Add dev compose deployment for anal-front

.gitea/workflows/ci-cd.yml

@@ -0,0 +1,176 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches:
+      - dev
+      - "feature/**"
+      - "codex/**"
+  pull_request:
+    branches:
+      - dev
+
+concurrency:
+  group: anal-front-${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  WEB_IMAGE: "anal-front-web"
+  DEPLOY_DOMAIN: "anal.dev.nii-ecos.ru"
+  DEPLOY_PATH: "/opt/anal-front"
+
+jobs:
+  quality:
+    name: Quality Gate
+    runs-on: [frontend, ubuntu-latest]
+    timeout-minutes: 120
+    env:
+      PLAYWRIGHT_BROWSERS_PATH: /root/.cache/ms-playwright
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4.2.2
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.9
+
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            /root/.bun/install/cache
+            node_modules
+          key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-${{ runner.arch }}-bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Generate API clients
+        run: bun run apigen
+
+      - name: Lint check
+        run: bun run lint
+
+      - name: Type check
+        run: bun run typecheck
+
+      - name: Unit tests
+        run: bun run test:unit
+
+      - name: Build
+        run: bun run build
+
+      - name: Resolve Playwright version
+        id: playwright-version
+        run: |
+          version="$(bunx playwright --version | awk '{ print $2 }')"
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v4
+        with:
+          path: /root/.cache/ms-playwright
+          key: ${{ runner.os }}-${{ runner.arch }}-playwright-${{ steps.playwright-version.outputs.version }}
+
+      - name: Install Playwright system deps
+        run: bunx playwright install-deps chromium
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: bunx playwright install chromium
+
+      - name: E2E
+        env:
+          CI: "1"
+          PLAYWRIGHT_HTML_OPEN: never
+        run: bun run test:e2e -- --reporter=line
+
+      - name: Docker build
+        run: docker build --pull -t analytical-panel-frontend:ci .
+
+  deploy_dev:
+    name: Build and Deploy Dev via Compose
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    needs: [quality]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/dev' && needs.quality.result == 'success' && !contains(github.event.head_commit.message, '#no_deploy')
+
+    steps:
+      - name: Checkout code
+        run: |
+          set -euo pipefail
+          REPO_URL=$(echo "${GITHUB_SERVER_URL}" | sed "s|://|://oauth2:${{ gitea.token }}@|")
+          BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
+          git -c core.hooksPath=/dev/null clone --depth=1 --branch="${BRANCH}" "${REPO_URL}/${GITHUB_REPOSITORY}.git" .
+          git -c core.hooksPath=/dev/null checkout "${GITHUB_SHA}"
+
+      - name: Build image on deployment host
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          DEPLOY_SSH_KEY_B64: ${{ secrets.DEPLOY_SSH_KEY_B64 }}
+        run: |
+          set -euo pipefail
+
+          SHA_SHORT="$(printf '%s' "${GITHUB_SHA}" | cut -c1-7)"
+          WEB_REF="${WEB_IMAGE}:dev-${SHA_SHORT}"
+          DEPLOY_HOST="${DEPLOY_HOST:-10.10.0.124}"
+          DEPLOY_USER="${DEPLOY_USER:-ecos-deploy}"
+          DEPLOY_PORT="${DEPLOY_PORT:-22}"
+
+          mkdir -p ~/.ssh
+          if [[ -n "${DEPLOY_SSH_KEY_B64:-}" ]]; then
+            printf '%s' "$DEPLOY_SSH_KEY_B64" | base64 -d > ~/.ssh/ecos_deploy_key
+          elif [[ -n "${DEPLOY_SSH_KEY:-}" ]]; then
+            printf '%s' "$DEPLOY_SSH_KEY" > ~/.ssh/ecos_deploy_key
+          elif [[ -f /root/.ssh/ci-key ]]; then
+            cp /root/.ssh/ci-key ~/.ssh/ecos_deploy_key
+          elif [[ -f ~/.ssh/ci-key ]]; then
+            cp ~/.ssh/ci-key ~/.ssh/ecos_deploy_key
+          else
+            echo "Deploy SSH key is not configured" >&2
+            exit 1
+          fi
+          chmod 0600 ~/.ssh/ecos_deploy_key
+          ssh-keyscan -p "$DEPLOY_PORT" -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+          ssh_base=(
+            ssh
+            -i ~/.ssh/ecos_deploy_key
+            -p "$DEPLOY_PORT"
+            "$DEPLOY_USER@$DEPLOY_HOST"
+          )
+          scp_base=(
+            scp
+            -i ~/.ssh/ecos_deploy_key
+            -P "$DEPLOY_PORT"
+          )
+
+          "${ssh_base[@]}" "mkdir -p '$DEPLOY_PATH/releases'"
+
+          "${scp_base[@]}" deploy/anal-front/compose.yml "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/compose.yml"
+          "${scp_base[@]}" deploy/anal-front/deploy.sh "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/deploy.sh"
+
+          tar \
+            --exclude=.git \
+            --exclude=node_modules \
+            --exclude=dist \
+            --exclude=playwright-report \
+            --exclude=test-results \
+            --exclude=.bun \
+            -cf - . \
+            | "${ssh_base[@]}" "rm -rf '$DEPLOY_PATH/build-src.tmp' && mkdir -p '$DEPLOY_PATH/build-src.tmp' && tar -xf - -C '$DEPLOY_PATH/build-src.tmp' && rm -rf '$DEPLOY_PATH/build-src' && mv '$DEPLOY_PATH/build-src.tmp' '$DEPLOY_PATH/build-src'"
+
+          "${ssh_base[@]}" "chmod 0750 '$DEPLOY_PATH/deploy.sh' && cd '$DEPLOY_PATH/build-src' && docker build --pull --label 'org.opencontainers.image.revision=${GITHUB_SHA}' --tag '$WEB_REF' --tag '${WEB_IMAGE}:dev' . && '$DEPLOY_PATH/deploy.sh' '$WEB_REF'"
+
+      - name: Verify public domain
+        run: |
+          set -euo pipefail
+          curl -fsS "https://${DEPLOY_DOMAIN}/" >/dev/null

