390 lines
17 KiB
YAML
390 lines
17 KiB
YAML
name: CD Production
|
|
|
|
# Pipeline de production — Hetzner k3s (infra/prod/).
|
|
#
|
|
# Enchaînement : qualité → vérification → promotion/rebuild → déploiement → contrôle
|
|
#
|
|
# TROIS RÈGLES STRUCTURANTES
|
|
#
|
|
# 1. Le BACKEND est PROMU depuis la preprod, jamais reconstruit.
|
|
# Promouvoir garantit que le binaire déployé en production est exactement
|
|
# celui qui a passé la chaîne de preprod (lint, tests unitaires, tests
|
|
# d'intégration, build). Un rebuild casserait cette garantie.
|
|
#
|
|
# 2. Le FRONTEND est RECONSTRUIT pour la production.
|
|
# next.config.js fige NEXT_PUBLIC_API_URL au moment du build. Promouvoir
|
|
# l'image de preprod livrerait une application qui appelle
|
|
# api.preprod.xpeditis.com en production. C'est la raison pour laquelle ce
|
|
# workflow ne peut pas se contenter de re-taguer.
|
|
#
|
|
# 3. Le déploiement passe par SSH, pas par l'API Kubernetes.
|
|
# L'API k3s (6443) n'est ouverte qu'aux IP d'administration. Les runners
|
|
# Gitea n'ont pas d'IP fixe : le job ouvre le port 22 pour la seule IP du
|
|
# runner via un firewall Hetzner dédié, puis le referme systématiquement.
|
|
#
|
|
# Secrets, runners et limites Gitea : voir docs/CI-CD-SECURITY.md
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: rg.fr-par.scw.cloud/weworkstudio
|
|
NODE_VERSION: '22'
|
|
K8S_NAMESPACE: xpeditis-prod
|
|
|
|
jobs:
|
|
security:
|
|
name: Security gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: ./.gitea/actions/security
|
|
|
|
# ═══ 1. Qualité ══════════════════════════════════════════════════════════
|
|
backend-quality:
|
|
name: Backend — Lint
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: apps/backend
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
- run: npm ci --legacy-peer-deps
|
|
- run: npm run lint -- --no-fix
|
|
|
|
frontend-quality:
|
|
name: Frontend — Lint & Type-check
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: apps/frontend
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
- run: npm ci --legacy-peer-deps
|
|
- run: npm run lint
|
|
- run: npm run type-check
|
|
|
|
backend-tests:
|
|
name: Backend — Tests unitaires
|
|
runs-on: ubuntu-latest
|
|
needs: backend-quality
|
|
defaults:
|
|
run:
|
|
working-directory: apps/backend
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
- run: npm ci --legacy-peer-deps
|
|
- run: npm test -- --ci --runInBand
|
|
|
|
frontend-tests:
|
|
name: Frontend — Tests unitaires
|
|
runs-on: ubuntu-latest
|
|
needs: frontend-quality
|
|
defaults:
|
|
run:
|
|
working-directory: apps/frontend
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: ${{ env.NODE_VERSION }}
|
|
- run: npm ci --legacy-peer-deps
|
|
- run: npm test -- --ci --runInBand
|
|
|
|
# ═══ 2. Vérification de la provenance ════════════════════════════════════
|
|
# Exige un pipeline preprod réussi ET un arbre Git identique au code testé ici.
|
|
verify-image:
|
|
name: Vérifier l'image de preprod
|
|
runs-on: ubuntu-latest
|
|
needs: [security, backend-tests, frontend-tests]
|
|
outputs:
|
|
sha: ${{ steps.sha.outputs.short }}
|
|
backend_digest: ${{ steps.sha.outputs.backend_digest }}
|
|
log_exporter_digest: ${{ steps.sha.outputs.log_exporter_digest }}
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
- uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
- uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: nologin
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
- name: Resolve validated preprod release
|
|
id: sha
|
|
run: bash scripts/ci/resolve-release.sh
|
|
|
|
# ═══ 3b. Reconstruction du frontend avec les URLs de production ══════════
|
|
build-frontend:
|
|
name: Reconstruire le frontend (URLs de production)
|
|
runs-on: ubuntu-latest
|
|
needs: verify-image
|
|
outputs:
