498 lines
19 KiB
YAML
498 lines
19 KiB
YAML
# ============================================================
|
||
# Docker Build & Push（Remote Host via Tailscale SSH）
|
||
# ============================================================
|
||
# 說明：使用 Tailscale SSH 連線到私有主機執行 Docker build
|
||
# 重要：此 workflow 完全不使用傳統 SSH key，僅使用 Tailscale SSH
|
||
# ============================================================
|
||
|
||
name: Docker Build & Push (Remote Host via Tailscale)
|
||
|
||
on:
|
||
# 手動觸發，支援輸入 image tag
|
||
workflow_dispatch:
|
||
inputs:
|
||
image_tag:
|
||
description: "Docker Image Tag（例如：0.1.10.test）"
|
||
required: true
|
||
default: "0.1.10.test"
|
||
type: string
|
||
|
||
# ============================================================
|
||
# 環境變數設定
|
||
# ============================================================
|
||
env:
|
||
# 遠端主機工作目錄
|
||
REMOTE_WORKDIR: /home/bioailab/miniconda3/lid/app/docker_build
|
||
# 專案名稱
|
||
PROJECT_NAME: ConvertX-CN
|
||
# Docker Hub 映像庫
|
||
DOCKER_IMAGE_REPO: convertx/convertx-cn
|
||
|
||
jobs:
|
||
build-and-push:
|
||
name: 🚀 遠端 Docker Build & Push
|
||
runs-on: ubuntu-latest
|
||
|
||
steps:
|
||
# ========================================
|
||
# Step 1: Checkout repository
|
||
# 說明：檢出程式碼（雖然 build 在遠端，但需要 workflow 完整性）
|
||
# ========================================
|
||
- name: 📥 Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
# ========================================
|
||
# Step 2: 啟動 Tailscale（非互動模式）
|
||
# 說明：使用 Tailscale Auth Key 加入 tailnet，啟用 SSH
|
||
# 重要：必須使用 --ssh 參數才能使用 tailscale ssh
|
||
# ========================================
|
||
- name: 🔗 啟動 Tailscale 連線（非互動模式）
|
||
uses: tailscale/github-action@v2
|
||
with:
|
||
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
|
||
args: "--ssh --accept-dns=false --accept-routes=false"
|
||
# 使用 ephemeral key，runner 結束後自動離開 tailnet
|
||
# --ssh: 啟用 Tailscale SSH 功能
|
||
# --accept-dns=false: 不使用 Tailscale DNS
|
||
# --accept-routes=false: 不接受其他節點的路由
|
||
|
||
# ========================================
|
||
# Step 3: 驗證 Tailscale 連線
|
||
# 說明：確認 Tailscale 已成功連線並顯示狀態
|
||
# ========================================
|
||
- name: ✅ 驗證 Tailscale 連線狀態
|
||
run: |
|
||
echo "========================================"
|
||
echo "🔍 檢查 Tailscale 連線狀態"
|
||
echo "========================================"
|
||
|
||
# 顯示 Tailscale 狀態
|
||
echo ""
|
||
echo "📊 Tailscale 狀態："
|
||
tailscale status
|
||
|
||
# 顯示本機 Tailscale IP
|
||
echo ""
|
||
echo "🌐 本機 Tailscale IP："
|
||
TAILSCALE_IP=$(tailscale ip -4)
|
||
echo "${TAILSCALE_IP}"
|
||
|
||
# 確認 SSH 功能已啟用
|
||
echo ""
|
||
echo "🔐 檢查 SSH 功能狀態："
|
||
if tailscale status --json | grep -q '"SSH":true'; then
|
||
echo "✅ Tailscale SSH 功能已啟用"
|
||
else
|
||
echo "⚠️ 正在檢查 SSH 狀態..."
|
||
tailscale status --json | head -50
|
||
fi
|
||
|
||
# 等待 Tailscale 完全連線
|
||
echo ""
|
||
echo "⏳ 等待 Tailscale 連線穩定..."
|
||
sleep 5
|
||
|
||
# 測試與目標主機的連通性
|
||
echo ""
|
||
echo "📡 測試與遠端主機的連通性..."
|
||
echo "目標主機: ${{ secrets.SSH_HOST }}"
|
||
|
||
if tailscale ping --c 3 "${{ secrets.SSH_HOST }}"; then
|
||
echo ""
|
||
echo "✅ Tailscale 連線測試成功！"
|
||
else
|
||
echo ""
|
||
echo "⚠️ Tailscale ping 失敗，但 SSH 可能仍可運作，繼續執行..."
|
||
fi
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 4: 測試 Tailscale SSH 連線（非互動式）
|
||
# 說明：使用 tailscale ssh 測試連線，確保不需要人工登入
|
||
# ========================================
|
||
- name: 🔐 測試 Tailscale SSH 連線（非互動式）
|
||
run: |
|
||
echo "========================================"
|
||
echo "🔐 測試 Tailscale SSH 連線（非互動式）"
|
||
echo "========================================"
|
||
echo "使用者: ${{ secrets.SSH_USER }}"
|
||
echo "主機: ${{ secrets.SSH_HOST }}"
|
||
echo ""
|
||
|
||
# 設定超時時間，避免卡住
|
||
echo "⏳ 嘗試 SSH 連線（超時 30 秒）..."
