575bdefd0e
docker-compose.prod.yml targets the public VPS: Postgres is never published, the app binds to 127.0.0.1 (Caddy proxies it), and every service has a memory/CPU cap plus no-new-privileges / cap_drop / read-only rootfs. deploy/deploy.sh rolls out main with a host-side build (migrations run via the entrypoint). CI type-checks and builds the frontend and byte-compiles the backend on every push to main.
35 lines
969 B
YAML
35 lines
969 B
YAML
name: CI
|
|
# Lightweight validation on every push to main: type-check + build the frontend and
|
|
# byte-compile the backend. The image build and rollout happen on the asgard host
|
|
# (see deploy/README.md); this just catches breakage early.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
frontend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
- run: npm ci
|
|
working-directory: frontend
|
|
- run: npx tsc --noEmit
|
|
working-directory: frontend
|
|
- run: npm run build
|
|
working-directory: frontend
|
|
|
|
backend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- run: pip install -r requirements.txt
|
|
working-directory: backend
|
|
- run: python -m compileall -q app
|
|
working-directory: backend
|