From 7a3684a1b3713a37e446556e7adf2273ab7da6b7 Mon Sep 17 00:00:00 2001 From: enlineawork Date: Sat, 5 Sep 2026 10:15:18 -0300 Subject: [PATCH] ops: add safe GitHub production deploy --- scripts/deploy-github.sh | 284 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 284 insertions(+) create mode 100644 scripts/deploy-github.sh diff --git a/scripts/deploy-github.sh b/scripts/deploy-github.sh new file mode 100644 index 0000000..a5897db --- /dev/null +++ b/scripts/deploy-github.sh @@ -0,0 +1,284 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +APP="/var/www/dhv2.korexlabs.com" +KEY="/root/.ssh/dhv2_github" +BACKUP_ROOT="/root/DH_V2_BACKUPS" +DEPLOY_REF="${DHV2_DEPLOY_REF:-deploy}" +STAMP="$(date +%Y%m%d_%H%M%S)" +BACKUP="$BACKUP_ROOT/GITHUB_DEPLOY_${STAMP}" +STAGE="/root/dhv2-github-stage-${STAMP}" +LOG="/tmp/dhv2-github-deploy-${STAMP}.log" +API_TEST_IMAGE="dhv2-api:github-${STAMP}" +WEB_TEST_IMAGE="dhv2-web:github-${STAMP}" +PHASE="bootstrap" +PREV_SHA="" +TARGET_SHA="" +EXPECTED_API_VERSION="" +EXPECTED_WEB_VERSION="" + +cd "$APP" +export GIT_SSH_COMMAND="ssh -i $KEY -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" +exec > >(tee -a "$LOG") 2>&1 + +publish_status() { + local rc="${1:-1}" + trap - EXIT ERR + set +e + + local outcome="failure" + [ "$rc" -eq 0 ] && outcome="success" + local current="unknown" + current="$(git rev-parse HEAD 2>/dev/null || echo unknown)" + local status_file log_file status_blob log_blob tree commit + + status_file="$(mktemp /tmp/dhv2-status.XXXXXX)" + log_file="$(mktemp /tmp/dhv2-log.XXXXXX)" + + { + echo "status=$outcome" + echo "exit_code=$rc" + echo "phase=$PHASE" + echo "timestamp=$(date --iso-8601=seconds)" + echo "deploy_ref=$DEPLOY_REF" + echo "previous_sha=${PREV_SHA:-unknown}" + echo "target_sha=${TARGET_SHA:-unknown}" + echo "current_sha=$current" + echo "api_version=${EXPECTED_API_VERSION:-unknown}" + echo "web_version=${EXPECTED_WEB_VERSION:-unknown}" + echo "backup=${BACKUP:-unknown}" + } > "$status_file" + + tail -n 500 "$LOG" > "$log_file" 2>/dev/null || true + status_blob="$(git hash-object -w "$status_file" 2>/dev/null || true)" + log_blob="$(git hash-object -w "$log_file" 2>/dev/null || true)" + + if [ -n "$status_blob" ] && [ -n "$log_blob" ]; then + tree="$(printf '100644 blob %s\tdeploy.log\n100644 blob %s\tstatus.txt\n' "$log_blob" "$status_blob" | git mktree 2>/dev/null || true)" + if [ -n "$tree" ]; then + commit="$(printf 'deploy-status: %s · phase %s\n' "$outcome" "$PHASE" | git -c user.name='DH V2 Deploy Bot' -c user.email='deploy@dhv2.local' commit-tree "$tree" 2>/dev/null || true)" + [ -z "$commit" ] || git push --force origin "$commit:refs/heads/deploy-status" >/dev/null 2>&1 || true + fi + fi + + rm -f "$status_file" "$log_file" +} +trap 'rc=$?; publish_status "$rc"; exit "$rc"' EXIT + +cleanup() { + set +e + git worktree remove --force "$STAGE" >/dev/null 2>&1 || true + rm -rf "$STAGE" + docker image rm "$API_TEST_IMAGE" "$WEB_TEST_IMAGE" >/dev/null 2>&1 || true +} +trap cleanup RETURN + +rollback() { + local rc=$? + trap - ERR + PHASE="rollback" + echo + echo "============================================================" + echo " DH V2 · DEPLOY FALLÓ · ROLLBACK" + echo "============================================================" + + cd "$APP" + if [ -n "${PREV_SHA:-}" ]; then + git reset --hard "$PREV_SHA" || true + docker compose build api web /dev/null || { echo "ERROR: falta $cmd"; false; } +done +[ -f "$KEY" ] || { echo "ERROR: falta deploy key $KEY"; false; } +[ -d .git ] || { echo "ERROR: $APP no es repositorio Git"; false; } + +git config --global --add safe.directory "$APP" >/dev/null 2>&1 || true + +if [ -n "$(git status --porcelain --untracked-files=no)" ]; then + echo "ERROR: hay cambios locales versionados en producción." + git status --short + false +fi + +PREV_SHA="$(git rev-parse HEAD)" +PHASE="fetch" +git fetch origin "$DEPLOY_REF" +TARGET_SHA="$(git rev-parse "origin/$DEPLOY_REF")" + +echo "Actual: $PREV_SHA" +echo "Objetivo: $TARGET_SHA" + +if [ "$TARGET_SHA" = "$PREV_SHA" ]; then + echo "Producción ya está en el commit autorizado." + PHASE="complete" + cleanup + exit 0 +fi + +if ! git merge-base --is-ancestor "$PREV_SHA" "$TARGET_SHA"; then + echo "ERROR: origin/$DEPLOY_REF no es fast-forward desde producción." + false +fi + +PHASE="candidate-preflight" +mkdir -p "$STAGE" +git worktree add --detach "$STAGE" "$TARGET_SHA" >/dev/null + +EXPECTED_API_VERSION="$(node -p "require('$STAGE/api-v3/package.json').version")" +EXPECTED_WEB_VERSION="$(node -p "require('$STAGE/web-v2/package.json').version")" + +echo "API candidata: $EXPECTED_API_VERSION" +echo "WEB candidata: $EXPECTED_WEB_VERSION" + +docker compose --env-file "$APP/.env" -f "$STAGE/docker-compose.yml" config >/dev/null + +while IFS= read -r -d '' script; do + bash -n "$script" +done < <(find "$STAGE/scripts" -type f -name '*.sh' -print0) + +echo +echo "========== TEST API CANDIDATA ==========" +docker build --target builder -t "$API_TEST_IMAGE" "$STAGE/api-v3" "$BACKUP/database-before.dump" +tar \ + --exclude='./.git' \ + --exclude='./.env' \ + --exclude='*/node_modules' \ + --exclude='*/dist' \ + --exclude='*.zip' \ + --exclude='*.tar.gz' \ + --exclude='*.tgz' \ + -czf "$BACKUP/source-before.tar.gz" . +install -m 600 .env "$BACKUP/.env" +git rev-parse HEAD > "$BACKUP/previous.sha" +printf '%s\n' "$TARGET_SHA" > "$BACKUP/target.sha" +docker compose ps -a > "$BACKUP/docker-before.txt" +( + cd "$BACKUP" + sha256sum database-before.dump source-before.tar.gz .env previous.sha target.sha docker-before.txt > SHA256SUMS.txt + sha256sum -c SHA256SUMS.txt +) +chmod 600 "$BACKUP"/* "$BACKUP/.env" 2>/dev/null || true + +PHASE="fast-forward" +echo +echo "========== FAST-FORWARD ==========" +git log --oneline --no-decorate "$PREV_SHA..$TARGET_SHA" +git merge --ff-only "origin/$DEPLOY_REF" + +PHASE="build" +echo +echo "========== BUILD PRODUCCIÓN ==========" +docker compose build api migrate web "$BACKUP/health.json" 2>/dev/null; then + if grep -F '"status":"ok"' "$BACKUP/health.json" >/dev/null; then + HEALTH_OK=1 + break + fi + fi + sleep 2 +done + +if [ "$HEALTH_OK" -ne 1 ]; then + echo "ERROR: API no pasó healthcheck." + docker compose logs --tail=180 api + false +fi + +cat "$BACKUP/health.json" +echo + +grep -Fq "\"version\":\"$EXPECTED_API_VERSION\"" "$BACKUP/health.json" +grep -Fq '"database":"ok"' "$BACKUP/health.json" + +WEB_CODE="$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 http://127.0.0.1:8182/)" +[ "$WEB_CODE" = "200" ] || { echo "ERROR: WEB HTTP $WEB_CODE"; false; } + +PHASE="verify" +echo +echo "========== VERIFICACIÓN FINAL ==========" +docker compose ps -a | tee "$BACKUP/docker-after.txt" +if docker compose ps --status running --services | grep -Fxq api && docker compose ps --status running --services | grep -Fxq web && docker compose ps --status running --services | grep -Fxq db; then + echo "Servicios críticos: OK" +else + echo "ERROR: falta un servicio crítico en ejecución." + false +fi + +PHASE="post-backup" +docker compose exec -T db sh -lc 'pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" -Fc' "$BACKUP/database-after.dump" +git rev-parse HEAD > "$BACKUP/deployed.sha" +printf 'API=%s\nWEB=%s\n' "$EXPECTED_API_VERSION" "$EXPECTED_WEB_VERSION" > "$BACKUP/deployed-versions.txt" +( + cd "$BACKUP" + sha256sum database-after.dump deployed.sha deployed-versions.txt health.json migrations.txt docker-after.txt >> SHA256SUMS.txt + sha256sum -c SHA256SUMS.txt +) +chmod 600 "$BACKUP"/* "$BACKUP/.env" 2>/dev/null || true + +PHASE="complete" +trap - ERR +cleanup + +echo +echo "============================================================" +echo " DH V2 · DEPLOY OK" +echo "============================================================" +echo "Commit: $TARGET_SHA" +echo "API: $EXPECTED_API_VERSION" +echo "WEB: $EXPECTED_WEB_VERSION" +echo "Backup: $BACKUP" +echo "============================================================"