|
|
digest: ${{ steps.build.outputs.digest }}
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
persist-credentials: false
|
|
# Cet arbre Git est identique à celui de la release preprod vérifiée.
|
|
ref: ${{ github.sha }}
|
|
- uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
- uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: nologin
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
- id: build
|
|
uses: https://github.com/docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
|
|
with:
|
|
context: ./apps/frontend
|
|
file: ./apps/frontend/Dockerfile
|
|
push: true
|
|
platforms: linux/amd64
|
|
tags: |
|
|
${{ env.REGISTRY }}/xpeditis-frontend:candidate-prod-${{ github.sha }}-${{ github.run_id }}
|
|
cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod
|
|
cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod,mode=max
|
|
build-args: |
|
|
NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL_PROD }}
|
|
NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL_PROD }}
|
|
|
|
- name: Contrôle — l'URL de preprod ne doit pas figurer dans le bundle
|
|
run: |
|
|
IMAGE="${{ env.REGISTRY }}/xpeditis-frontend@${{ steps.build.outputs.digest }}"
|
|
CID=$(docker create "$IMAGE")
|
|
trap 'docker rm "$CID" >/dev/null' EXIT
|
|
docker cp "$CID:/app/.next" /tmp/next-check
|
|
test -d /tmp/next-check
|
|
trap - EXIT
|
|
docker rm "$CID" >/dev/null
|
|
if grep -rq "api.preprod.xpeditis.com" /tmp/next-check 2>/dev/null; then
|
|
echo "::error::L'URL de preprod est figée dans le bundle de production."
|
|
echo "Vérifiez le secret NEXT_PUBLIC_API_URL_PROD."
|
|
exit 1
|
|
fi
|
|
echo "Aucune URL de preprod dans le bundle."
|
|
|
|
image-security:
|
|
name: Image security (${{ matrix.service }}, ${{ matrix.arch }})
|
|
runs-on: ubuntu-latest
|
|
needs: [verify-image, build-frontend]
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
service: [backend, frontend, log-exporter]
|
|
arch: [amd64]
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: ./.gitea/actions/setup-trivy
|
|
- uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: nologin
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
- name: Scan the exact image before deployment
|
|
env:
|
|
IMAGE: ${{ env.REGISTRY }}/xpeditis-${{ matrix.service }}@${{ matrix.service == 'frontend' && needs.build-frontend.outputs.digest || (matrix.service == 'backend' && needs.verify-image.outputs.backend_digest || needs.verify-image.outputs.log_exporter_digest) }}
|
|
PLATFORM: linux/${{ matrix.arch }}
|
|
run: |
|
|
trivy image --platform "$PLATFORM" --scanners vuln --severity HIGH,CRITICAL \
|
|
--ignore-unfixed=false --exit-code 1 --timeout 15m --format json \
|
|
--output "$RUNNER_TEMP/image-security.json" "$IMAGE"
|
|
- name: Save image report
|
|
if: always()
|
|
uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3, Gitea artifact protocol
|
|
with:
|
|
name: image-security-${{ matrix.service }}-${{ matrix.arch }}
|
|
path: ${{ runner.temp }}/image-security.json
|
|
retention-days: 14
|
|
if-no-files-found: error
|
|
|
|
# ═══ 4. Déploiement ══════════════════════════════════════════════════════
|
|
deploy:
|
|
name: Déployer en production
|
|
runs-on: xpeditis-deploy
|
|
needs: [verify-image, build-frontend, image-security]
