hoelee
585aeeba05
Deploy / build (push) Successful in 1m3s
Measured on 2026-10-16: the same archive comes down at ~16 KB/s through git.hoelee.com (Cloudflare -> tunnel -> back to this host) and ~17 MB/s from http://192.168.1.6:3000. The shallow clone had grown to ~13 MB with the image work and one run sat in the middle of index-pack for 13+ minutes with the job hung. The runner is on the same host as Gitea, so it has no reason to leave the LAN; Gitea has no 443 there, so this hop is plain HTTP on the private network and the token stays inside it. Also bounds the deploy: timeout-minutes 15 on the job and -m 30 on the purge call, so a stalled Cloudflare API cannot hold a deploy open.
58 lines
2.4 KiB
YAML
58 lines
2.4 KiB
YAML
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
# The runner lives on the same host as Gitea: a hang used to sit here for hours.
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout
|
|
run: |
|
|
git config --global --add safe.directory '*'
|
|
# Clone over the LAN, not through the public hostname. Measured 2026-10-16:
|
|
# git.hoelee.com goes out to Cloudflare and back through the tunnel at
|
|
# ~16 KB/s (13 min for a shallow clone, once hung for 13+ min mid-pack),
|
|
# while http://192.168.1.6:3000 serves the same archive at ~17 MB/s.
|
|
# Gitea has no 443 on the LAN, so this hop is plain HTTP on the private
|
|
# network — the token never leaves the LAN.
|
|
git clone --depth 1 "http://hoelee:${{ secrets.PAT }}@192.168.1.6:3000/hoelee/hoelee-blog.git" .
|
|
git checkout $GITHUB_SHA 2>/dev/null || true
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
- name: Deploy to nginx-hoelee-blog
|
|
run: |
|
|
rm -rf /mnt/user/docker/nginx-hoelee-blog/html/*
|
|
cp -r dist/* /mnt/user/docker/nginx-hoelee-blog/html/
|
|
echo "Deployed. Contents:"
|
|
ls -la /mnt/user/docker/nginx-hoelee-blog/html/
|
|
|
|
# Purge the Cloudflare edge after deploy. Required as soon as an HTML cache
|
|
# rule exists at the edge (Caching -> Cache Rules): without a purge, a new or
|
|
# edited post can keep serving the old HTML until the Edge TTL expires.
|
|
# Skipped silently while the secrets are unset so the deploy never breaks.
|
|
- name: Purge Cloudflare cache
|
|
run: |
|
|
if [ -z "${CF_TOKEN}" ] || [ -z "${CF_ZONE_ID}" ]; then
|
|
echo "CF_TOKEN / CF_ZONE_ID not set — skipping purge (add both as repo secrets)"
|
|
exit 0
|
|
fi
|
|
echo "Purging zone ${CF_ZONE_ID} ..."
|
|
# -m 30: a hung purge API must never hold the deploy open.
|
|
curl -sS -m 30 -X POST "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/purge_cache" \
|
|
-H "Authorization: Bearer ${CF_TOKEN}" \
|
|
-H "Content-Type: application/json" \
|
|
--data '{"purge_everything":true}' | head -c 400 || echo "purge call failed (deploy already done)"
|
|
echo
|
|
env:
|
|
CF_TOKEN: ${{ secrets.CF_TOKEN }}
|
|
CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
|