aura-crm/production/.gitea/workflows/build-release.yml

name: build-and-release

# EXAMPLE / OPTIONAL — this workflow is not required for a base install.
# `docker compose up --build` (see the repo README) builds everything
# locally from source; you don't need CI or a private registry for that.
#
# This is included as a reference for a self-hosted-CI deployment pattern:
# build images on a runner (not on the production host itself, so a build
# never competes with the running app for RAM/CPU), push them to your own
# registry, and have the production host `docker compose pull` instead of
# building in place. Adjust GITEA_URL/REGISTRY/IMAGE_OWNER below (or port
# this to GitHub Actions/another CI) to your own infrastructure before
# using it — the values here are placeholders.
on:
  push:
    branches: [main]

env:
  # Your Gitea instance's normal HTTPS git/web/API endpoint.
  GITEA_URL: https://gitea.your-domain.com
  # Your container registry (Gitea's own OCI registry, Docker Hub, GHCR,
  # etc.). If your registry's public domain doesn't work for `docker
  # login`/push directly (e.g. due to how a reverse proxy in front of it
  # resolves the bearer-token auth realm), point this at whatever endpoint
  # does work for registry traffic specifically — that's a registry/proxy
  # configuration detail on your end, not something this workflow can fix.
  REGISTRY: registry.your-domain.com
  IMAGE_OWNER: your-github-org

jobs:
  build:
    runs-on: docker
    container:
      image: docker:27-cli
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
    steps:
      - name: Install build tools
        run: apk add --no-cache bash git curl jq

      - name: Checkout
        shell: bash
        run: |
          git clone --depth 50 "https://${{ env.IMAGE_OWNER }}:${{ secrets.REGISTRY_TOKEN }}@gitea.your-domain.com/${{ env.IMAGE_OWNER }}/production.git" repo
          cd repo && git checkout "${{ github.sha }}"

      - name: Log in to registry
        shell: bash
        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "${{ env.REGISTRY }}" -u "${{ env.IMAGE_OWNER }}" --password-stdin

      - name: Build and push backend image
        shell: bash
        working-directory: repo
        run: |
          SHA_TAG="$(echo "${{ github.sha }}" | cut -c1-8)"
          echo "SHA_TAG=$SHA_TAG" >> "$GITEA_ENV"
          docker build \
            -t "${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/production-backend:latest" \
            -t "${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/production-backend:$SHA_TAG" \
            ./backend
          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/production-backend:latest"
          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/production-backend:$SHA_TAG"

      # Vite bakes VITE_CORE_URL/VITE_PRODUCTION_URL in at build time — set
      # these to the public URLs your staff/browsers will actually use to
      # reach core/production (same values as docker-compose.yml's
      # WEB_CORE_URL/WEB_PRODUCTION_URL for a local build). Hardcoded here
      # rather than read from .env since this job doesn't have access to
      # that file, and these are public URLs, not secrets.
      - name: Build and push web image
        shell: bash
        working-directory: repo
        run: |
          docker build \
            --build-arg VITE_CORE_URL=https://core.your-domain.com \
            --build-arg VITE_PRODUCTION_URL=https://api.your-domain.com \
            -t "${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/production-web:latest" \
            -t "${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/production-web:$SHA_TAG" \
            ./web
          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/production-web:latest"
          docker push "${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/production-web:$SHA_TAG"

      # Release notes = the newest "## YYYY-MM-DD" section of CHANGELOG.md
      # verbatim (the human-curated, owner-facing changelog already
      # maintained per feature — see Settings → Обновления in the app
      # itself) — not regenerated from commit messages, which are a
      # developer-facing log, not a release note.
      - name: Create Gitea release
        shell: bash
        working-directory: repo
        run: |
          VERSION="$(date -u +%Y.%m.%d)-$SHA_TAG"
          NOTES="$(awk '/^## /{if (n++) exit} n' backend/CHANGELOG.md)"
          jq -n --arg tag "$VERSION" --arg body "$NOTES" \
            '{tag_name: $tag, target_commitish: "main", name: $tag, body: $body}' > /tmp/release.json
          curl -sf -X POST \
            -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d @/tmp/release.json \
            "${{ env.GITEA_URL }}/api/v1/repos/${{ env.IMAGE_OWNER }}/production/releases"