Xor290/projet_gestion_commande
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update ci

Browse Source
This commit is contained in:
Xor290
2026-06-10 13:58:38 +02:00
parent ee0abcd223
commit 27558d7651
28 changed files with 2329 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/backend-build.yml
+22 -8
View File
@@ -2,17 +2,17 @@ name: Backend - Build & Lint
on:
push:
branches: [main]
branches: [main, pre-prod]
paths:
- "backend/**/**"
pull_request:
branches: [main]
branches: [main, pre-prod]
paths:
- "backend/**/**"
jobs:
lint:
name: Static Analysis (golangci-lint)
name: Static Analysis (golangci-lint + gosec)
runs-on: ubuntu-latest
steps:
@@ -24,6 +24,10 @@ jobs:
go-version: "1.24.4"
cache-dependency-path: backend/gestion/go.sum
- name: Download dependencies
working-directory: backend/gestion
run: go mod download
- name: golangci-lint
uses: golangci/golangci-lint-action@v6
continue-on-error: true
@@ -32,6 +36,14 @@ jobs:
working-directory: backend/gestion
args: --timeout=5m
- name: Install gosec
run: go install github.com/securego/gosec/v2/cmd/gosec@latest
- name: Run Gosec Security Scanner
working-directory: backend/gestion
run: gosec ./...
continue-on-error: true
build:
name: Build
needs: lint
@@ -65,7 +77,9 @@ jobs:
name: Docker Build & Push
needs: build
runs-on: ubuntu-latest
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
if: >
github.event_name == 'push' &&
(github.ref == 'refs/heads/main' || github.ref == 'refs/heads/pre-prod')
steps:
- uses: actions/checkout@v4
@@ -86,7 +100,7 @@ jobs:
file: docker/backend/Dockerfile
target: runtime
push: true
tags: xor1234/backend-mln:latest
tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'latest' || 'pre-prod' }}
- name: Build & push WAF
uses: docker/build-push-action@v6
@@ -95,7 +109,7 @@ jobs:
file: docker/backend/Dockerfile
target: waf
push: true
tags: xor1234/backend-mln:waf
tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'waf' || 'waf-pre-prod' }}
deploy:
name: SSH Deploy
@@ -106,9 +120,9 @@ jobs:
- name: SSH deploy
uses: appleboy/ssh-action@v1
with:
host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST }}
host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST_PRE_PROD }}
username: ${{ secrets.SERVER_USER }}
key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY }}
key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY_PRE_PROD }}
script: |
docker compose -f ${{ secrets.COMPOSE_PATH }} pull backend waf
docker compose -f ${{ secrets.COMPOSE_PATH }} up -d --no-deps backend waf
.github/workflows/frontend-admin-build.yml
+122 -17
View File
@@ -13,7 +13,6 @@ on:
jobs:
typecheck:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
@@ -35,7 +34,6 @@ jobs:
build-apk:
needs: typecheck
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
@@ -46,11 +44,19 @@ jobs:
cache: npm
cache-dependency-path: frontend-admin/package-lock.json
- name: Setup Expo & EAS CLI
uses: expo/expo-github-action@v8
- name: Setup Java
uses: actions/setup-java@v4
with:
eas-version: latest
token: ${{ secrets.EXPO_TOKEN }}
distribution: temurin
java-version: 17
- name: Setup Android SDK
uses: android-actions/setup-android@v3
- name: Install EAS CLI & cache deps
run: |
npm install -g eas-cli
pip install -r scripts/requirements.txt --quiet
- name: Install dependencies
working-directory: frontend-admin
@@ -62,21 +68,120 @@ jobs:
jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID }}"' app.json > app.tmp.json
mv app.tmp.json app.json
- name: Build APK
- name: Determine build profile & env
id: config
run: |
if [ "${{ github.ref_name }}" = "main" ] || [ "${{ github.base_ref }}" = "main" ]; then
echo "profile=production" >> $GITHUB_OUTPUT
echo "channel=production-admin" >> $GITHUB_OUTPUT
echo "api_url=${{ secrets.PROD_API_URL }}" >> $GITHUB_OUTPUT
echo "update_url=${{ secrets.XAVIA_API_URL }}" >> $GITHUB_OUTPUT
echo "apk_name=admin-panel-production-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
else
echo "profile=pre-prod" >> $GITHUB_OUTPUT
echo "channel=pre-prod-admin" >> $GITHUB_OUTPUT
echo "api_url=${{ secrets.PREPROD_API_URL }}" >> $GITHUB_OUTPUT
echo "update_url=${{ secrets.XAVIA_API_URL }}" >> $GITHUB_OUTPUT
echo "apk_name=admin-panel-pre-prod-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
fi
- name: Restore Gradle cache (RustFS)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
S3_ENDPOINT: https://rustfs.uber-stup.club
S3_BUCKET: apk-builds
run: python scripts/eas_cache.py restore --app frontend-admin
- name: Build APK (local)
working-directory: frontend-admin
env:
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.update_url }}