|
|
# Gitea 1.22 ignores environments: serialize on the dedicated deployment runner.
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: https://github.com/docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
- uses: https://github.com/docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: nologin
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
- name: Publish scanned production images
|
|
env:
|
|
IMAGE_SHA: ${{ needs.verify-image.outputs.sha }}
|
|
BACKEND_DIGEST: ${{ needs.verify-image.outputs.backend_digest }}
|
|
FRONTEND_DIGEST: ${{ needs.build-frontend.outputs.digest }}
|
|
LOG_EXPORTER_DIGEST: ${{ needs.verify-image.outputs.log_exporter_digest }}
|
|
run: |
|
|
for service in backend frontend log-exporter; do
|
|
case "$service" in
|
|
backend) digest="$BACKEND_DIGEST" ;;
|
|
frontend) digest="$FRONTEND_DIGEST" ;;
|
|
log-exporter) digest="$LOG_EXPORTER_DIGEST" ;;
|
|
esac
|
|
docker buildx imagetools create \
|
|
--tag "$REGISTRY/xpeditis-$service:prod-$IMAGE_SHA" \
|
|
--tag "$REGISTRY/xpeditis-$service:latest" \
|
|
"$REGISTRY/xpeditis-$service@$digest"
|
|
done
|
|
|
|
- name: Installer le client Hetzner
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/hcloud-bin"
|
|
curl --fail --silent --show-error --location --retry 3 --max-time 120 \
|
|
https://github.com/hetznercloud/cli/releases/download/v1.49.0/hcloud-linux-amd64.tar.gz \
|
|
--output "$RUNNER_TEMP/hcloud.tar.gz"
|
|
echo "dc6e5b0e6eaf9ef2baa5473a3eb49a11e80e72cdf2a01fdf7b0af975410e79cc $RUNNER_TEMP/hcloud.tar.gz" | sha256sum --check --strict
|
|
tar -xzf "$RUNNER_TEMP/hcloud.tar.gz" -C "$RUNNER_TEMP/hcloud-bin" hcloud
|
|
echo "$RUNNER_TEMP/hcloud-bin" >> "$GITHUB_PATH"
|
|
"$RUNNER_TEMP/hcloud-bin/hcloud" version
|
|
|
|
- name: Ouvrir le port 22 pour l'IP de ce runner
|
|
env:
|
|
HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }}
|
|
run: |
|
|
RUNNER_IP="$(curl -fsS --max-time 10 https://ifconfig.me)"
|
|
echo "IP du runner : ${RUNNER_IP}"
|
|
cat > /tmp/fw-open.json <<JSON
|
|
[{
|
|
"direction": "in",
|
|
"protocol": "tcp",
|
|
"port": "22",
|
|
"source_ips": ["${RUNNER_IP}/32"],
|
|
"description": "Gitea Actions run ${{ github.run_id }}"
|
|
}]
|
|
JSON
|
|
hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-open.json
|
|
|
|
- name: Préparer SSH
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
|
|
DEPLOY_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/deploy-ssh" && chmod 700 "$RUNNER_TEMP/deploy-ssh"
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > "$RUNNER_TEMP/deploy-ssh/id_ed25519"
|
|
chmod 600 "$RUNNER_TEMP/deploy-ssh/id_ed25519"
