mohammedhamdy/ghaymah-exam-mohammedhamdy-sre
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor GitHub Actions workflow for production deployment

Browse Source 
Updated workflow to deploy to production instead of staging. Added verification for secrets and improved Docker image build steps.
This commit is contained in:
mohammed hamdy
2026-07-27 18:34:42 +03:00
committed by GitHub
parent efd8891d0c
commit 00681492f6
1 changed files with 37 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/main.yml
+37 -50
View File
@@ -2,82 +2,69 @@ name: CI/CD - Build & Deploy to Ghaymah Cloud
on: on:
push: push:
branches:
- main # production
- develop # staging
pull_request:
branches: branches:
- main - main
jobs: jobs:
# --------------------------------------------------------- # ---------------------------------------------------------
# 1) BUILD & TEST — runs on every push / PR, no approval needed # 1) BUILD & TEST
# --------------------------------------------------------- # ---------------------------------------------------------
build-and-test: build-and-test:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v5.0.0 uses: actions/checkout@v5
- name: Build Docker image (validation only) - name: Build Docker image
run: docker build -t exam-api:${{ github.sha }} . run: |
docker build -t exam-api:${{ github.sha }} .
- name: Smoke test the image locally - name: Smoke Test
run: | run: |
docker run -d -p 5000:5000 --name smoke-test exam-api:${{ github.sha }} docker run -d -p 5000:5000 --name smoke-test exam-api:${{ github.sha }}
sleep 5 sleep 8
curl -f http://localhost:5000/health || (docker logs smoke-test && exit 1) curl -f http://localhost:5000/health
docker stop smoke-test docker stop smoke-test
docker rm smoke-test
# --------------------------------------------------------- # ---------------------------------------------------------
# 2) DEPLOY TO STAGING — automatic, no approval # 2) DEPLOY TO PRODUCTION
# Triggers when pushing to "develop"
# ---------------------------------------------------------
deploy-staging:
needs: build-and-test
if: github.ref == 'refs/heads/develop' && github.event_name == 'push'
runs-on: ubuntu-latest
environment: staging # no required reviewers configured on this one
steps:
- name: Checkout code
uses: actions/checkout@v5.0.0
- name: Install Ghaymah CLI
run: curl -sSL https://cli.ghaymah.systems/install.sh | bash
- name: Login to Ghaymah
run: $HOME/ghaymah/bin/gy auth login --email "${{ secrets.GHAYMAH_EMAIL }}" --password "${{ secrets.GHAYMAH_PW }}"
- name: Use staging config
run: cp .ghaymah.staging.json .ghaymah.json
- name: Deploy to Ghaymah (staging)
run: $HOME/ghaymah/bin/gy resource app launch
# ---------------------------------------------------------
# 3) DEPLOY TO PRODUCTION — requires manual approval
# Triggers when pushing to "main"
# The "environment: production" below is what enforces the
# approval gate — set "Required reviewers" on this environment
# in: Repo Settings -> Environments -> production
# --------------------------------------------------------- # ---------------------------------------------------------
deploy-production: deploy-production:
needs: build-and-test needs: build-and-test
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
runs-on: ubuntu-latest runs-on: ubuntu-latest
environment: production # <-- manual approval enforced here
environment:
name: production
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@v5.0.0 uses: actions/checkout@v5
- name: Install Ghaymah CLI - name: Install Ghaymah CLI
run: curl -sSL https://cli.ghaymah.systems/install.sh | bash run: |
curl -sSL https://cli.ghaymah.systems/install.sh | bash
- name: Verify Secrets
shell: bash
env:
EMAIL: ${{ secrets.GHAYMAH_EMAIL }}
PASSWORD: ${{ secrets.GHAYMAH_PW }}
run: |
echo "Email Length: ${#EMAIL}"
echo "Password Length: ${#PASSWORD}"
- name: Login to Ghaymah - name: Login to Ghaymah
run: $HOME/ghaymah/bin/gy auth login --email "${{ secrets.GHAYMAH_EMAIL }}" --password "${{ secrets.GHAYMAH_PW }}" run: |
$HOME/ghaymah/bin/gy auth login \
--email "${{ secrets.GHAYMAH_EMAIL }}" \
--password "${{ secrets.GHAYMAH_PW }}"
- name: Use production config - name: Use Production Config
run: cp .ghaymah.production.json .ghaymah.json run: |
cp .ghaymah.production.json .ghaymah.json
- name: Deploy to Ghaymah (production) - name: Deploy to Ghaymah
run: $HOME/ghaymah/bin/gy resource app launch run: |
$HOME/ghaymah/bin/gy resource app launch