EAS_BUILD_NO_EXPO_GO_WARNING: true
run: eas build --platform android ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && '--profile production' || '--profile preview' }} --non-interactive
GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx4096m -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError"
JAVA_TOOL_OPTIONS: "-Xmx4096m"
run: eas build --platform android --profile ${{ steps.config.outputs.profile }} --local --non-interactive
- name: Download APK
- name: Save Gradle cache (RustFS)
if: success() || failure()
env:
AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
S3_ENDPOINT: https://rustfs.uber-stup.club
S3_BUCKET: apk-builds
run: python scripts/eas_cache.py save --app frontend-admin
- name: Rename APK
working-directory: frontend-admin
run: mv *.apk ${{ steps.config.outputs.apk_name }}
- name: Upload APK to RustFS
working-directory: frontend-admin
env:
AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
aws s3 cp ${{ steps.config.outputs.apk_name }} \
s3://apk-builds/${{ steps.config.outputs.profile }}/${{ steps.config.outputs.apk_name }} \
--endpoint-url https://rustfs.uber-stup.club \
--no-verify-ssl
ota-update:
needs: build-apk
runs-on: ubuntu-latest
# Ne publie pas sur les PR, seulement sur les pushs
if: github.event_name == 'push'
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
cache-dependency-path: frontend-admin/package-lock.json
- name: Install dependencies
working-directory: frontend-admin
run: npm ci
- name: Determine channel & env
id: config
run: |
if [ "${{ github.ref_name }}" = "main" ]; then
echo "channel=production-admin" >> $GITHUB_OUTPUT
echo "api_url=https://mln-uber.club" >> $GITHUB_OUTPUT
echo "message=Production update $(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT
else
echo "channel=pre-prod-admin" >> $GITHUB_OUTPUT
echo "api_url=https://5.181.0.112.nip.io" >> $GITHUB_OUTPUT
echo "message=Pre-prod update $(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT
fi
- name: Inject EAS project ID
working-directory: frontend-admin
run: |
APK_URL=$(eas build:list --platform android --status finished --limit 1 --json --non-interactive | jq -r '.[0].artifacts.buildUrl')
curl -L -o admin-panel-prod.apk "$APK_URL"
jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID }}"' app.json > app.tmp.json
mv app.tmp.json app.json
- name: Upload production APK artifact
uses: actions/upload-artifact@v4
with:
name: admin-panel-android-prod-apk
path: frontend-admin/admin-panel-prod.apk
retention-days: 14
- name: Publish OTA update to Xavia
working-directory: frontend-admin
env:
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}
run: |
RUNTIME_VERSION=$(jq -r '.expo.version' app.json)
npx expo export --platform android --output-dir dist
cd dist && zip -r ../bundle.zip . && cd ..
curl -X POST "${{ secrets.XAVIA_API_URL }}/api/upload" \
-H "Authorization: Bearer ${{ secrets.XAVIA_API_KEY }}" \
-F "file=@bundle.zip" \
-F "runtimeVersion=$RUNTIME_VERSION" \
-F "channel=${{ steps.config.outputs.channel }}" \
-F "commitHash=${{ github.sha }}" \
-F "commitMessage=${{ steps.config.outputs.message }}" \
--fail
.github/workflows/frontend-client-build.yml
+121 -20
View File
@@ -13,7 +13,6 @@ on:
jobs:
typecheck:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
@@ -35,7 +34,6 @@ jobs:
build-apk:
needs: typecheck
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
@@ -46,11 +44,19 @@ jobs:
cache: npm
cache-dependency-path: mobile/package-lock.json
- name: Setup Expo & EAS CLI
uses: expo/expo-github-action@v8
- name: Setup Java
uses: actions/setup-java@v4
with:
eas-version: latest
token: ${{ secrets.EXPO_TOKEN }}
distribution: temurin
java-version: 17
- name: Setup Android SDK
uses: android-actions/setup-android@v3
- name: Install EAS CLI & cache deps
run: |
npm install -g eas-cli
pip install -r scripts/requirements.txt --quiet
- name: Install dependencies
working-directory: mobile
@@ -62,25 +68,120 @@ jobs:
jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID_CLIENT }}"' app.json > app.tmp.json
mv app.tmp.json app.json
- name: Debug app.json
working-directory: mobile
run: cat app.json
- name: Determine build profile & env
id: config
run: |
if [ "${{ github.ref_name }}" = "main" ] || [ "${{ github.base_ref }}" = "main" ]; then
echo "profile=production" >> $GITHUB_OUTPUT
echo "channel=production-client" >> $GITHUB_OUTPUT
echo "api_url=${{ secrets.PROD_API_URL }}" >> $GITHUB_OUTPUT
echo "update_url=${{ secrets.XAVIA_API_URL }}" >> $GITHUB_OUTPUT
echo "apk_name=mobile-production-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
