLOY_HOST: ${{ secrets.KAMAL_DEPLOY_HOST }}
 
 jobs:
   build-container:
@@ -33,6 +32,24 @@ jobs:
           echo "repository_name_lower=$(echo ${{ github.repository }} | cut -d '/' -f 2 | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
           echo "org_name=$(echo ${{ github.repository }} | cut -d '/' -f 1)" >> $GITHUB_ENV
 
+          # Set SERVICE_LABEL: derive from GITHUB_REPOSITORY (replace dots with dashes)
+          echo "SERVICE_LABEL=$(echo ${{ github.repository }} | cut -d '/' -f 2 | tr '.' '-')" >> $GITHUB_ENV
+
+          # Set KAMAL_DEPLOY_HOST: use secret if available, otherwise use repository name
+          if [ -n "${{ secrets.KAMAL_DEPLOY_HOST }}" ]; then
+            DEPLOY_HOST="${{ secrets.KAMAL_DEPLOY_HOST }}"
+          else
+            DEPLOY_HOST="$(echo ${{ github.repository }} | cut -d '/' -f 2)"
+          fi
+
+          # Validate KAMAL_DEPLOY_HOST contains at least one '.'
+          if [[ ! "$DEPLOY_HOST" == *.* ]]; then
+            echo "Error: KAMAL_DEPLOY_HOST must contain a hostname, e.g. example.com (got: $DEPLOY_HOST)"
+            exit 1
+          fi
+
+          echo "KAMAL_DEPLOY_HOST=$DEPLOY_HOST" >> $GITHUB_ENV
+
       # This step is for the deployment of the templates only, safe to delete
       - name: Modify csproj for template deploy
         env: 
@@ -61,6 +78,11 @@ jobs:
         working-directory: ./MyApp.Client
         run: npm install
 
+      - name: Build client
+        if: steps.check_client.outputs.client_exists == 'true'
+        working-directory: ./MyApp.Client
+        run: npm run build
+
       - name: Install x tool
         run: dotnet tool install -g x
 
@@ -79,16 +101,21 @@ jobs:
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ env.KAMAL_REGISTRY_USERNAME }}
-          password: ${{ env.KAMAL_REGISTRY_PASSWORD }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 10.0.x
 
       - name: Build and push Docker image
         env:
           SERVICESTACK_LICENSE: ${{ secrets.SERVICESTACK_LICENSE }}
+          KAMAL_DEPLOY_HOST: ${{ secrets.KAMAL_DEPLOY_HOST }}
         run: |
-          dotnet publish --os linux --arch x64 -c Release -p:ContainerRepository=${{ env.image_repository_name }} -p:ContainerRegistry=ghcr.io -p:ContainerImageTags=latest -p:ContainerPort=80 -p:ContainerEnvironmentVariable="SERVICESTACK_LICENSE=${{ secrets.SERVICESTACK_LICENSE }}"
+          dotnet publish --os linux --arch x64 -c Release \
+            -p:ContainerRepository=${{ env.image_repository_name }} \
+            -p:ContainerRegistry=ghcr.io -p:ContainerImageTags=latest \
+            -p:ContainerPort=80 \
+            -p:ContainerEnvironmentVariable="SERVICESTACK_LICENSE=${{ env.SERVICESTACK_LICENSE }}"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -16,10 +16,26 @@ jobs:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 8.0.x
+          dotnet-version: 10.0.x
+
+      - name: Restore NuGet packages (use repo NuGet.config)
+        run: dotnet restore MyApp.slnx --configfile ./NuGet.Config
+
+      # If your feed requires authentication, enable and configure the step below.
+      # This example uses a Personal Access Token stored in secrets.NUGET_API_KEY.
+      # Alternatively, you can use the NuGet Authenticate action from Azure Pipelines.
+      # - name: Authenticate private NuGet feed
+      #   env:
+      #     NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+      #   run: |
+      #     dotnet nuget add source "https://YOUR_FEED_URL/index.json" \
+      #       --name "PrivateFeed" \
+      #       --username "YOUR_USERNAME" \
+      #       --password "$NUGET_API_KEY" \
+      #       --store-password-in-clear-text
 
       - name: build
-        run: dotnet build
+        run: dotnet build --no-restore
         working-directory: .
 
