129 lines
4.3 KiB
YAML
129 lines
4.3 KiB
YAML
name: Backend - Build & Lint
|
|
|
|
on:
|
|
push:
|
|
branches: [main, pre-prod]
|
|
paths:
|
|
- "backend/**/**"
|
|
pull_request:
|
|
branches: [main, pre-prod]
|
|
paths:
|
|
- "backend/**/**"
|
|
|
|
jobs:
|
|
lint:
|
|
name: Static Analysis (golangci-lint + gosec)
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.24.4"
|
|
cache-dependency-path: backend/gestion/go.sum
|
|
|
|
- name: Download dependencies
|
|
working-directory: backend/gestion
|
|
run: go mod download
|
|
|
|
- name: golangci-lint
|
|
uses: golangci/golangci-lint-action@v6
|
|
continue-on-error: true
|
|
with:
|
|
version: latest
|
|
working-directory: backend/gestion
|
|
args: --timeout=5m
|
|
|
|
- name: Install gosec
|
|
run: go install github.com/securego/gosec/v2/cmd/gosec@latest
|
|
|
|
- name: Run Gosec Security Scanner
|
|
working-directory: backend/gestion
|
|
run: gosec ./...
|
|
continue-on-error: true
|
|
|
|
build:
|
|
name: Build
|
|
needs: lint
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.24.4"
|
|
cache-dependency-path: backend/gestion/go.sum
|
|
|
|
- name: Download dependencies
|
|
working-directory: backend/gestion
|
|
run: go mod download
|
|
|
|
- name: Build
|
|
working-directory: backend/gestion
|
|
run: go build -v ./...
|
|
|
|
- name: Upload binary
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: backend-binary
|
|
path: backend/gestion/gestion
|
|
retention-days: 7
|
|
|
|
docker:
|
|
name: Docker Build & Push
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
if: >
|
|
github.event_name == 'push' &&
|
|
(github.ref == 'refs/heads/main' || github.ref == 'refs/heads/pre-prod')
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build & push backend (runtime)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: docker-pre-prod/backend/Dockerfile
|
|
target: runtime
|
|
push: true
|
|
tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'latest' || 'pre-prod' }}
|
|
|
|
- name: Build & push WAF
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: docker-pre-prod/backend/Dockerfile
|
|
target: waf
|
|
push: true
|
|
tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'waf' || 'waf-pre-prod' }}
|
|
|
|
deploy:
|
|
name: SSH Deploy
|
|
needs: docker
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: SSH deploy
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST_PRE_PROD }}
|
|
username: ${{ secrets.SERVER_USER }}
|
|
key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY_PRE_PROD }}
|
|
script: |
|
|
docker compose -f ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.COMPOSE_PATH_PROD || secrets.COMPOSE_PATH_PRE_PROD }} pull backend waf
|
|
docker compose -f ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.COMPOSE_PATH_PROD || secrets.COMPOSE_PATH_PRE_PROD }} up -d --no-deps backend waf
|