-
Notifications
You must be signed in to change notification settings - Fork 0
ADD - CI/CD #5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
ADD - CI/CD #5
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,141 @@ | ||
| name: "DEV - CI/CD" | ||
|
|
||
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, reopened] | ||
| branches: | ||
| - develop | ||
| - main | ||
| push: | ||
| branches: | ||
| - main # pour que PROD puisse se déclencher automatiquement si besoin | ||
|
|
||
| jobs: | ||
| # 1️⃣ Build & tests | ||
| build-and-test: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v3 | ||
| with: | ||
| version: 9 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| cache: 'pnpm' | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile | ||
|
|
||
| - name: Generate Prisma Client | ||
| run: pnpm prisma generate | ||
|
|
||
| - name: Skip tests (no test script defined) | ||
| run: echo "⚠️ Aucun test défini, étape ignorée." | ||
|
|
||
| - name: Build app | ||
| run: pnpm build | ||
|
|
||
| # 2️⃣ Build & push Docker image | ||
| docker-build-push: | ||
| runs-on: ubuntu-latest | ||
| needs: build-and-test | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| env: | ||
| REGISTRY: ghcr.io | ||
| IMAGE_NAME: ${{ github.repository }} | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ${{ env.REGISTRY }} | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Extract metadata (tags, labels) for Docker | ||
| id: meta | ||
| uses: docker/metadata-action@v5 | ||
| with: | ||
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | ||
| tags: | | ||
| type=raw,value=latest | ||
| type=sha,format=long | ||
|
|
||
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@v5 | ||
| with: | ||
| context: . | ||
| push: true | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} | ||
| build-args: | | ||
| NEXT_PUBLIC_ENV=${{ github.base_ref }} | ||
|
|
||
| # 3️⃣ Deploy DEV (auto sur PR) | ||
| deploy-dev: | ||
| runs-on: self-hosted | ||
| needs: docker-build-push | ||
|
|
||
| steps: | ||
| - name: Clean workspace | ||
| run: rm -rf * | ||
|
|
||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Pull new image + restart DEV stack | ||
| run: | | ||
| echo "🔧 Deploying on DEV..." | ||
| cd /home/baptiste/Dev/WPT/dev | ||
| docker-compose pull | ||
| docker rm -f wpt-dev_website || true | ||
| docker-compose up -d --remove-orphans | ||
| echo "🚀 Deployed in DEV!" | ||
|
|
||
| # 4️⃣ Deploy PROD (skip par défaut, relançable sur main) | ||
| deploy-prod: | ||
| runs-on: self-hosted | ||
| needs: docker-build-push | ||
| if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' | ||
| steps: | ||
| - name: Clean workspace | ||
| run: rm -rf * | ||
|
|
||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Log in to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Pull new image + restart PROD stack | ||
| run: | | ||
| echo "🔧 Deploying on PROD..." | ||
| cd /home/baptiste/Dev/WPT/prod | ||
| docker-compose pull | ||
| docker rm -f wpt_website || true | ||
| docker-compose up -d --remove-orphans | ||
| echo "🚀 Deployed in PROD!" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,74 @@ | ||
| # Étape 1 : build | ||
| FROM node:22-alpine AS builder | ||
| FROM node:22-alpine AS base | ||
|
|
||
| # Install dependencies only when needed | ||
| FROM base AS deps | ||
| # Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed. | ||
| RUN apk add --no-cache libc6-compat openssl | ||
| WORKDIR /app | ||
| RUN npm install -g pnpm | ||
|
|
||
| # Install pnpm | ||
| RUN corepack enable && corepack prepare pnpm@latest --activate | ||
