diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index d4844b4..2253244 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -3,7 +3,8 @@ name: CI/CD on: push: branches: - - "main" + - main + - "feature/*" jobs: deploy: @@ -22,24 +23,30 @@ jobs: run: | APP_NAME="thanksbot" DATE=$(date +'%Y%m%d') - GITHUB_BRANCH=${{ github.ref_name }} - BUILD_NUM=${{ github.run_number }} - VERSION="${APP_NAME}-${DATE}-${GITHUB_BRANCH}-${BUILD_NUM}" + BRANCH="${{ github.ref_name }}" + BRANCH_SAFE=$(echo "$BRANCH" | tr '/ .' '---') + BUILD_NUM="${{ github.run_number }}" + VERSION="${APP_NAME}-${DATE}-${BRANCH_SAFE}-${BUILD_NUM}" echo "appVersion=$VERSION" >> $GITHUB_ENV echo "appVersion=$VERSION" >> $GITHUB_OUTPUT - name: Log into Docker Registry + if: github.ref == 'refs/heads/main' run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login ${{ secrets.REGISTRY_URL }} -u ${{ secrets.REGISTRY_USERNAME }} --password-stdin - name: Build and tag Docker image run: | - docker build -t $REGISTRY/${{ env.IMAGE_NAME }}:${{ env.appVersion }} -t $REGISTRY/${{ env.IMAGE_NAME }}:latest . + docker build \ + -t "$REGISTRY/${{ env.IMAGE_NAME }}:${{ env.appVersion }}" \ + -t "$REGISTRY/${{ env.IMAGE_NAME }}:latest" . - name: Push Docker images + if: github.ref == 'refs/heads/main' run: | - docker push $REGISTRY/${{ env.IMAGE_NAME }}:${{ env.appVersion }} - docker push $REGISTRY/${{ env.IMAGE_NAME }}:latest + docker push "$REGISTRY/${{ env.IMAGE_NAME }}:${{ env.appVersion }}" + docker push "$REGISTRY/${{ env.IMAGE_NAME }}:latest" - name: Trigger Portainer webhook + if: github.ref == 'refs/heads/main' run: | - curl -X POST ${{ secrets.PORTAINER_WEBHOOK_URL }} + curl -X POST "${{ secrets.PORTAINER_WEBHOOK_URL }}" diff --git a/Dockerfile b/Dockerfile index 892725e..dac8bb7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,18 +1,12 @@ # ---- Base (Debian 12 / bookworm) ---- FROM python:3.12-slim -# Keep Python logs unbuffered and avoid .pyc files ENV PYTHONUNBUFFERED=1 \ PYTHONDONTWRITEBYTECODE=1 \ PIP_DISABLE_PIP_VERSION_CHECK=1 \ PIP_NO_CACHE_DIR=1 \ TZ=Europe/Paris -# Minimal runtime deps: -# - tzdata: timezone handling for logs -# - ca-certificates: TLS -# - libffi8: runtime for cffi -# - libsodium23: (usually not needed w/ PyNaCl wheels, but harmless/safe) RUN apt-get update && apt-get install -y --no-install-recommends \ tzdata \ ca-certificates \ @@ -20,19 +14,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ libsodium23 \ && rm -rf /var/lib/apt/lists/* -# Create non-root user RUN useradd -m -u 10001 thanksbotuser WORKDIR /app -# Install Python deps first for better layer caching COPY requirements.txt /app/requirements.txt RUN pip install -r /app/requirements.txt -# Copy the bot code COPY . /app -# Drop privileges for runtime USER thanksbotuser -# If your entrypoint is main.py at project root: -CMD ["python", "main.py"] +CMD ["python", "main.py"] \ No newline at end of file