ci: publish production image to Volcengine registry

2026-07-27 11:48:53 +08:00
parent 9d17c7d8cc
commit 6b0baa0333
3 changed files with 79 additions and 102 deletions
@@ -23,14 +23,14 @@ jobs:
          git fetch --no-tags --depth=1 origin "${GITHUB_SHA}"
          git checkout --detach FETCH_HEAD

-      - name: Validate ECR configuration
+      - name: Validate Volcengine registry configuration
+        env:
+          VOLCENGINE_REGISTRY_USERNAME: ${{ secrets.VOLCENGINE_REGISTRY_USERNAME }}
+          VOLCENGINE_REGISTRY_PASSWORD: ${{ secrets.VOLCENGINE_REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
-          test -n "${{ secrets.AWS_ACCESS_KEY_ID }}"
-          test -n "${{ secrets.AWS_SECRET_ACCESS_KEY }}"
-          test -n "${{ secrets.AWS_REGION }}"
-          test -n "${{ secrets.AWS_ACCOUNT_ID }}"
-          test -n "${{ secrets.ECR_REPOSITORY }}"
+          test -n "${VOLCENGINE_REGISTRY_USERNAME}"
+          test -n "${VOLCENGINE_REGISTRY_PASSWORD}"

      - name: Build backend production image
        run: |
@@ -63,35 +63,16 @@ jobs:
            ${IMAGE_NAME}:prod-${GITHUB_SHA} \
            -c "import app; print(app.app.title)"

-      - name: Push backend image to ECR
+      - name: Push backend image to Volcengine registry
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
-          AWS_REGION: ${{ secrets.AWS_REGION }}
-          AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
-          ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
+          VOLCENGINE_REGISTRY_USERNAME: ${{ secrets.VOLCENGINE_REGISTRY_USERNAME }}
+          VOLCENGINE_REGISTRY_PASSWORD: ${{ secrets.VOLCENGINE_REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          export HTTP_PROXY= HTTPS_PROXY= ALL_PROXY= http_proxy= https_proxy= all_proxy=

-          caller_account_id="$(aws sts get-caller-identity --query Account --output text)"
-          if [ "${caller_account_id}" != "${AWS_ACCOUNT_ID}" ]; then
-            echo "AWS_ACCOUNT_ID does not match caller identity" >&2
-            exit 1
-          fi
-
-          ecr_registry="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
-          ecr_image="${ecr_registry}/${ECR_REPOSITORY}"
-
-          aws ecr describe-repositories \
-            --region "${AWS_REGION}" \
-            --repository-names "${ECR_REPOSITORY}" >/dev/null 2>&1 \
-            || aws ecr create-repository \
-              --region "${AWS_REGION}" \
-              --repository-name "${ECR_REPOSITORY}" \
-              --image-scanning-configuration scanOnPush=true \
-              --encryption-configuration encryptionType=AES256 >/dev/null
+          volcengine_registry="linksy-docker-cn-beijing.cr.volces.com"
+          volcengine_image="${volcengine_registry}/eryao/${IMAGE_NAME}"

          retry() {
            for attempt in 1 2 3; do
@@ -105,28 +86,16 @@ jobs:
            done
          }

-          ecr_login() {
-            aws ecr get-login-password --region "${AWS_REGION}" \
-              | docker login --username AWS --password-stdin "${ecr_registry}"
+          volcengine_login() {
+            printf '%s' "${VOLCENGINE_REGISTRY_PASSWORD}" \
+              | docker login --username "${VOLCENGINE_REGISTRY_USERNAME}" --password-stdin "${volcengine_registry}"
          }

-          retry ecr_login
-          docker tag "${IMAGE_NAME}:prod-${GITHUB_SHA}" "${ecr_image}:latest"
-          retry docker push "${ecr_image}:latest"
-
-          untagged_image_ids="$(aws ecr list-images \
-            --region "${AWS_REGION}" \
-            --repository-name "${ECR_REPOSITORY}" \
-            --filter tagStatus=UNTAGGED \
-            --query 'imageIds[*]' \
-            --output json)"
-          if [ "${untagged_image_ids}" != "[]" ]; then
-            aws ecr batch-delete-image \
-              --region "${AWS_REGION}" \
-              --repository-name "${ECR_REPOSITORY}" \
-              --image-ids "${untagged_image_ids}" >/dev/null \
-              || echo "Warning: ECR image cleanup failed; ensure the CI AWS user has ecr:BatchDeleteImage" >&2
-          fi
+          retry volcengine_login
+          docker tag "${IMAGE_NAME}:prod-${GITHUB_SHA}" "${volcengine_image}:${GITHUB_SHA}"
+          docker tag "${IMAGE_NAME}:prod-${GITHUB_SHA}" "${volcengine_image}:latest"
+          retry docker push "${volcengine_image}:${GITHUB_SHA}"
+          retry docker push "${volcengine_image}:latest"

