mirror of
https://github.com/pezkuwichain/pezkuwi-subquery.git
synced 2026-10-20 18:56:24 +00:00
Satoshi Qazi Muhammed
74336dff5c
deploy-vps reached subquery1 as root, through appleboy/ssh-action referenced by tag, with a key whose comment (mamostehp@MamostePC) made it look like a person's. It now uses plain ssh with SUBQUERY_DEPLOY_KEY, which the host pins (authorized_keys restrict,command=) to ops/host/subquery-deploy-ssh: the commit SHA is its only input. subquery-deploy, run through sudo, does what the workflow's script did, with three changes: - It deploys exactly the SHA CI was triggered for, and only a commit on main. - The host's local edits to tracked files (the indexer manifests) are put back whether the deploy succeeds or fails. Before, a failed build exited before `stash pop` and left them stashed. - Only tracked files are stashed. Stashing untracked ones too (.yarn/, which yarn install recreates) made every pop fail half-way; that is how 13 stash entries piled up on the host. test-deploy.sh covers this against a scratch clone (red with the restore trap removed); CI runs it with shellcheck. subquery1's host key is pinned. The indexer endpoints themselves are unchanged. Actions pinned to SHAs; the secret scanner's own AGPL licence is allowed in dependency review.
92 lines
3.1 KiB
YAML
92 lines
3.1 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: '18'
|
|
|
|
- name: Enable Corepack
|
|
run: corepack enable
|
|
|
|
- name: Install dependencies
|
|
run: yarn install --immutable
|
|
|
|
- name: Generate types
|
|
run: ./node_modules/.bin/subql codegen pezkuwi.yaml
|
|
|
|
- name: Build
|
|
run: ./node_modules/.bin/subql build pezkuwi.yaml
|
|
|
|
# The noter and payout bots ship as their own images (docker-compose.prod.yml)
|
|
# and nothing else here builds or runs them. Build each image as production
|
|
# does, then run inside it: the crypto stack must be the locked one and sign
|
|
# with every key type, and the bot must load its whole module graph and stop
|
|
# only where it reads the mnemonic that CI does not have.
|
|
bots:
|
|
name: bots (${{ matrix.bot }})
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- bot: noter
|
|
mode: esm
|
|
expect: 'No noter mnemonic found'
|
|
- bot: payout-bot
|
|
mode: cjs
|
|
expect: "ENOENT: no such file or directory, open '/run/secrets/payout_mnemonic'"
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
|
|
- name: Build the image
|
|
run: docker build -t bot ${{ matrix.bot }}
|
|
|
|
# Dependency Review allows these GPL-3.0 packages in the lockfiles only
|
|
# because no image installs them; this is the check that keeps it true.
|
|
- name: No light client in the image
|
|
run: |
|
|
docker run --rm bot sh -c '! [ -e node_modules/@bizinikiwi ] && ! [ -e node_modules/smoldot ]' || {
|
|
echo "the image installs the light client; it must be built with --omit=optional"; exit 1; }
|
|
|
|
- name: Crypto stack
|
|
run: docker run --rm -v "$PWD/scripts/bot-smoke.mjs:/app/bot-smoke.mjs:ro" bot node bot-smoke.mjs ${{ matrix.mode }}
|
|
|
|
- name: The bot loads and stops at its missing mnemonic
|
|
env:
|
|
EXPECT: ${{ matrix.expect }}
|
|
run: |
|
|
set +e
|
|
out=$(timeout 60 docker run --rm bot 2>&1)
|
|
code=$?
|
|
set -e
|
|
echo "$out"
|
|
[ "$code" -ne 0 ] && [ "$code" -ne 124 ] || { echo "expected the bot to exit with an error, got $code"; exit 1; }
|
|
grep -qF "$EXPECT" <<<"$out" || { echo "expected: $EXPECT"; exit 1; }
|
|
|
|
# The scripts the deploy key is pinned to are the whole of what CI can do on
|
|
# the host, so they are checked with every change.
|
|
host-scripts:
|
|
name: Host deploy scripts
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
- run: |
|
|
shellcheck -S warning ops/host/subquery-deploy ops/host/subquery-deploy-ssh ops/host/test-deploy.sh
|
|
bash ops/host/test-deploy.sh
|