Skip to content

Commit da4cc33

Browse files
motatoesmotatoes
authored
Merge pull request #19 from diggerhq/feat/ci-deploy-pipelines
Add CI/CD pipelines for server, worker, and SDK publishing
2 parents 297bfcd + 2fc8682 commit da4cc33

File tree

4 files changed

+234
-0
lines changed

4 files changed

+234
-0
lines changed

‎.github/workflows/deploy-server.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: Deploy Control Plane
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'cmd/server/**'
8+
- 'internal/**'
9+
- 'web/**'
10+
- 'go.mod'
11+
- 'go.sum'
12+
- '.github/workflows/deploy-server.yml'
13+
workflow_dispatch:
14+
15+
env:
16+
SSH_USER: ubuntu
17+
GOARCH: amd64
18+
19+
jobs:
20+
deploy:
21+
name: Build & Deploy Server
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@v4
25+
26+
- uses: actions/setup-go@v5
27+
with:
28+
go-version: '1.23'
29+
30+
- uses: actions/setup-node@v4
31+
with:
32+
node-version: '20'
33+
34+
- name: Build server binary
35+
run: CGO_ENABLED=0 GOOS=linux GOARCH=${{ env.GOARCH }} go build -o bin/opensandbox-server ./cmd/server/
36+
37+
- name: Build web dashboard
38+
run: cd web && npm ci && npm run build
39+
40+
- name: Package web assets
41+
run: tar czf bin/web-dist.tar.gz -C web dist
42+
43+
- name: Configure SSH
44+
run: |
45+
mkdir -p ~/.ssh
46+
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy.pem
47+
chmod 600 ~/.ssh/deploy.pem
48+
ssh-keyscan -H ${{ secrets.SERVER_IP }} >> ~/.ssh/known_hosts
49+
50+
- name: Upload artifacts
51+
run: |
52+
scp -i ~/.ssh/deploy.pem bin/opensandbox-server ${{ env.SSH_USER }}@${{ secrets.SERVER_IP }}:/tmp/opensandbox-server
53+
scp -i ~/.ssh/deploy.pem bin/web-dist.tar.gz ${{ env.SSH_USER }}@${{ secrets.SERVER_IP }}:/tmp/web-dist.tar.gz
54+
55+
- name: Install and restart
56+
run: |
57+
ssh -i ~/.ssh/deploy.pem ${{ env.SSH_USER }}@${{ secrets.SERVER_IP }} '
58+
sudo mv /tmp/opensandbox-server /usr/local/bin/opensandbox-server
59+
sudo chmod +x /usr/local/bin/opensandbox-server
60+
sudo mkdir -p /opt/opensandbox/web
61+
sudo tar xzf /tmp/web-dist.tar.gz -C /opt/opensandbox/web
62+
rm /tmp/web-dist.tar.gz
63+
sudo systemctl restart opensandbox-server
64+
'
65+
66+
- name: Pull secrets from AWS Secrets Manager
67+
run: |
68+
ssh -i ~/.ssh/deploy.pem ${{ env.SSH_USER }}@${{ secrets.SERVER_IP }} '
69+
SECRETS_ARN=$(grep OPENSANDBOX_SECRETS_ARN /etc/opensandbox/server.env 2>/dev/null | cut -d= -f2-) || true
70+
if [ -n "$SECRETS_ARN" ]; then
71+
SECRETS_JSON=$(aws --region us-east-2 secretsmanager get-secret-value \
72+
--secret-id "$SECRETS_ARN" --query SecretString --output text 2>&1) || {
73+
echo "WARNING: Failed to pull secrets, using existing env file."
74+
exit 0
75+
}
76+
echo "$SECRETS_JSON" | python3 -c "
77+
import json, sys
78+
secrets = json.load(sys.stdin)
79+
existing = {}
80+
try:
81+
with open(\"/etc/opensandbox/server.env\") as f:
82+
for line in f:
83+
line = line.strip()
84+
if line and not line.startswith(\"#\") and \"=\" in line:
85+
k, v = line.split(\"=\", 1)
86+
existing[k] = v
87+
except FileNotFoundError:
88+
pass
89+
existing.update(secrets)
90+
with open(\"/tmp/server.env.new\", \"w\") as f:
91+
for k, v in existing.items():
92+
f.write(f\"{k}={v}\n\")
93+
" && sudo mv /tmp/server.env.new /etc/opensandbox/server.env
94+
echo "Secrets merged."
95+
fi
96+
'
97+
98+
- name: Verify deployment
99+
run: |
100+
sleep 3
101+
ssh -i ~/.ssh/deploy.pem ${{ env.SSH_USER }}@${{ secrets.SERVER_IP }} 'sudo systemctl is-active opensandbox-server'
102+
echo "Server deployed successfully!"