|
|
# Empreinte épinglée : un détournement DNS ou BGP ne peut pas
|
|
# rediriger le déploiement vers une machine tierce.
|
|
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$RUNNER_TEMP/deploy-ssh/known_hosts"
|
|
chmod 600 "$RUNNER_TEMP/deploy-ssh/known_hosts"
|
|
|
|
- name: Synchroniser infra/prod sur le serveur
|
|
run: |
|
|
rsync -az --delete \
|
|
--exclude '.terraform' --exclude '*.tfstate*' --exclude '*.tfvars' \
|
|
-e "ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile=\"$RUNNER_TEMP/deploy-ssh/known_hosts\" -i \"$RUNNER_TEMP/deploy-ssh/id_ed25519\"" \
|
|
infra/prod/ \
|
|
"${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}:/opt/xpeditis/infra-prod/"
|
|
|
|
- name: Déployer
|
|
id: deploy
|
|
run: |
|
|
SHA="${{ needs.verify-image.outputs.sha }}"
|
|
ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$RUNNER_TEMP/deploy-ssh/known_hosts" -i "$RUNNER_TEMP/deploy-ssh/id_ed25519" \
|
|
"${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
|
|
"deploy prod-${SHA}"
|
|
|
|
- name: Tests de fumée depuis l'extérieur
|
|
id: smoke
|
|
env:
|
|
PROD_API_URL: ${{ vars.PROD_API_URL }}
|
|
PROD_APP_URL: ${{ vars.PROD_APP_URL }}
|
|
run: bash infra/prod/scripts/smoke-test.sh
|
|
|
|
- name: Retour arrière si le déploiement a échoué
|
|
if: failure() && (steps.deploy.conclusion == 'failure' || steps.smoke.conclusion == 'failure')
|
|
run: |
|
|
ssh -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$RUNNER_TEMP/deploy-ssh/known_hosts" -i "$RUNNER_TEMP/deploy-ssh/id_ed25519" \
|
|
"${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \
|
|
"rollback" || true
|
|
|
|
- name: Refermer le firewall
|
|
# `always()` : la fenêtre d'exposition se referme même si le
|
|
# déploiement a échoué, si le job a été annulé ou s'il a expiré.
|
|
if: always()
|
|
env:
|
|
HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }}
|
|
run: |
|
|
echo '[]' > /tmp/fw-close.json
|
|
hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-close.json
|
|
echo "Firewall CI refermé."
|
|
|
|
- name: Effacer la clé SSH
|
|
if: always()
|
|
run: shred -u "$RUNNER_TEMP/deploy-ssh/id_ed25519" 2>/dev/null || rm -f "$RUNNER_TEMP/deploy-ssh/id_ed25519"
|
|
|
|
# ═══ 5. Notifications ════════════════════════════════════════════════════
|
|
notify-success:
|
|
name: Notifier le succès
|
|
runs-on: ubuntu-latest
|
|
needs: [verify-image, deploy]
|
|
if: success()
|
|
steps:
|
|
- run: |
|
|
curl -sf -H "Content-Type: application/json" -d '{
|
|
"embeds": [{
|
|
"title": "Production déployée et saine",
|
|
"color": 3066993,
|
|
"fields": [
|
|
{"name": "Auteur", "value": "${{ github.actor }}", "inline": true},
|
|
{"name": "Version", "value": "`prod-${{ needs.verify-image.outputs.sha }}`", "inline": true},
|
|
{"name": "Cible", "value": "Hetzner k3s — xpeditis-prod", "inline": false},
|
|
{"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}
|
|
],
|
|
"footer": {"text": "Xpeditis CI/CD - Production"}
|
|
}]
|
|
}' ${{ secrets.DISCORD_WEBHOOK_URL }}
|
|
|
|
notify-failure:
|
|
name: Notifier l'échec
|
|
runs-on: ubuntu-latest
|
|
needs: [security, backend-quality, frontend-quality, backend-tests, frontend-tests, verify-image, build-frontend, image-security, deploy]
|
|
if: failure()
|
|
steps:
|
|
- run: |
|
|
curl -sf -H "Content-Type: application/json" -d '{
|
|
"content": "@here ECHEC DU PIPELINE DE PRODUCTION",
|
|
"embeds": [{
|
|
"title": "Pipeline de production en échec",
|
|
"description": "Un retour arrière a été tenté si l échec est survenu pendant le déploiement. Vérifiez l état réel avant toute nouvelle tentative.",
|
|
"color": 15158332,
|
|
"fields": [
|
|
{"name": "Auteur", "value": "${{ github.actor }}", "inline": true},
|
|
{"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false},
|
|
{"name": "A vérifier", "value": "Le firewall CI est-il bien refermé ? `hcloud firewall describe xpeditis-prod-fw-cicd`", "inline": false}
|
|
],
|
|
"footer": {"text": "Xpeditis CI/CD - Production"}
|
|
}]
|
|
}' ${{ secrets.DISCORD_WEBHOOK_URL }}
|