deploy/anal-front/compose.yml

@@ -0,0 +1,10 @@
+name: anal-front
+
+services:
+  web:
+    image: ${ANAL_FRONT_WEB_IMAGE:?ANAL_FRONT_WEB_IMAGE is required}
+    restart: unless-stopped
+    environment:
+      BACKEND_UPSTREAM: ${BACKEND_UPSTREAM:?BACKEND_UPSTREAM is required}
+    ports:
+      - "${FRONTEND_BIND_HOST:-10.10.0.124}:${FRONTEND_PORT:-18011}:80"

deploy/anal-front/deploy.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-/opt/anal-front}"
+COMPOSE_FILE="${COMPOSE_FILE:-$APP_DIR/compose.yml}"
+ENV_FILE="${ENV_FILE:-$APP_DIR/.env}"
+IMAGE_ENV_FILE="${IMAGE_ENV_FILE:-$APP_DIR/releases/current.env}"
+HEALTH_URL="${HEALTH_URL:-http://10.10.0.124:18011/}"
+ANAL_FRONT_WEB_IMAGE="${1:-${ANAL_FRONT_WEB_IMAGE:-}}"
+
+if [[ -z "$ANAL_FRONT_WEB_IMAGE" ]]; then
+  echo "ANAL_FRONT_WEB_IMAGE argument or environment variable is required" >&2
+  exit 1
+fi
+
+install -d -m 0770 "$APP_DIR" "$APP_DIR/releases"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  umask 077
+  cat >"$ENV_FILE" <<EOF
+BACKEND_UPSTREAM=https://anal-back.dev.nii-ecos.ru
+FRONTEND_BIND_HOST=10.10.0.124
+FRONTEND_PORT=18011
+EOF
+  chmod 0600 "$ENV_FILE"
+fi
+
+umask 027
+cat >"$IMAGE_ENV_FILE" <<EOF
+ANAL_FRONT_WEB_IMAGE=$ANAL_FRONT_WEB_IMAGE
+EOF
+chmod 0640 "$IMAGE_ENV_FILE"
+
+compose() {
+  docker compose \
+    --env-file "$ENV_FILE" \
+    --env-file "$IMAGE_ENV_FILE" \
+    -f "$COMPOSE_FILE" \
+    "$@"
+}
+
+wait_for_service_health() {
+  local service="$1"
+  local container_id=""
+  local health_status=""
+
+  for _ in $(seq 1 120); do
+    container_id="$(compose ps -q "$service" 2>/dev/null || true)"
+    if [[ -n "$container_id" ]]; then
+      health_status="$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id" 2>/dev/null || true)"
+      if [[ "$health_status" == "healthy" || "$health_status" == "running" ]]; then
+        return 0
+      fi
+    fi
+    sleep 2
+  done
+
+  echo "Service $service did not become healthy" >&2
+  compose ps >&2 || true
+  compose logs --tail=100 "$service" >&2 || true
+  exit 1
+}
+
+compose config >/dev/null
+if [[ "$ANAL_FRONT_WEB_IMAGE" == */* ]]; then
+  compose pull web
+else
+  echo "Using local image $ANAL_FRONT_WEB_IMAGE"
+fi
+compose up -d --remove-orphans web
+wait_for_service_health web
+
+for _ in $(seq 1 60); do
+  if curl -fsS "$HEALTH_URL" >/dev/null; then
+    compose ps
+    exit 0
+  fi
+  sleep 2
+done
+
+echo "Anal Front did not become healthy at $HEALTH_URL" >&2
+compose ps >&2 || true
+compose logs --tail=100 web >&2 || true
+exit 1