Capstone part 2: the pipeline

The workflow, top half

One file, .github/workflows/ship.yml, and notesy tests, builds, ships, and deploys itself on every merge. First the CI half, straight from unit 7:

name: ship
on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install -r requirements.txt
      - run: pytest

Runs on PRs and on main, so broken code is caught before merge (7-2's triggers), and every step gates the next through exit codes (7-1). Cheap steps first (7-3).

The workflow, bottom half

  deploy:
    needs: test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: docker login ghcr.io -u ada -p "${{ secrets.REGISTRY_TOKEN }}"
      - run: docker build -t ghcr.io/ada/notesy:${{ github.sha }} .
      - run: docker push ghcr.io/ada/notesy:${{ github.sha }}
      - run: ./scripts/deploy.sh ${{ github.sha }}

• needs: test: this job waits for test to pass, the pipeline chain from 8-1
• if: github.ref == ...: PRs get tested but only main deploys
• environment: production and secrets.REGISTRY_TOKEN: unit 8's secrets and environments
• Images tagged with the commit sha (7-3), pushed to GHCR (6-1)
• deploy.sh connects to the lesson 9-1 VM and runs docker compose pull && docker compose up -d

Rollback plan, tested and ready: rerun deploy.sh with the previous sha (8-3).