Déployer automatiquement une application (CD)

#!/usr/bin/env bash
# Déploie une version de sorbier-frais : ./deployer.sh sha-3f9c2e1
set -euo pipefail

VERSION="${1:?Usage : deployer.sh <étiquette>}"
if [[ ! "$VERSION" =~ ^(sha-[0-9a-f]{7}|[0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
  echo "Étiquette invalide : $VERSION" >&2
  exit 2
fi
cd /opt/sorbier-frais

PRECEDENTE=$(cat version-courante 2>/dev/null || true)
export VERSION

echo "Déploiement de $VERSION (précédente : ${PRECEDENTE:-aucune})"
docker compose pull api
if [[ "${MIGRER:-oui}" == "oui" ]]; then
  docker compose run --rm api npm run migrate
fi
docker compose up -d api

for _ in $(seq 1 20); do
  if curl --fail --silent --output /dev/null http://127.0.0.1:3000/health; then
    echo "$VERSION" > version-courante
    echo "Version $VERSION en service"
    exit 0
  fi
  sleep 3
done

echo "La version $VERSION ne répond pas : retour à ${PRECEDENTE:-aucune}" >&2
if [[ -n "$PRECEDENTE" ]]; then
  VERSION="$PRECEDENTE" docker compose up -d api
fi
exit 1

name: CI/CD

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-cd-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  IMAGE: ghcr.io/sorbier/sorbier-frais

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run lint

  tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm test -- --ci

  image:
    needs: [lint, tests]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      tag: ${{ steps.etiquette.outputs.tag }}
    steps:
      - uses: actions/checkout@v7
      - id: etiquette
        run: echo "tag=sha-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
      - uses: docker/setup-buildx-action@v4
      - if: github.event_name == 'push'
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        with:
          context: .
          push: ${{ github.event_name == 'push' }}
          tags: ${{ env.IMAGE }}:${{ steps.etiquette.outputs.tag }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy-recette:
    needs: image
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    environment:
      name: recette
      url: https://recette.sorbier.example
    concurrency:
      group: deploiement-recette
      cancel-in-progress: false
    steps:
      - name: Préparer la connexion SSH
        env:
          SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          KNOWN_HOSTS: ${{ vars.DEPLOY_KNOWN_HOSTS }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
      - name: Déployer
        run: ssh deploy@recette.sorbier.example "/opt/sorbier-frais/deployer.sh ${{ needs.image.outputs.tag }}"
      - name: Test de fumée
        run: curl --fail --silent --show-error --retry 5 --retry-delay 3 --retry-all-errors https://recette.sorbier.example/health

  deploy-production:
    needs: [image, deploy-recette]
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://frais.sorbier.example
    concurrency:
      group: deploiement-production
      cancel-in-progress: false
    steps:
      - name: Préparer la connexion SSH
        env:
          SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          KNOWN_HOSTS: ${{ vars.DEPLOY_KNOWN_HOSTS }}
        run: |
          install -m 700 -d ~/.ssh
          printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519
          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
      - name: Déployer
        run: ssh deploy@frais.sorbier.example "/opt/sorbier-frais/deployer.sh ${{ needs.image.outputs.tag }}"
      - name: Test de fumée
        run: curl --fail --silent --show-error --retry 5 --retry-delay 3 --retry-all-errors https://frais.sorbier.example/health

  deploy:
    needs: [lint, tests]
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: recette
    steps:
      - name: Déclencher le déploiement
        env:
          DEPLOY_HOOK: ${{ secrets.DEPLOY_HOOK }}
        run: curl --fail --silent --show-error -X POST "$DEPLOY_HOOK"

name: Documentation

on:
  push:
    branches: [main]

permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  group: pages
  cancel-in-progress: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run docs:build
      - uses: actions/configure-pages@v6
      - uses: actions/upload-pages-artifact@v5
        with:
          path: docs/dist

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deploiement.outputs.page_url }}
    steps:
      - id: deploiement
        uses: actions/deploy-pages@v5