push-and-deploy.yaml

name: akane-push-and-deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:
  pull_request:
    types:
      - opened
      - synchronize
      - reopened
    paths:
      - "packages/akane-next/**"
      - ".github/workflows/push-and-deploy.yaml"
      - "docker/akane-next/**"
      - "compose.yaml"

jobs:
  next-build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
      id-token: write
      actions: write
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@v4
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}/akane-next
          # デフォルトブランチの時だけ latest タグをつけてそれ以外は日時とコミットハッシュをつける
          # ref: https://github.com/docker/metadata-action?tab=readme-ov-file#customizing
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value={{date 'YYYYMMDD-HHmmss' tz='Asia/Tokyo'}}-{{sha}}
          # Open Container Initiative (OCI) の Image Spec に基づくラベル
          # ref:
          # - https://github.com/opencontainers/image-spec/blob/fbb4662eb53b80bd38f7597406cf1211317768f0/annotations.md?plain=1#L18-L26
          labels: |
            org.opencontainers.image.authors="rokuosan, taiseiue, nenrinyear, Retasusan, ikotome"
            org.opencontainers.image.url="https://github.com/kc3hack/2025_9"
            org.opencontainers.image.documentation="https://github.com/kc3hack/2025_9"
            org.opencontainers.image.source="https://github.com/kc3hack/2025_9"
      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./docker/akane-next/Dockerfile
          target: production
          platforms: linux/amd64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
          provenance: false
          build-args: |
            DATABASE_URL=mysql://root@db:3306/akane
            MAPBOX_MAP_STYLE=mapbox://styles/nenrin/cm77whskd00sl01reh909h23j
            MAPBOX_ACCESS_TOKEN=${{ secrets.MAPBOX_ACCESS_TOKEN }}
            S3_ACCESS_KEY_ID=${{ secrets.S3_ACCESS_KEY_ID }}
            S3_SECRET_ACCESS_KEY=${{ secrets.S3_SECRET_ACCESS_KEY }}
            S3_BUCKET_NAME=${{ secrets.S3_BUCKET_NAME }}
            S3_BUCKET_URL=${{ secrets.S3_BUCKET_URL }}
            S3_API_ENDPOINT=${{ secrets.S3_API_ENDPOINT }}
      - name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}
  nginx-build-and-push:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
      id-token: write
      actions: write
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/metadata-action@v4
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}/akane-nginx
          # デフォルトブランチの時だけ latest タグをつけてそれ以外は日時とコミットハッシュをつける
          # ref: https://github.com/docker/metadata-action?tab=readme-ov-file#customizing
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=raw,value={{date 'YYYYMMDD-HHmmss' tz='Asia/Tokyo'}}-{{sha}}
          # Open Container Initiative (OCI) の Image Spec に基づくラベル
          # ref:
          # - https://github.com/opencontainers/image-spec/blob/fbb4662eb53b80bd38f7597406cf1211317768f0/annotations.md?plain=1#L18-L26
          labels: |
            org.opencontainers.image.authors="rokuosan, taiseiue, nenrinyear, Retasusan, ikotome"
            org.opencontainers.image.url="https://github.com/kc3hack/2025_9"
            org.opencontainers.image.documentation="https://github.com/kc3hack/2025_9"
            org.opencontainers.image.source="https://github.com/kc3hack/2025_9"
      - name: Push
        uses: docker/build-push-action@v6
        with:
          context: ./docker/production/nginx
          file: ./docker/production/nginx/Dockerfile
          platforms: linux/amd64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
          provenance: false
      - name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}
  deploy:
    name: Auto Deploy as Staging Environment
    needs: [next-build-and-push, nginx-build-and-push]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Setup Tailscale
        uses: tailscale/github-action@v3
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          tags: tag:ci
      - name: Deploy
        uses: appleboy/ssh-action@master
        with:
          host: ${{ secrets.STAGING_HOST }}
          username: ${{ secrets.STAGING_USERNAME }}
          key: ${{ secrets.STAGING_PRIVATE_KEY }}
          script: |
            cd ~/yaken/2025_9 && git pull
            . ~/yaken/2025_9/production/script/deploy-staging ${{ secrets.KEYCHAIN_PASSWORD }} ${{ secrets.GHCR_USER }} ${{ secrets.GHCR_TOKEN }}