initialising for ci-cd pipeline

2026-09-16 11:53:55 +05:30
parent 666979cf22
commit 8e472ac996
48 changed files with 2224 additions and 62 deletions
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# deploy.yml › backend — build (or reuse) the self-contained release for BACKEND_HASH into
+# /opt/erpcore/releases/backend/<hash>. Releases are shared by test and release, so a
+# Dev → production merge that carries the same Backend/ERPCore tree skips the build entirely.
+# shellcheck source=common.sh
+source "$(dirname "${BASH_SOURCE[0]}")/common.sh"
+
+: "${BACKEND_HASH:?BACKEND_HASH is required}"
+target="$RELEASES_DIR/$BACKEND_HASH"
+
+reuse_if_built() {
+  if [[ -x "$target/ERPCore" ]]; then
+    log "backend $BACKEND_HASH already built → reused ($target)"
+    set_output reused true
+    exit 0
+  fi
+}
+
+reuse_if_built
+with_build_lock
+reuse_if_built # another job may have built it while we waited for the lock
+
+# Only the exact tree can be built. A rollback hash whose release was pruned cannot be recreated
+# from a different checkout — fail instead of deploying something else under that name.
+[[ "$(tree_hash "$BACKEND_PATH")" == "$BACKEND_HASH" ]] ||
+  fail "no release for $BACKEND_HASH, and this checkout's $BACKEND_PATH is a different tree (pruned rollback target?)"
+
+mkdir -p "$RELEASES_DIR"
+tmp="$target.tmp"
+rm -rf "$tmp"
+mkdir -p "$tmp"
+z="$(selinux_mount_suffix)"
+
+log "building backend $BACKEND_HASH (capped: 2 CPU / 1500 MB)"
+docker run --rm --cpus=2 --cpu-shares=512 --memory=1500m \
+  -e DOTNET_CLI_TELEMETRY_OPTOUT=1 -e DOTNET_NOLOGO=1 \
+  -v "$PWD/Backend:/src$z" \
+  -v "$tmp:/out$z" \
+  -v erp-nuget:/root/.nuget/packages \
+  -w /src "$DOTNET_SDK_IMAGE" \
+  dotnet publish ERPCore/ERPCore.csproj -c Release -r linux-x64 --self-contained true -o /out
+
+[[ -x "$tmp/ERPCore" ]] || fail "publish finished but $tmp/ERPCore is missing"
+
+# Root-owned and read-only for the service user: the app never writes into its own release
+# (uploads and logs live under /var/lib/erpcore and /var/log/erpcore).
+chown -R root:root "$tmp"
+chmod -R u=rwX,go=rX "$tmp"
+chmod 755 "$tmp/ERPCore"
+mv "$tmp" "$target"
+if command -v restorecon >/dev/null 2>&1; then restorecon -R "$target"; fi
+
+log "backend release ready: $target"
+set_output reused false