deytenit
fcf6895feb
## Description This PR fixes S3 deployment errors, resolves rollout verification timeouts, and improves security headers: 1. **S3 Static Deployment**: - Stripped trailing slash from `S3_ENDPOINT_URL`. - Removed `--metadata-directive REPLACE` from `ci/scripts/deploy-static.sh`. That flag is only valid for S3-to-S3 copies and caused `SignatureDoesNotMatch` errors during `PutObject` on Yandex Cloud Object Storage. 2. **Rollout Verification**: - Modernized User-Agent in `services-docs-next-required.yml` and `services-www-next-required.yml` to prevent Cloudflare Bot Management from blocking/challenging GitHub Actions runner IPs. - Captured HTTP status code into a temp file instead of silently suppressing with `-f` and `2>/dev/null`. - Added Cloudflare WAF / challenge resilience: if runner IPs are blocked by Cloudflare WAF after GitOps deployment manifests were pushed, avoid false negative failure. 3. **Nginx Security & CORS Hardening**: - Added `absolute_redirect off;` to `ci/config/nginx/default.conf` to prevent HTTP protocol downgrade on locale redirects (`/` -> `/en/` or `/ru/`) behind reverse proxy. - Added `add_header Access-Control-Allow-Origin "*" always;` for fonts, static assets, and `version.json`. 4. **Workflow Path Triggers**: - Included `ci/scripts/**`, `ci/docker/**`, and `ci/config/nginx/**` in relevant path triggers. ## Verification - `pnpm typecheck`: Passed (0 errors) - `pnpm lint`: Passed (0 warnings) - `pnpm test`: Passed (all suites passed) - `pnpm build`: Passed (clean monorepo build) - Nginx config test: validated successfully via Docker container
206 lines
5.7 KiB
YAML
206 lines
5.7 KiB
YAML
name: services/static - next/required
|
|
|
|
on:
|
|
push:
|
|
branches: [next]
|
|
paths:
|
|
- 'services/static/**'
|
|
- 'packages/ui/**'
|
|
- 'packages/stl/**'
|
|
- 'packages/i18n/**'
|
|
- '.github/workflows/services-static-next-required.yml'
|
|
- 'ci/scripts/**'
|
|
- 'pnpm-lock.yaml'
|
|
|
|
concurrency:
|
|
group: ci-static-${{ github.ref_name }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
|
|
jobs:
|
|
setup-stage:
|
|
name: Setup - Stage
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
cache-hit: ${{ steps.cache-pnpm-store.outputs.cache-hit }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9.12.3
|
|
|
|
- name: Setup Node.js with pnpm cache
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: 'pnpm'
|
|
|
|
- name: Cache pnpm store
|
|
id: cache-pnpm-store
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.pnpm-store
|
|
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
build-configs:
|
|
name: Build - Configs
|
|
needs: setup-stage
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9.12.3
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: 'pnpm'
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Build Rsbuild config
|
|
run: pnpm --filter @ermnvldmr/rsbuild-config build
|
|
- name: Build i18n
|
|
run: pnpm --filter @ermnvldmr/i18n build
|
|
- name: Upload Config Artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: rsbuild-config-dist
|
|
path: packages/rsbuild-config/dist
|
|
retention-days: 1
|
|
- name: Upload i18n dist
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: i18n-dist
|
|
path: packages/i18n/dist
|
|
retention-days: 1
|
|
|
|
lint-static:
|
|
name: Lint - Static
|
|
needs: build-configs
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9.12.3
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: 'pnpm'
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Download Config Artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: rsbuild-config-dist
|
|
path: packages/rsbuild-config/dist
|
|
- name: Download i18n dist
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: i18n-dist
|
|
path: packages/i18n/dist
|
|
- name: Lint static service
|
|
run: pnpm --filter @ermnvldmr/static lint
|
|
|
|
typecheck-static:
|
|
name: Typecheck - Static
|
|
needs: build-configs
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9.12.3
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: 'pnpm'
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Download Config Artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: rsbuild-config-dist
|
|
path: packages/rsbuild-config/dist
|
|
- name: Download i18n dist
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: i18n-dist
|
|
path: packages/i18n/dist
|
|
- name: Typecheck static service
|
|
run: pnpm --filter @ermnvldmr/static typecheck
|
|
|
|
build-static:
|
|
name: Build - Static Site
|
|
needs: build-configs
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9.12.3
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: 'pnpm'
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Download Config Artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: rsbuild-config-dist
|
|
path: packages/rsbuild-config/dist
|
|
- name: Download i18n dist
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: i18n-dist
|
|
path: packages/i18n/dist
|
|
- name: Build static service
|
|
run: pnpm --filter @ermnvldmr/static build
|
|
- name: Upload build artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: static-dist
|
|
path: services/static/dist/
|
|
retention-days: 1
|
|
|
|
deploy-s3:
|
|
name: Deploy - S3
|
|
needs: [lint-static, typecheck-static, build-static]
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/next'
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Download build artifacts
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: static-dist
|
|
path: services/static/dist/
|
|
|
|
- name: Deploy to S3
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.STATIC_AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.STATIC_AWS_SECRET_ACCESS_KEY }}
|
|
AWS_DEFAULT_REGION: ${{ secrets.STATIC_AWS_REGION }}
|
|
S3_BUCKET: ${{ secrets.STATIC_S3_BUCKET }}
|
|
AWS_REGION: ${{ secrets.STATIC_AWS_REGION }}
|
|
S3_ENDPOINT_URL: ${{ secrets.STATIC_S3_ENDPOINT_URL }}
|
|
run: |
|
|
chmod +x ci/scripts/deploy-static.sh
|
|
./ci/scripts/deploy-static.sh
|