       - name: test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -14,8 +14,11 @@ on:
 
 env:
   DOCKER_BUILDKIT: 1
-  KAMAL_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+  SERVICESTACK_LICENSE: ${{ secrets.SERVICESTACK_LICENSE }}
+  KAMAL_DEPLOY_IP: ${{ secrets.KAMAL_DEPLOY_IP }}
+  KAMAL_DEPLOY_HOST: ${{ secrets.KAMAL_DEPLOY_HOST }}
   KAMAL_REGISTRY_USERNAME: ${{ github.actor }}
+  KAMAL_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   release:
@@ -37,24 +40,12 @@ jobs:
             echo "HAS_MIGRATIONS=false" >> $GITHUB_ENV
           fi
 
-      # This step is for the deployment of the templates only, safe to delete
-      - name: Modify deploy.yml
-        env: 
-          KAMAL_DEPLOY_IP: ${{ secrets.KAMAL_DEPLOY_IP }}
-        if: env.KAMAL_DEPLOY_IP != null
-        run: |
-          sed -i "s/service: my-app/service: ${{ env.repository_name_lower }}/g" config/deploy.yml
-          sed -i "s#image: my-user/myapp#image: ${{ env.image_repository_name }}#g" config/deploy.yml
-          sed -i "s/- 192.168.0.1/- ${{ secrets.KAMAL_DEPLOY_IP }}/g" config/deploy.yml
-          sed -i "s/host: my-app.example.com/host: ${{ secrets.KAMAL_DEPLOY_HOST }}/g" config/deploy.yml
-          sed -i "s/MyApp/${{ env.repository_name }}/g" config/deploy.yml
-
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
-          username: ${{ env.KAMAL_REGISTRY_USERNAME }}
-          password: ${{ env.KAMAL_REGISTRY_PASSWORD }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up SSH key
         uses: webfactory/ssh-agent@v0.9.0
@@ -79,29 +70,47 @@ jobs:
         run: |
           kamal server bootstrap
 
+      - name: Ensure directories exist with correct permissions
+        run: |
+          echo "Creating directories with correct permissions"
+          kamal server exec "mkdir -p /opt/docker/${{ env.repository_name }}/App_Data /opt/docker/${{ env.repository_name }}/initdb.d"
+
+          echo "Setting app file permissions"
+          kamal server exec "chown -R 1654:1654 /opt/docker/${{ env.repository_name }}/App_Data /opt/docker/${{ env.repository_name }}/initdb.d"
+
       - name: Check if first run and execute kamal app boot if necessary
         run: |
-          FIRST_RUN_FILE=".${{ env.repository_name }}"
-          if ! kamal server exec --no-interactive -q "test -f $FIRST_RUN_FILE"; then
-            kamal server exec --no-interactive -q "touch $FIRST_RUN_FILE" || true
+          FIRST_RUN_FILE="~/first-run/${{ env.repository_name }}"
+          if ! kamal server exec -q "test -f $FIRST_RUN_FILE"; then
+            kamal server exec -q "mkdir -p ~/first-run && touch $FIRST_RUN_FILE" || true
+
+            if [ -n "${{env.INIT_DB_SQL}}" ]; then
+              echo "Initializing DB with INIT_DB_SQL secret..."
+              # Save the SQL content to a temporary file
+              echo "${{ env.INIT_DB_SQL }}" > init-db.sql
+              cat init-db.sql | kamal server exec -i "cat > /opt/docker/${{ env.repository_name }}/initdb.d/${{ env.repository_name }}.sql" && rm init-db.sql || true
+            fi
+            # Start all kamal accessories
+            kamal accessory boot all || true
+
+            # Deploy latest version
             kamal deploy -q -P --version latest || true
           else
             echo "Not first run, skipping kamal app boot"
-          fi          
+          fi
 
-      - name: Ensure file permissions
+      - name: Verify file permissions before deploy
         run: |
-          kamal server exec --no-interactive "mkdir -p /opt/docker/${{ env.repository_name }}/App_Data && chown -R 1654:1654 /opt/docker/${{ env.repository_name }}"
+          kamal server exec --no-interactive "chown -R 1654:1654 /opt/docker/${{ env.repository_name }}/App_Data /opt/docker/${{ env.repository_name }}/initdb.d"
+
+      - name: Deploy with Kamal
+        run: |
+          kamal lock release -v
+          kamal server exec --no-interactive 'echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin'
+          kamal server exec --no-interactive 'docker pull ghcr.io/${{ env.image_repository_name }}:latest'
+          kamal deploy -P --version latest
 
       - name: Migration
         if: env.HAS_MIGRATIONS == 'true'
         run: |
-          kamal server exec --no-interactive 'echo "${{ env.KAMAL_REGISTRY_PASSWORD }}" | docker login ghcr.io -u ${{ env.KAMAL_REGISTRY_USERNAME }} --password-stdin'
-          kamal server exec --no-interactive "docker pull ghcr.io/${{ env.image_repository_name }}:latest || true"
           kamal app exec --no-reuse --no-interactive --version=latest "--AppTasks=migrate"
-
-      - name: Deploy with Kamal
-        run: |
-          kamal lock release -v
-          kamal server exec --no-interactive 'echo "${{ env.KAMAL_REGISTRY_PASSWORD }}" | docker login ghcr.io -u ${{ env.KAMAL_REGISTRY_USERNAME }} --password-stdin'
-          kamal deploy -P --version latest