else
echo "profile=pre-prod" >> $GITHUB_OUTPUT
echo "channel=pre-prod-client" >> $GITHUB_OUTPUT
echo "api_url=${{ secrets.PREPROD_API_URL }}" >> $GITHUB_OUTPUT
echo "update_url=${{ secrets.XAVIA_API_URL }}" >> $GITHUB_OUTPUT
echo "apk_name=mobile-pre-prod-$(date +%Y%m%d-%H%M).apk" >> $GITHUB_OUTPUT
fi
- name: Build APK
- name: Restore Gradle cache (RustFS)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
S3_ENDPOINT: https://rustfs.uber-stup.club
S3_BUCKET: apk-builds
run: python scripts/eas_cache.py restore --app mobile
- name: Build APK (local)
working-directory: mobile
env:
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
EXPO_PUBLIC_UPDATE_URL: ${{ steps.config.outputs.update_url }}
EAS_BUILD_NO_EXPO_GO_WARNING: true
run: eas build --platform android ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && '--profile production' || '--profile preview' }} --non-interactive
GRADLE_OPTS: "-Dorg.gradle.jvmargs=-Xmx4096m -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError"
JAVA_TOOL_OPTIONS: "-Xmx4096m"
run: eas build --platform android --profile ${{ steps.config.outputs.profile }} --local --non-interactive
- name: Download production APK
- name: Save Gradle cache (RustFS)
if: success() || failure()
env:
AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
S3_ENDPOINT: https://rustfs.uber-stup.club
S3_BUCKET: apk-builds
run: python scripts/eas_cache.py save --app mobile
- name: Rename APK
working-directory: mobile
run: mv *.apk ${{ steps.config.outputs.apk_name }}
- name: Upload APK to RustFS
working-directory: mobile
env:
AWS_ACCESS_KEY_ID: ${{ secrets.RUSTFS_ACCESS_KEY }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.RUSTFS_SECRET_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
aws s3 cp ${{ steps.config.outputs.apk_name }} \
s3://apk-builds/${{ steps.config.outputs.profile }}/${{ steps.config.outputs.apk_name }} \
--endpoint-url https://rustfs.uber-stup.club \
--no-verify-ssl
ota-update:
needs: build-apk
runs-on: ubuntu-latest
# Ne publie pas sur les PR, seulement sur les pushs
if: github.event_name == 'push'
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
cache-dependency-path: mobile/package-lock.json
- name: Install dependencies
working-directory: mobile
run: npm ci
- name: Determine channel & env
id: config
run: |
if [ "${{ github.ref_name }}" = "main" ]; then
echo "channel=production-client" >> $GITHUB_OUTPUT
echo "api_url=${{ secrets.PROD_API_URL }}" >> $GITHUB_OUTPUT
echo "message=Production update $(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT
else
echo "channel=pre-prod-client" >> $GITHUB_OUTPUT
echo "api_url=${{ secrets.PREPROD_API_URL }}" >> $GITHUB_OUTPUT
echo "message=Pre-prod update $(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT
fi
- name: Inject EAS project ID
working-directory: mobile
run: |
APK_URL=$(eas build:list --platform android --status finished --limit 1 --json --non-interactive | jq -r '.[0].artifacts.buildUrl')
curl -L -o client-panel-prod.apk "$APK_URL"
jq '.expo.extra.eas.projectId = "${{ secrets.EXPO_PROJECT_ID_CLIENT }}"' app.json > app.tmp.json
mv app.tmp.json app.json
- name: Upload production APK artifact
uses: actions/upload-artifact@v4
with:
name: client-panel-android-prod-apk
path: mobile/client-panel-prod.apk
retention-days: 14
- name: Publish OTA update to Xavia
working-directory: mobile
env:
EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
EXPO_PUBLIC_API_URL: ${{ steps.config.outputs.api_url }}
EXPO_PUBLIC_UPDATE_URL: ${{ secrets.XAVIA_API_URL }}
run: |
RUNTIME_VERSION=$(jq -r '.expo.version' app.json)
npx expo export --platform android --output-dir dist
cd dist && zip -r ../bundle.zip . && cd ..
curl -X POST "${{ secrets.XAVIA_API_URL }}/api/upload" \
-H "Authorization: Bearer ${{ secrets.XAVIA_API_KEY }}" \
-F "file=@bundle.zip" \
-F "runtimeVersion=$RUNTIME_VERSION" \
-F "channel=${{ steps.config.outputs.channel }}" \
-F "commitHash=${{ github.sha }}" \
-F "commitMessage=${{ steps.config.outputs.message }}" \
--fail
.github/workflows/frontend-web-build.yml
+2 -2
View File
@@ -103,9 +103,9 @@ jobs:
- name: SSH deploy
uses: appleboy/ssh-action@v1
with:
host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST }}
host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST_PRE_PROD }}
username: ${{ secrets.SERVER_USER }}
key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY }}
key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY_PRE_PROD }}
script: |
docker compose -f ${{ secrets.COMPOSE_PATH }} pull frontend
docker compose -f ${{ secrets.COMPOSE_PATH }} up -d --no-deps frontend