dunkirk.sh
Kieran's opinionated (and probably slightly dumb) nix config
feat: allow build step
+14
-5
.github/workflows/deploy-service.yml
+14
-5
.github/workflows/deploy-service.yml
···
24
24
required: false
25
25
type: string
26
26
description: "SQLite DB path for pre-deploy snapshot (e.g. /var/lib/cachet/data/cachet.db)"
27
+
work_dir:
28
+
required: false
29
+
type: string
30
+
default: "."
31
+
description: "Subdirectory to run install/build from (relative to ~/app)"
32
+
build_command:
33
+
required: false
34
+
type: string
35
+
description: "Build command to run after install (e.g. 'bun run build')"
27
36
secrets:
28
37
TS_OAUTH_CLIENT_ID:
29
38
required: true
30
39
TS_OAUTH_SECRET:
31
40
required: true
32
-
33
-
permissions:
34
-
deployments: write
35
41
36
42
jobs:
37
43
deploy:
···
107
113
fi
108
114
109
115
echo "::group::install & restart"
110
-
ssh ${{ inputs.service }}@${{ inputs.host }} << 'INSTALL'
116
+
ssh ${{ inputs.service }}@${{ inputs.host }} << INSTALL
111
117
set -e
112
-
cd ~/app
118
+
cd ~/app/${{ inputs.work_dir }}
113
119
bun install --frozen-lockfile
120
+
${{ inputs.build_command }}
114
121
sudo /run/current-system/sw/bin/systemctl restart ${{ inputs.service }}.service
115
122
INSTALL
116
123
echo "::endgroup::"
···
217
224
fi
218
225
219
226
git reset --hard "$PREV" --quiet
227
+
cd ~/app/${{ inputs.work_dir }}
220
228
bun install --frozen-lockfile 2>&1 | tail -1
229
+
${{ inputs.build_command }}
221
230
sudo /run/current-system/sw/bin/systemctl restart ${{ inputs.service }}.service
222
231
223
232
echo -e "${G}:: rolled back to ${SHORT}${R}"