Repository navigation
Fix issues with z-indexes and elements scrolling out of view [] #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Part of the EDG Compiler Project, under the Apache License v2.0 with LLVM | |
| # Exceptions. | |
| # See https://edgcpp.org/LICENSE.txt for license information. | |
| # SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception | |
| # | |
| # Build and deploy AcknowlEDG over SSH. Two independent jobs: | |
| # | |
| # client builds the Vue client and rsyncs the static files into the web | |
| # root. Nothing is restarted; browsers pick up the new files once | |
| # their caches expire. | |
| # server builds the server wheel, uploads it, and runs | |
| # dev_tools/services/acknowledg/server/deploy-remote.sh on the host, | |
| # which installs it and restarts the systemd unit only when the | |
| # wheel's contents differ from what is already deployed. | |
| # | |
| # Host, paths, and credentials come from secrets in the `acknowledg` | |
| # environment (see dev_tools/services/acknowledg/README.md). The SSH setup | |
| # writes them into a `Host acknowledg` alias so they never appear on a command | |
| # line. The public API URL is the ACKNOWLEDG_API_HOST repository variable, | |
| # shared with acknowledg-forge-deploy.yml. | |
| name: AcknowlEDG Deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - dev_tools/services/acknowledg/** | |
| - dev_tools/pylibs/edgacknowledg/** | |
| # acknowledg-forge is a separate service. | |
| - '!dev_tools/pylibs/edgacknowledg/forge/**' | |
| - .github/workflows/acknowledg-deploy.yml | |
| workflow_dispatch: | |
| concurrency: | |
| group: acknowledg-deploy | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| env: | |
| ACKNOWLEDG_DIR: dev_tools/services/acknowledg | |
| jobs: | |
| client: | |
| name: Deploy client | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| environment: acknowledg | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| cache-dependency-path: ${{ env.ACKNOWLEDG_DIR }}/client/package-lock.json | |
| - name: Build client | |
| working-directory: ${{ env.ACKNOWLEDG_DIR }}/client | |
| env: | |
| VITE_EDG_ACKNOWLEDG_API_HOST: ${{ vars.ACKNOWLEDG_API_HOST }} | |
| run: | | |
| # The client opens `${VITE_EDG_ACKNOWLEDG_API_HOST}/review`; without | |
| # a scheme the browser resolves that relative to the page instead. | |
| case "${VITE_EDG_ACKNOWLEDG_API_HOST}" in | |
| ws://?*|wss://?*) ;; | |
| *) | |
| echo '::error::ACKNOWLEDG_API_HOST must be a ws:// or wss:// URL' | |
| exit 1 | |
| ;; | |
| esac | |
| npm ci | |
| npm run build | |
| - name: Configure SSH | |
| env: | |
| SSH_HOST: ${{ secrets.ACKNOWLEDG_SSH_HOST }} | |
| SSH_USER: ${{ secrets.ACKNOWLEDG_SSH_USER }} | |
| SSH_PORT: ${{ secrets.ACKNOWLEDG_SSH_PORT || '22' }} | |
| SSH_PRIVATE_KEY: ${{ secrets.ACKNOWLEDG_SSH_PRIVATE_KEY }} | |
| SSH_KNOWN_HOSTS: ${{ secrets.ACKNOWLEDG_SSH_KNOWN_HOSTS }} | |
| run: &configure-ssh | | |
| install -d -m 700 ~/.ssh | |
| install -m 600 /dev/null ~/.ssh/deploy_key | |
| printf '%s\n' "${SSH_PRIVATE_KEY}" > ~/.ssh/deploy_key | |
| printf '%s\n' "${SSH_KNOWN_HOSTS}" > ~/.ssh/known_hosts | |
| cat > ~/.ssh/config <<EOF | |
| Host acknowledg | |
| HostName ${SSH_HOST} | |
| User ${SSH_USER} | |
| Port ${SSH_PORT} | |
| IdentityFile ~/.ssh/deploy_key | |
| IdentitiesOnly yes | |
| StrictHostKeyChecking yes | |
| BatchMode yes | |
| EOF | |
| chmod 600 ~/.ssh/config ~/.ssh/known_hosts | |
| - name: Upload client files | |
| working-directory: ${{ env.ACKNOWLEDG_DIR }}/client | |
| env: | |
| CLIENT_PATH: ${{ secrets.ACKNOWLEDG_CLIENT_PATH }} | |
| run: | | |
| # --delay-updates swaps the new files in at the end of the transfer | |
| # and --delete-after removes stale hashed assets only once the new | |
| # index.html no longer references them. | |
| rsync --recursive --links --compress --checksum --itemize-changes \ | |
| --delay-updates --delete-after \ | |
| dist/ "acknowledg:${CLIENT_PATH}/" | |
| server: | |
| name: Deploy server | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| environment: acknowledg | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v10.3.0 | |
| - name: Build server wheel | |
| id: build | |
| working-directory: ${{ env.ACKNOWLEDG_DIR }}/server | |
| run: | | |
| uv build --wheel --out-dir dist | |
| wheel=$(ls dist/*.whl) | |
| # Fingerprint the wheel by its RECORD, which lists a hash of every | |
| # file in it; the zip itself isn't reproducible (timestamps). WHEEL | |
| # only names the build backend's version, so leave it out to avoid | |
| # restarts when nothing we ship has changed. | |
| fingerprint=$(unzip -p "${wheel}" '*.dist-info/RECORD' \ | |
| | grep -v -E '\.dist-info/(WHEEL|RECORD),' \ | |
| | sort | sha256sum | cut -d' ' -f1) | |
| echo "Built $(basename "${wheel}") with fingerprint ${fingerprint}" | |
| echo "wheel=${wheel}" >> "${GITHUB_OUTPUT}" | |
| echo "fingerprint=${fingerprint}" >> "${GITHUB_OUTPUT}" | |
| - name: Configure SSH | |
| env: | |
| SSH_HOST: ${{ secrets.ACKNOWLEDG_SSH_HOST }} | |
| SSH_USER: ${{ secrets.ACKNOWLEDG_SSH_USER }} | |
| SSH_PORT: ${{ secrets.ACKNOWLEDG_SSH_PORT || '22' }} | |
| SSH_PRIVATE_KEY: ${{ secrets.ACKNOWLEDG_SSH_PRIVATE_KEY }} | |
| SSH_KNOWN_HOSTS: ${{ secrets.ACKNOWLEDG_SSH_KNOWN_HOSTS }} | |
| run: *configure-ssh | |
| - name: Install server | |
| working-directory: ${{ env.ACKNOWLEDG_DIR }}/server | |
| env: | |
| SERVER_PATH: ${{ secrets.ACKNOWLEDG_SERVER_PATH }} | |
| SERVICE_NAME: ${{ secrets.ACKNOWLEDG_SERVICE_NAME }} | |
| WHEEL: ${{ steps.build.outputs.wheel }} | |
| FINGERPRINT: ${{ steps.build.outputs.fingerprint }} | |
| run: | | |
| wheel_name=$(basename "${WHEEL}") | |
| ssh acknowledg "mkdir -p $(printf '%q' "${SERVER_PATH}/incoming")" | |
| rsync --checksum "${WHEEL}" "acknowledg:${SERVER_PATH}/incoming/" | |
| ssh acknowledg "bash -s -- $(printf '%q ' \ | |
| "${SERVER_PATH}" "${SERVICE_NAME}" "${wheel_name}" \ | |
| "${FINGERPRINT}")" < deploy-remote.sh |