mirror of
https://github.com/MervinPraison/PraisonAI.git
synced 2026-11-10 17:29:39 -10:00
praisonai-triage-agent[bot]andMervin Praison
991bc31302
- Pin checkout to main (ref: main) so workflow_dispatch cannot publish a non-main branch to production - persist-credentials: false (no git creds retained in workspace) - Replace TOFU ssh-keyscan with pinned known_hosts from MIGRATION_TARGET_KNOWN_HOSTS secret + StrictHostKeyChecking=yes - Add trap to remove SSH private key on exit - Add BatchMode + ConnectTimeout to fail fast on unreachable host - Upload to temp files then atomic mv into place to avoid serving truncated or mixed-commit installers Co-authored-by: Mervin Praison <[email protected]>
78 lines
2.9 KiB
YAML
78 lines
2.9 KiB
YAML
name: Deploy install scripts to praison.ai
|
|
|
|
# Production praison.ai runs on Hestia (migration-target), not Azure AKS.
|
|
# Uses scoped deploy user (praison-deploy) — not root.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'src/praisonai/scripts/install.sh'
|
|
- 'src/praisonai/scripts/install.ps1'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-install-scripts
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
deploy-to-hestia:
|
|
runs-on: ubuntu-latest
|
|
environment: production-hestia
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
ref: main
|
|
persist-credentials: false
|
|
|
|
- name: Sync install scripts to Hestia
|
|
env:
|
|
SSH_PRIVATE_KEY: ${{ secrets.MIGRATION_TARGET_SSH_KEY }}
|
|
HESTIA_HOST: ${{ secrets.MIGRATION_TARGET_HOST }}
|
|
HESTIA_USER: ${{ secrets.MIGRATION_TARGET_USER }}
|
|
HESTIA_KNOWN_HOSTS: ${{ secrets.MIGRATION_TARGET_KNOWN_HOSTS }}
|
|
SOURCE_SHA: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
for var in SSH_PRIVATE_KEY HESTIA_HOST HESTIA_USER; do
|
|
if [ -z "${!var:-}" ]; then
|
|
echo "Missing secret for deploy (need MIGRATION_TARGET_SSH_KEY, MIGRATION_TARGET_HOST, MIGRATION_TARGET_USER)"
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
REMOTE_WEB="/home/hestiaadmin/web/praison.ai/pa/web"
|
|
SSH_OPTS="-o BatchMode=yes -o ConnectTimeout=15 -o StrictHostKeyChecking=yes"
|
|
|
|
mkdir -p ~/.ssh
|
|
echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
trap 'rm -f ~/.ssh/id_ed25519' EXIT
|
|
|
|
# Pin host identity via an out-of-band secret (no TOFU/ssh-keyscan).
|
|
if [ -z "${HESTIA_KNOWN_HOSTS:-}" ]; then
|
|
echo "Missing secret MIGRATION_TARGET_KNOWN_HOSTS (pinned host key). Refusing to deploy without a verified host identity."
|
|
exit 1
|
|
fi
|
|
echo "$HESTIA_KNOWN_HOSTS" > ~/.ssh/known_hosts
|
|
chmod 644 ~/.ssh/known_hosts
|
|
|
|
# Upload to temp files, then atomically move both into place in a
|
|
# single remote step to avoid serving truncated or mixed-commit files.
|
|
for f in install.sh install.ps1; do
|
|
echo "Syncing $f..."
|
|
scp $SSH_OPTS "src/praisonai/scripts/$f" "${HESTIA_USER}@${HESTIA_HOST}:${REMOTE_WEB}/.${f}.tmp"
|
|
done
|
|
|
|
ssh $SSH_OPTS "${HESTIA_USER}@${HESTIA_HOST}" \
|
|
"mv -f ${REMOTE_WEB}/.install.sh.tmp ${REMOTE_WEB}/install.sh && \
|
|
mv -f ${REMOTE_WEB}/.install.ps1.tmp ${REMOTE_WEB}/install.ps1 && \
|
|
sudo chown hestiaadmin:hestiaadmin ${REMOTE_WEB}/install.sh ${REMOTE_WEB}/install.ps1 && \
|
|
sudo chmod 644 ${REMOTE_WEB}/install.sh ${REMOTE_WEB}/install.ps1"
|
|
|
|
echo "Deployed install scripts for commit ${SOURCE_SHA}"
|
|
echo "Verify: curl -fsSL https://praison.ai/install.ps1 | head -5"
|