Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 81 additions & 15 deletions .github/workflows/web-sync-server-deploy.yml
Original file line number Diff line number Diff line change
@@ -1,22 +1,28 @@
name: Web Sync Server deploy

on:
push:
branches:
- main
paths:
- '.github/workflows/web-sync-server*'
- 'moon/apps/sync-server/**'
- 'moon/packages/editor/**'
- 'moon/packages/config/**'
- 'moon/packages/types/**'

- ".github/workflows/web-sync-server*"
- "moon/apps/sync-server/**"
- "moon/packages/editor/**"
- "moon/packages/config/**"
- "moon/packages/types/**"

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

env:
REGISTRY_ALIAS: m8q5m4u3
REPOSITORY: mega/web-sync-server
IMAGE_TAG: latest
GCP_PROJECT_ID: infra-20250121-20260121-0235

jobs:
web-sync-server-deploy:
build-and-push:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
Expand All @@ -25,7 +31,7 @@

- uses: actions/setup-node@v4
with:
node-version: '20'
node-version: "20"

- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v4
Expand All @@ -40,26 +46,86 @@
with:
registry-type: public

- name: Auth to GCP
uses: google-github-actions/auth@v2
with:
credentials_json: ${{ secrets.GCP_SA_KEY }}

- name: Configure docker for GCP
run: gcloud auth configure-docker us-central1-docker.pkg.dev

- name: Build, tag, and push docker image to Amazon ECR Public
working-directory: moon
env:
REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
REGISTRY_ALIAS: m8q5m4u3
REPOSITORY: mega/web-sync-server
IMAGE_TAG: latest
run: |
set -euo pipefail

AWS_IMAGE_BASE="$REGISTRY/${{ env.REGISTRY_ALIAS }}/${{ env.REPOSITORY }}"
GCP_IMAGE_BASE="us-central1-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.REPOSITORY }}"
IMAGE_TAG="${{ env.IMAGE_TAG }}"

docker build \
-f apps/sync-server/Dockerfile \
-t $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG .
docker push $REGISTRY/$REGISTRY_ALIAS/$REPOSITORY:$IMAGE_TAG
-t "$AWS_IMAGE_BASE:$IMAGE_TAG" .

# Push to AWS ECR Public
docker push "$AWS_IMAGE_BASE:$IMAGE_TAG"

# Tag and push to GCP Artifact Registry
docker tag "$AWS_IMAGE_BASE:$IMAGE_TAG" "$GCP_IMAGE_BASE:$IMAGE_TAG"
docker push "$GCP_IMAGE_BASE:$IMAGE_TAG"

deploy-aws:
needs: build-and-push
if: ${{ github.repository == 'web3infra-foundation/mega' }}
runs-on: ubuntu-latest
strategy:
matrix:
include:
- cluster: gitmega-com
service: mega-web-sync-server-dev-service-v3hdlyk8
# TODO: update service name to actual gitmono sync server ECS service
- cluster: gitmono-com-mega-app
service: mega-web-sync-service
Comment on lines +88 to +90
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Replace placeholder gitmono ECS service name

The matrix includes a TODO stating the gitmono service name is not the actual one, but aws ecs update-service is executed unconditionally for that entry; if this placeholder does not match a real ECS service, the gitmono matrix leg fails and the deploy-aws job is marked failed on every run. This should be updated to the real service name before merging.

Useful? React with 👍 / 👎.

steps:
- name: Force ECS redeploy
run: |
aws ecs update-service \
--cluster gitmega-com \
--service mega-web-sync-server-dev-service-v3hdlyk8 \
--cluster ${{ matrix.cluster }} \
--service ${{ matrix.service }} \
--force-new-deployment
env:
AWS_REGION: ap-southeast-2
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

deploy-gcp:
Comment on lines +80 to +103

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
needs: build-and-push
if: ${{ github.repository == 'web3infra-foundation/mega' }}
runs-on: ubuntu-latest
steps:
- name: Auth to GCP
uses: google-github-actions/auth@v2
with:
credentials_json: ${{ secrets.GCP_SA_KEY }}

- name: Deploy to Cloud Run (force new revision)
env:
REGION: asia-east1
SERVICE_NAME: buck2hub-notesync
run: |
set -euo pipefail

IMAGE=$(gcloud run services describe "$SERVICE_NAME" \
--project "$GCP_PROJECT_ID" \
--region "$REGION" \
--format="value(spec.template.spec.containers[0].image)")

echo "Current image: $IMAGE"

gcloud run deploy "$SERVICE_NAME" \
--image "$IMAGE" \
--region "$REGION" \
--project "$GCP_PROJECT_ID" \
--quiet
Comment on lines +104 to +131

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
4 changes: 0 additions & 4 deletions moon/apps/sync-server/.env.buck2hub

This file was deleted.

4 changes: 0 additions & 4 deletions moon/apps/sync-server/.env.demo

This file was deleted.

10 changes: 0 additions & 10 deletions moon/apps/sync-server/.env.example

This file was deleted.

4 changes: 0 additions & 4 deletions moon/apps/sync-server/.env.gitmono

This file was deleted.

4 changes: 0 additions & 4 deletions moon/apps/sync-server/.env.openatom

This file was deleted.

4 changes: 0 additions & 4 deletions moon/apps/sync-server/.env.staging

This file was deleted.

4 changes: 0 additions & 4 deletions moon/apps/sync-server/.env.staging-nju

This file was deleted.

19 changes: 5 additions & 14 deletions moon/apps/sync-server/src/config.ts
Original file line number Diff line number Diff line change
@@ -1,21 +1,12 @@
import * as path from 'path'
import * as dotenv from 'dotenv'

// Load environment-specific .env file
// Priority: .env.{NODE_ENV} > .env.local > .env
const envFile = process.env.NODE_ENV ? `.env.${process.env.NODE_ENV}` : '.env.local'
const NODE_ENV = process.env.NODE_ENV || 'development'

dotenv.config({ path: path.resolve(process.cwd(), envFile) })

// Fallback to .env.local if environment-specific file doesn't exist
if (process.env.NODE_ENV && !process.env.API_URL) {
dotenv.config({ path: path.resolve(process.cwd(), '.env.local') })
// In non-production environments, load variables from .env.local for local development.
if (NODE_ENV !== 'production') {
dotenv.config({ path: '.env.local' })
}

// API URL - read from environment variable with fallback default
export const API_URL = process.env.API_URL || 'https://api.gitmega.com'

// Server Configuration
export const API_URL = process.env.API_URL
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Restore a guaranteed API_URL value

API_URL is now exported directly from process.env.API_URL without any fallback, while this commit also removes the checked-in sync-server .env.* files; in any environment where API_URL is not explicitly injected, the generated client will run with an empty base URL and issue relative fetches, which breaks sync/auth requests at runtime in Node. Please keep a safe default or fail fast during startup when API_URL is missing.

Useful? React with 👍 / 👎.

export const PORT = parseInt(process.env.PORT || '9000', 10)
export const NODE_ENV = process.env.NODE_ENV || 'development'
export const IS_PRODUCTION = NODE_ENV === 'production'
Loading