  deploy-production:
    needs: build-backend-image
@@ -137,27 +106,23 @@ jobs:
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_REGION: ${{ secrets.AWS_REGION }}
+          VOLCENGINE_REGISTRY_USERNAME: ${{ secrets.VOLCENGINE_REGISTRY_USERNAME }}
+          VOLCENGINE_REGISTRY_PASSWORD: ${{ secrets.VOLCENGINE_REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail
          test -n "${DEPLOY_SSH_KEY}"
          test -n "${DEPLOY_HOST}"
          test -n "${DEPLOY_USER}"
-          test -n "${AWS_ACCESS_KEY_ID}"
-          test -n "${AWS_SECRET_ACCESS_KEY}"
-          test -n "${AWS_REGION}"
+          test -n "${VOLCENGINE_REGISTRY_USERNAME}"
+          test -n "${VOLCENGINE_REGISTRY_PASSWORD}"

      - name: Deploy production server
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
-          AWS_REGION: ${{ secrets.AWS_REGION }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          VOLCENGINE_REGISTRY_USERNAME: ${{ secrets.VOLCENGINE_REGISTRY_USERNAME }}
+          VOLCENGINE_REGISTRY_PASSWORD: ${{ secrets.VOLCENGINE_REGISTRY_PASSWORD }}
        run: |
          set -euo pipefail

@@ -165,21 +130,34 @@ jobs:
          printf '%s\n' "${DEPLOY_SSH_KEY}" > ~/.ssh/eryao_deploy_key
          chmod 600 ~/.ssh/eryao_deploy_key
          ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts
+          remote_registry_username="$(printf '%q' "${VOLCENGINE_REGISTRY_USERNAME}")"
+          remote_registry_password="$(printf '%q' "${VOLCENGINE_REGISTRY_PASSWORD}")"

          ssh -i ~/.ssh/eryao_deploy_key \
            -o IdentitiesOnly=yes \
            "${DEPLOY_USER}@${DEPLOY_HOST}" \
-            "AWS_ACCESS_KEY_ID='${AWS_ACCESS_KEY_ID}' AWS_SECRET_ACCESS_KEY='${AWS_SECRET_ACCESS_KEY}' AWS_DEFAULT_REGION='${AWS_REGION}' AWS_REGION='${AWS_REGION}' bash -se" <<'REMOTE'
+            "VOLCENGINE_REGISTRY_USERNAME=${remote_registry_username} VOLCENGINE_REGISTRY_PASSWORD=${remote_registry_password} bash -se" <<'REMOTE'
          set -euo pipefail

          cd ~/deploy
+          test -f ./.env
+          for required_key in ERYAO_DATABASE__HOST ERYAO_DATABASE__PORT ERYAO_DATABASE__NAME ERYAO_DATABASE__USER ERYAO_DATABASE__PASSWORD; do
+            grep -q "^${required_key}=" ./.env
+          done
+          sed -i \
+            -e 's#^ERYAO_DATABASE__HOST=.*#ERYAO_DATABASE__HOST=pgm-j6ckocm243gd2997.pg.cnhk.rds.aliyuncs.com#' \
+            -e 's#^ERYAO_DATABASE__PORT=.*#ERYAO_DATABASE__PORT=5432#' \
+            -e 's#^ERYAO_DATABASE__NAME=.*#ERYAO_DATABASE__NAME=supabase_db#' \
+            -e 's#^ERYAO_DATABASE__USER=.*#ERYAO_DATABASE__USER=postgres#' \
+            ./.env
+
          set -a
          . ./.env
          set +a

-          ecr_registry="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
-          aws ecr get-login-password --region "${AWS_REGION}" \
-            | sudo docker login --username AWS --password-stdin "${ecr_registry}"
+          volcengine_registry="linksy-docker-cn-beijing.cr.volces.com"
+          printf '%s' "${VOLCENGINE_REGISTRY_PASSWORD}" \
+            | sudo docker login --username "${VOLCENGINE_REGISTRY_USERNAME}" --password-stdin "${volcengine_registry}"

          sudo docker compose --env-file ./.env -f docker-compose.prod.yml --profile workers pull
          sudo docker compose --env-file ./.env -f docker-compose.prod.yml --profile workers up -d --remove-orphans