‎.github/workflows/deploy-worker.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Deploy Worker
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'cmd/worker/**'
8+
- 'cmd/agent/**'
9+
- 'internal/**'
10+
- 'go.mod'
11+
- 'go.sum'
12+
- '.github/workflows/deploy-worker.yml'
13+
workflow_dispatch:
14+
15+
env:
16+
SSH_USER: ubuntu
17+
GOARCH: arm64
18+
19+
jobs:
20+
deploy:
21+
name: Build & Deploy Worker
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@v4
25+
26+
- uses: actions/setup-go@v5
27+
with:
28+
go-version: '1.23'
29+
30+
- name: Build worker binary
31+
run: CGO_ENABLED=0 GOOS=linux GOARCH=${{ env.GOARCH }} go build -o bin/opensandbox-worker ./cmd/worker/
32+
33+
- name: Build agent binary
34+
run: CGO_ENABLED=0 GOOS=linux GOARCH=${{ env.GOARCH }} go build -o bin/osb-agent ./cmd/agent/
35+
36+
- name: Configure SSH
37+
run: |
38+
mkdir -p ~/.ssh
39+
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy.pem
40+
chmod 600 ~/.ssh/deploy.pem
41+
ssh-keyscan -H ${{ secrets.WORKER_IP }} >> ~/.ssh/known_hosts
42+
43+
- name: Upload binaries
44+
run: |
45+
scp -i ~/.ssh/deploy.pem bin/opensandbox-worker ${{ env.SSH_USER }}@${{ secrets.WORKER_IP }}:/tmp/opensandbox-worker
46+
scp -i ~/.ssh/deploy.pem bin/osb-agent ${{ env.SSH_USER }}@${{ secrets.WORKER_IP }}:/tmp/osb-agent
47+
48+
- name: Install and restart
49+
run: |
50+
ssh -i ~/.ssh/deploy.pem ${{ env.SSH_USER }}@${{ secrets.WORKER_IP }} '
51+
sudo mv /tmp/opensandbox-worker /usr/local/bin/opensandbox-worker
52+
sudo chmod +x /usr/local/bin/opensandbox-worker
53+
sudo mv /tmp/osb-agent /usr/local/bin/osb-agent
54+
sudo chmod +x /usr/local/bin/osb-agent
55+
sudo systemctl restart opensandbox-worker
56+
'
57+
58+
- name: Verify deployment
59+
run: |
60+
sleep 3
61+
ssh -i ~/.ssh/deploy.pem ${{ env.SSH_USER }}@${{ secrets.WORKER_IP }} 'sudo systemctl is-active opensandbox-worker'
62+
echo "Worker deployed successfully!"

‎.github/workflows/publish-python-sdk.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Publish Python SDK
2+
3+
on:
4+
push:
5+
tags:
6+
- 'py-sdk-v*'
7+
workflow_dispatch:
8+
9+
defaults:
10+
run:
11+
working-directory: sdks/python
12+
13+
jobs:
14+
publish:
15+
name: Build & Publish to PyPI
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
id-token: write
20+
environment: pypi
21+
steps:
22+
- uses: actions/checkout@v4
23+
24+
- name: Install uv
25+
uses: astral-sh/setup-uv@v4
26+
27+
- name: Build package
28+
run: uv build
29+
30+
- name: Publish to PyPI
31+
uses: pypa/gh-action-pypi-publish@release/v1
32+
with:
33+
packages-dir: sdks/python/dist/

‎.github/workflows/publish-ts-sdk.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Publish TypeScript SDK
2+
3+
on:
4+
push:
5+
tags:
6+
- 'ts-sdk-v*'
7+
workflow_dispatch:
8+
9+
defaults:
10+
run:
11+
working-directory: sdks/typescript
12+
13+
jobs:
14+
publish:
15+
name: Build & Publish to npm
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
id-token: write
20+
steps:
21+
- uses: actions/checkout@v4
22+
23+
- uses: actions/setup-node@v4
24+
with:
25+
node-version: '20'
26+
registry-url: 'https://registry.npmjs.org'
27+
28+
- name: Install dependencies
29+
run: npm ci
30+
31+
- name: Build
32+
run: npm run build
33+
34+
- name: Publish
35+
run: npm publish --provenance --access public
36+
env:
37+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

0 commit comments

Comments
 (0)