Kevin L'Hereec
b88871879c
Untracking .env.production (commit 3cc189c) breaks the 'cat .env.production'
step in this pipeline, since the job clones a fresh copy of the repo. This
is intentional: the file contained plaintext secrets and should never have
been committed. Documented inline:
- the deploy step will fail until secrets are migrated to Gitea Actions
secrets and the .env file is generated at deploy time
- the sshpass/sudo -S pattern for NASPASS should be replaced with a
dedicated SSH key and scoped passwordless sudo
Not changing the workflow itself: no access to the NAS to reconfigure
SSH/sudo or verify a fix end-to-end from this environment.
86 lines
4.3 KiB
YAML
86 lines
4.3 KiB
YAML
name: Build & Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main, master]
|
|
pull_request:
|
|
branches: [main, master]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: linux
|
|
container: node:24
|
|
steps:
|
|
- name: Checkout repository
|
|
run: git clone --depth=1 http://x-access-token:${{ github.token }}@192.168.1.39:3000/${{ github.repository }}.git .
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build project
|
|
run: npm run build
|
|
|
|
docker:
|
|
needs: build
|
|
runs-on: dind
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
steps:
|
|
- name: Checkout repository
|
|
run: git clone --depth=1 http://x-access-token:${{ github.token }}@192.168.1.39:3000/${{ github.repository }}.git .
|
|
|
|
- name: Login to Gitea Container Registry
|
|
run: |
|
|
echo "${{ secrets.token }}" | docker login http://192.168.1.39:3000 -u "${{ secrets.username }}" --password-stdin
|
|
|
|
- name: Build and push Docker image
|
|
run: |
|
|
IMAGE=192.168.1.39:3000/$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
|
|
docker build -t ${IMAGE}:latest -t ${IMAGE}:${{ github.sha }} .
|
|
docker push ${IMAGE}:latest
|
|
docker push ${IMAGE}:${{ github.sha }}
|
|
|
|
# ---------------------------------------------------------------------
|
|
# ⚠️ SECURITY REVIEW NOTES (see pc_builder remediation plan, item 1.4)
|
|
# ---------------------------------------------------------------------
|
|
# This deploy step has two known issues that were flagged during a
|
|
# security review but intentionally NOT auto-fixed here (no access to
|
|
# reconfigure the NAS SSH/sudo setup from this environment):
|
|
#
|
|
# 1. `.env.production` was removed from git tracking (it contained
|
|
# plaintext APP_KEY/DB_PASSWORD and should never have been
|
|
# committed). The `cat .env.production` line below now reads a
|
|
# file that will NOT exist in a fresh `git clone` of this repo,
|
|
# since this job clones the repo from scratch at the top of the
|
|
# `docker` job. This step WILL fail until the deployment secrets
|
|
# are migrated to Gitea Actions secrets and the `.env` file is
|
|
# generated at deploy time instead of committed, e.g.:
|
|
# printf 'APP_KEY=%s\nDB_PASSWORD=%s\n...' \
|
|
# "${{ secrets.APP_KEY }}" "${{ secrets.DB_PASSWORD }}" | \
|
|
# sshpass ... "cat > /volume1/docker/pc_builder/.env"
|
|
# Until that migration happens, whoever runs this pipeline must
|
|
# place a non-committed `.env.production` file back in the
|
|
# repository checkout (or update this script) for deploys to work.
|
|
#
|
|
# 2. The NAS password (`secrets.NASPASS`) is passed on the command
|
|
# line via `sshpass -p` and `sudo -S`, which can leak through
|
|
# process listings and CI logs. Recommended remediation: switch to
|
|
# a dedicated SSH key stored as a Gitea secret, and configure a
|
|
# scoped passwordless `sudo` (NOPASSWD) on the NAS limited to the
|
|
# exact commands below (setup-db.sh, docker compose, docker exec),
|
|
# rather than transiting the interactive user's password.
|
|
- name: Deploy on NAS
|
|
run: |
|
|
apk add --no-cache openssh-client sshpass
|
|
cat docker-compose.prod.yml | sshpass -p "${{ secrets.NASPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "cat > /volume1/docker/pc_builder/docker-compose.prod.yml"
|
|
cat .env.production | sshpass -p "${{ secrets.NASPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "cat > /volume1/docker/pc_builder/.env"
|
|
cat deploy/setup-db.sh | sshpass -p "${{ secrets.NASPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "cat > /volume1/docker/pc_builder/setup-db.sh"
|
|
sshpass -p "${{ secrets.NASPASS }}" ssh -o StrictHostKeyChecking=no Stude12@192.168.1.39 "
|
|
cd /volume1/docker/pc_builder &&
|
|
echo '${{ secrets.NASPASS }}' | sudo -S /usr/bin/bash setup-db.sh &&
|
|
echo '${{ secrets.NASPASS }}' | sudo -S /usr/bin/docker compose -f docker-compose.prod.yml pull &&
|
|
echo '${{ secrets.NASPASS }}' | sudo -S /usr/bin/docker compose -f docker-compose.prod.yml up -d --remove-orphans &&
|
|
echo '${{ secrets.NASPASS }}' | sudo -S /usr/bin/docker exec pc-builder node ace migration:run --force
|
|
"
|