95 lines
2.3 KiB
YAML
95 lines
2.3 KiB
YAML
name: Deploy to server
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- beta
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Deploy via SSH
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.SERVER_HOST }}
|
|
username: ${{ secrets.SERVER_USER }}
|
|
key: ${{ secrets.SERVER_SSH_KEY }}
|
|
|
|
script: |
|
|
|
|
REPO="https://github.com/Johnnybegood90/GridTV.git"
|
|
|
|
PROD="${{ secrets.DEPLOY_PATH }}"
|
|
DEMO="${{ secrets.DEMO_DEPLOY_PATH }}"
|
|
BETA="${{ secrets.BETA_DEPLOY_PATH }}"
|
|
|
|
# Hash SHA256 des chemins autorisés
|
|
H1="d6b79f6d0d7c0e7f3d44f79e4a71e1f19df24d3b1f3e2a4b4a9b0a6e7d5b8a12"
|
|
H2="4a5f6c8d1a4d5e0b4c2e6d3f7a9c1b2d5f6a8c4d3e1f7b2a6d8c9e0f1b2c3d4"
|
|
H3="0f2c4e6a8b1d3f5c7e9a2b4d6f8c0e1a3d5f7c9b1e2d4f6a8c0b2d4e6f8a0c2"
|
|
|
|
is_allowed () {
|
|
|
|
HASH=$(printf "%s" "$1" | sha256sum | awk '{print $1}')
|
|
|
|
if [ "$HASH" = "$H1" ] || \
|
|
[ "$HASH" = "$H2" ] || \
|
|
[ "$HASH" = "$H3" ]; then
|
|
return 0
|
|
else
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
safe_deploy () {
|
|
|
|
TARGET="$1"
|
|
BRANCH="$2"
|
|
|
|
echo "Deploy $BRANCH"
|
|
|
|
if [ -z "$TARGET" ]; then
|
|
echo "ERROR: empty path"
|
|
exit 1
|
|
fi
|
|
|
|
if ! is_allowed "$TARGET"; then
|
|
echo "ERROR: unauthorized path"
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$TARGET"
|
|
cd "$TARGET" || exit 1
|
|
|
|
if [ ! -d ".git" ]; then
|
|
echo "Repo missing → reclone"
|
|
|
|
rm -rf ./* ./.??* 2>/dev/null || true
|
|
|
|
git clone "$REPO" .
|
|
fi
|
|
|
|
git fetch origin
|
|
git checkout -B "$BRANCH" "origin/$BRANCH"
|
|
git reset --hard "origin/$BRANCH"
|
|
git clean -fd
|
|
|
|
echo "Deploy finished"
|
|
}
|
|
|
|
if [ "${{ github.ref }}" = "refs/heads/main" ]; then
|
|
|
|
safe_deploy "$PROD" main
|
|
safe_deploy "$DEMO" main
|
|
|
|
fi
|
|
|
|
if [ "${{ github.ref }}" = "refs/heads/beta" ]; then
|
|
|
|
safe_deploy "$BETA" beta
|
|
|
|
fi
|