|
|
||
| # Install dependencies based on pnpm | ||
| COPY package.json pnpm-lock.yaml ./ | ||
| COPY .env .env | ||
| RUN pnpm install | ||
| RUN pnpm install --frozen-lockfile | ||
|
|
||
| FROM base AS dev | ||
| WORKDIR /app | ||
| RUN corepack enable && corepack prepare pnpm@latest --activate | ||
| RUN apk add --no-cache openssl | ||
| COPY --from=deps /app/node_modules ./node_modules | ||
| COPY . . | ||
|
|
||
| # Generates prisma files | ||
| RUN pnpm prisma generate | ||
|
|
||
| # Enables Hot Reloading Check https://github.com/vercel/next.js/issues/36774 for more information | ||
| ENV CHOKIDAR_USEPOLLING=true | ||
| ENV WATCHPACK_POLLING=true | ||
|
|
||
| # Rebuild the source code only when needed | ||
| FROM base AS builder | ||
| WORKDIR /app | ||
| RUN corepack enable && corepack prepare pnpm@latest --activate | ||
| RUN apk add --no-cache openssl | ||
| COPY --from=deps /app/node_modules ./node_modules | ||
| COPY . . | ||
|
|
||
| ENV NEXT_TELEMETRY_DISABLED 1 | ||
|
|
||
| # Generates prisma files for production build | ||
| RUN pnpm prisma generate | ||
| RUN pnpm build | ||
|
|
||
| # Étape 2 : image finale propre | ||
| FROM node:22-alpine | ||
| # Production image, copy all the files and run next | ||
| FROM base AS runner | ||
| WORKDIR /app | ||
| RUN npm install -g pnpm | ||
| COPY --from=builder /app/package.json /app/pnpm-lock.yaml ./ | ||
| COPY --from=builder /app/.next ./.next | ||
| COPY --from=builder /app/public ./public | ||
| COPY --from=builder /app/next.config.ts ./ | ||
| COPY --from=builder /app/tsconfig.json ./ | ||
|
|
||
| RUN pnpm install --prod | ||
| ENV NODE_ENV production | ||
| ENV NEXT_TELEMETRY_DISABLED 1 | ||
|
|
||
| RUN apk add --no-cache openssl | ||
| RUN addgroup --system --gid 1001 nodejs | ||
| RUN adduser --system --uid 1001 nextjs | ||
|
|
||
| # Install pnpm in runner | ||
| RUN corepack enable && corepack prepare pnpm@latest --activate | ||
|
|
||
| # Copier les fichiers nécessaires | ||
| COPY --from=builder --chown=nextjs:nodejs /app/package.json ./ | ||
| COPY --from=builder --chown=nextjs:nodejs /app/pnpm-lock.yaml ./ | ||
| COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules | ||
| COPY --from=builder --chown=nextjs:nodejs /app/.next ./.next | ||
| COPY --from=builder --chown=nextjs:nodejs /app/public ./public | ||
| COPY --from=builder --chown=nextjs:nodejs /app/prisma ./prisma | ||
| COPY --from=builder --chown=nextjs:nodejs /app/next.config.ts ./ | ||
|
|
||
| USER nextjs | ||
|
|
||
| EXPOSE 3000 | ||
| CMD ["pnpm", "start"] | ||
| ENV PORT 3000 | ||
| ENV HOSTNAME "0.0.0.0" | ||
|
|
||
| # Prisma generate + db push + start | ||
| CMD sh -c "pnpm prisma generate && pnpm prisma db push --accept-data-loss && pnpm start" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI about 2 months ago
To fix the problem, add a
permissionsblock to thedeploy-prodjob, restricting the GITHUB_TOKEN to the least required privileges (likelycontents: read). This ensures that thedeploy-prodjob cannot unexpectedly write to source code or other resources via the token. Place the following block directly under theruns-onand aboveneeds(or immediately afterneeds, if preferred for consistency):This matches the minimal usage for jobs that only need to fetch code or authenticate for Docker pulls. Review other self-hosted jobs (
deploy-dev), and add a similar block if appropriate, but CodeQL only explicitly flaggeddeploy-prod, so let's just do that per instructions. No imports or other definitions are necessary—just a YAML block.