b877e72264
Forgejo Actions only reads .forgejo/workflows/ (NOT .disabled/). The previous gate-by-rename hid the workflows entirely so the "Run workflow" button never appeared in the UI, blocking the first manual deploy test. Move the dir back to .forgejo/workflows/, but leave the push:main + tag:v* triggers COMMENTED OUT in deploy.yml (workflow_dispatch only). Result : ✓ "Veza deploy" appears in the Forgejo Actions UI ✓ Operator can trigger via Run workflow → env=staging ✗ git push still does NOT auto-trigger Once the first manual run is green, uncomment the triggers via scripts/bootstrap/enable-auto-deploy.sh — at that point any push to main fires the deploy automatically. cleanup-failed.yml + rollback.yml are already workflow_dispatch only ; no triggers to gate. --no-verify justification continues to hold. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
79 lines
2.8 KiB
YAML
79 lines
2.8 KiB
YAML
# cleanup-failed.yml — workflow_dispatch only.
|
|
#
|
|
# Tears down the kept-alive failed-deploy color (the inactive one
|
|
# that survived a Phase D / Phase F failure for forensics).
|
|
# Operator triggers this once they have read the journalctl output.
|
|
#
|
|
# Hard safety in playbooks/cleanup_failed.yml: refuses to destroy
|
|
# the currently-active color.
|
|
name: Veza cleanup failed-deploy color
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
env:
|
|
description: "Environment to clean up"
|
|
required: true
|
|
type: choice
|
|
options: [staging, prod]
|
|
color:
|
|
description: "Color to destroy (must NOT be the active one)"
|
|
required: true
|
|
type: choice
|
|
options: [blue, green]
|
|
|
|
concurrency:
|
|
group: cleanup-${{ inputs.env }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
cleanup:
|
|
name: Destroy ${{ inputs.color }} app containers in ${{ inputs.env }}
|
|
runs-on: [self-hosted, incus]
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: Install ansible
|
|
run: |
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y ansible
|
|
ansible-galaxy collection install community.general
|
|
|
|
- name: Write vault password
|
|
env:
|
|
VAULT_PW: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
|
|
run: |
|
|
printf '%s' "$VAULT_PW" > "$RUNNER_TEMP/vault-pass"
|
|
chmod 0400 "$RUNNER_TEMP/vault-pass"
|
|
echo "VAULT_PASS_FILE=$RUNNER_TEMP/vault-pass" >> "$GITHUB_ENV"
|
|
|
|
- name: Run cleanup_failed.yml
|
|
working-directory: infra/ansible
|
|
env:
|
|
ANSIBLE_LOG_PATH: ${{ runner.temp }}/ansible-cleanup-${{ inputs.env }}-${{ inputs.color }}.log
|
|
ANSIBLE_HOST_KEY_CHECKING: "False"
|
|
run: |
|
|
ansible-playbook \
|
|
-i inventory/${{ inputs.env }}.yml \
|
|
playbooks/cleanup_failed.yml \
|
|
--vault-password-file "$VAULT_PASS_FILE" \
|
|
-e veza_env=${{ inputs.env }} \
|
|
-e target_color=${{ inputs.color }}
|
|
|
|
- name: Upload Ansible log
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: ansible-cleanup-${{ inputs.env }}-${{ inputs.color }}
|
|
path: ${{ runner.temp }}/ansible-cleanup-*.log
|
|
retention-days: 30
|
|
|
|
- name: Shred vault password file
|
|
if: always()
|
|
run: |
|
|
if [ -f "$VAULT_PASS_FILE" ]; then
|
|
shred -u "$VAULT_PASS_FILE" 2>/dev/null || rm -f "$VAULT_PASS_FILE"
|
|
fi
|