Add dev compose deployment for anal-front

.gitea/workflows/ci-cd.yml

@@ -0,0 +1,176 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches:
+      - dev
+      - "feature/**"
+      - "codex/**"
+  pull_request:
+    branches:
+      - dev
+
+concurrency:
+  group: anal-front-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  WEB_IMAGE: "anal-front-web"
+  DEPLOY_DOMAIN: "anal.dev.nii-ecos.ru"
+  DEPLOY_PATH: "/opt/anal-front"
+
+jobs:
+  quality:
+    name: Quality Gate
+    runs-on: [frontend, ubuntu-latest]
+    timeout-minutes: 120
+    env:
+      PLAYWRIGHT_BROWSERS_PATH: /root/.cache/ms-playwright
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4.2.2
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.9
+
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            /root/.bun/install/cache
+            node_modules
+          key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Generate API clients
+        run: bun run apigen
+
+      - name: Lint check
+        run: bun run lint
+
+      - name: Type check
+        run: bun run typecheck
+
+      - name: Unit tests
+        run: bun run test:unit
+
+      - name: Build
+        run: bun run build
+
+      - name: Resolve Playwright version
+        id: playwright-version
+        run: |
+          version="$(bunx playwright --version | awk '{ print $2 }')"
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v4
+        with:
+          path: /root/.cache/ms-playwright
+          key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright-version.outputs.version }}
+
+      - name: Install Playwright system deps
+        run: bunx playwright install-deps chromium
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: bunx playwright install chromium
+
+      - name: E2E
+        env:
+          CI: "1"
+          PLAYWRIGHT_HTML_OPEN: never
+        run: bun run test:e2e -- --reporter=line
+
+      - name: Docker build
+        run: docker build --pull -t analytical-panel-frontend:ci .
+
+  deploy_dev:
+    name: Build and Deploy Dev via Compose
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    needs: [quality]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev' && needs.quality.result == 'success' && !contains(github.event.head_commit.message, '#no_deploy')
+
+    steps:
+      - name: Checkout code
+        run: |
+          set -euo pipefail
+          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
+          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
+          git -c core.hooksPath=/dev/null clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
+          git -c core.hooksPath=/dev/null checkout "${GITHUB_SHA}"
+
+      - name: Build image on deployment host
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_B64 }}
+        run: |
+          set -euo pipefail
+
+          SHA_SHORT="$(printf '%s' "${GITHUB_SHA}" | cut -c1-7)"
+          WEB_REF="${WEB_IMAGE}:dev-${SHA_SHORT}"
+          DEPLOY_HOST="${DEPLOY_HOST:-10.10.0.124}"
+          DEPLOY_USER="${DEPLOY_USER:-ecos-deploy}"
+          DEPLOY_PORT="${DEPLOY_PORT:-22}"
+
+          mkdir -p ~/.ssh
+          if [[ -n "${DEPLOY_SSH_KEY_B64:-}" ]]; then
+            printf '%s' "$DEPLOY_SSH_KEY_B64" | base64 -d > ~/.ssh/ecos_deploy_key
+          elif [[ -n "${DEPLOY_SSH_KEY:-}" ]]; then
+            printf '%s' "$DEPLOY_SSH_KEY" > ~/.ssh/ecos_deploy_key
+          elif [[ -f /root/.ssh/ci-key ]]; then
+            cp /root/.ssh/ci-key ~/.ssh/ecos_deploy_key
+          elif [[ -f ~/.ssh/ci-key ]]; then
+            cp ~/.ssh/ci-key ~/.ssh/ecos_deploy_key
+          else
+            echo "Deploy SSH key is not configured" >&2
+            exit 1
+          fi
+          chmod 0600 ~/.ssh/ecos_deploy_key
+          ssh-keyscan -p "$DEPLOY_PORT" -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+          ssh_base=(
+            ssh
+            -i ~/.ssh/ecos_deploy_key
+            -p "$DEPLOY_PORT"
+            "$DEPLOY_USER@$DEPLOY_HOST"
+          )
+          scp_base=(
+            scp
+            -i ~/.ssh/ecos_deploy_key
+            -P "$DEPLOY_PORT"
+          )
+
+          "${ssh_base[@]}" "mkdir -p '$DEPLOY_PATH/releases'"
+
+          "${scp_base[@]}" deploy/anal-front/compose.yml "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/compose.yml"
+          "${scp_base[@]}" deploy/anal-front/deploy.sh "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/deploy.sh"
+
+          tar \
+            --exclude=.git \
+            --exclude=node_modules \
+            --exclude=dist \
+            --exclude=playwright-report \
+            --exclude=test-results \
+            --exclude=.bun \
+            -cf - . \
+            | "${ssh_base[@]}" "rm -rf '$DEPLOY_PATH/build-src.tmp' && mkdir -p '$DEPLOY_PATH/build-src.tmp' && tar -xf - -C '$DEPLOY_PATH/build-src.tmp' && rm -rf '$DEPLOY_PATH/build-src' && mv '$DEPLOY_PATH/build-src.tmp' '$DEPLOY_PATH/build-src'"
+
+          "${ssh_base[@]}" "chmod 0750 '$DEPLOY_PATH/deploy.sh' && cd '$DEPLOY_PATH/build-src' && docker build --pull --label 'org.opencontainers.image.revision=${GITHUB_SHA}' --tag '$WEB_REF' --tag '${WEB_IMAGE}:dev' . && '$DEPLOY_PATH/deploy.sh' '$WEB_REF'"
+
+      - name: Verify public domain
+        run: |
+          set -euo pipefail
+          curl -fsS "https://${DEPLOY_DOMAIN}/" >/dev/null