|
||
|
||
# 使用 timeout 命令確保不會卡住
|
||
if timeout 30 tailscale ssh -o "StrictHostKeyChecking=no" -o "BatchMode=yes" \
|
||
${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} \
|
||
"echo '✅ Tailscale SSH 連線成功！' && echo '主機名稱:' && hostname && echo '當前使用者:' && whoami" 2>&1; then
|
||
echo ""
|
||
echo "✅ SSH 非互動式測試成功！"
|
||
else
|
||
# 檢查是否出現需要登入的訊息
|
||
echo ""
|
||
echo "❌ SSH 連線失敗，嘗試診斷..."
|
||
echo ""
|
||
|
||
# 嘗試不帶選項的連線
|
||
RESULT=$(timeout 10 tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} "hostname" 2>&1 || true)
|
||
echo "診斷輸出: ${RESULT}"
|
||
|
||
if echo "${RESULT}" | grep -qi "authenticate\|login.tailscale.com\|additional check"; then
|
||
echo ""
|
||
echo "========================================"
|
||
echo "❌ 錯誤：Tailscale SSH 需要互動式登入！"
|
||
echo "========================================"
|
||
echo ""
|
||
echo "🔧 可能的原因："
|
||
echo " 1. TAILSCALE_AUTHKEY 沒有啟用 SSH 權限"
|
||
echo " 2. 遠端主機的 Tailscale SSH policy 需要調整"
|
||
echo " 3. Auth Key 需要重新產生（勾選 'Pre-authorized'）"
|
||
echo ""
|
||
echo "📋 建議修復步驟："
|
||
echo " 1. 前往 https://login.tailscale.com/admin/settings/keys"
|
||
echo " 2. 產生新的 Auth Key，確保勾選："
|
||
echo " - Reusable"
|
||
echo " - Ephemeral"
|
||
echo " - Pre-authorized（重要！）"
|
||
echo " 3. 更新 GitHub Secret: TAILSCALE_AUTHKEY"
|
||
echo ""
|
||
exit 1
|
||
fi
|
||
|
||
echo "⚠️ 連線可能有其他問題，但不是登入問題"
|
||
fi
|
||
|
||
echo ""
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 5: Smoke Test（環境驗證）
|
||
# 說明：快速驗證遠端環境是否正常
|
||
# ========================================
|
||
- name: 🧪 Smoke Test（環境驗證）
|
||
run: |
|
||
echo "========================================"
|
||
echo "🧪 Smoke Test - 驗證遠端環境"
|
||
echo "========================================"
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'REMOTE_EOF'
|
||
set -e
|
||
|
||
echo "📋 測試項目 1：進入目標目錄"
|
||
echo "----------------------------------------"
|
||
WORKDIR="/home/bioailab/miniconda3/lid/app/docker_build"
|
||
mkdir -p "${WORKDIR}"
|
||
cd "${WORKDIR}"
|
||
echo "✅ 目前目錄: $(pwd)"
|
||
|
||
echo ""
|
||
echo "📋 測試項目 2：Git 版本"
|
||
echo "----------------------------------------"
|
||
git --version
|
||
echo "✅ Git 可用"
|
||
|
||
echo ""
|
||
echo "📋 測試項目 3：Docker 版本"
|
||
echo "----------------------------------------"
|
||
docker version --format '{{.Server.Version}}' || docker --version
|
||
echo "✅ Docker 可用"
|
||
|
||
echo ""
|
||
echo "📋 測試項目 4：Docker Buildx 版本"
|
||
echo "----------------------------------------"
|
||
docker buildx version
|
||
echo "✅ Docker Buildx 可用"
|
||
|
||
echo ""
|
||
echo "========================================"
|
||
echo "✅ 所有 Smoke Test 通過！"
|
||
echo "========================================"
|
||
REMOTE_EOF
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 6: 準備遠端工作目錄
|
||
# 說明：確保遠端工作目錄存在
|
||
# ========================================
|
||
- name: 📁 準備遠端工作目錄
|
||
run: |
|
||
echo "========================================"
|
||
echo "📁 準備遠端工作目錄"
|
||
echo "========================================"
|
||
echo "工作目錄: ${{ env.REMOTE_WORKDIR }}"
|
||
echo ""
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} \
|
||
"mkdir -p ${{ env.REMOTE_WORKDIR }} && echo '✅ 工作目錄已就緒'"
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 7: Clone 或更新專案程式碼
|
||
# 說明：在遠端主機上 clone 或 pull 最新程式碼
|
||
# ========================================
|
||
- name: 📥 Clone 或更新專案程式碼
|
||
run: |
|
||
echo "========================================"
|
||
echo "📥 Clone 或更新專案程式碼"
|
||
echo "========================================"
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'REMOTE_EOF'
|
||
set -e
|
||
|
||
WORKDIR="${{ env.REMOTE_WORKDIR }}"
|
||
PROJECT="${{ env.PROJECT_NAME }}"
|
||
REPO_URL="https://github.com/pi-docket/ConvertX-CN.git"
|
||
|
||
echo "📂 進入工作目錄: ${WORKDIR}"
|
||
cd "${WORKDIR}"
|
||
|
||
if [ -d "${PROJECT}" ]; then
|
||
echo "📦 專案已存在，執行 git pull..."
|
||
cd "${PROJECT}"
|
||
git fetch origin
|
||
git reset --hard origin/main
|
||
git pull origin main
|
||
echo "✅ 程式碼更新完成"
|
||
else
|
||
echo "📦 專案不存在，執行 git clone..."
|
||
git clone "${REPO_URL}" "${PROJECT}"
|
||
cd "${PROJECT}"
|
||
echo "✅ 專案 clone 完成"
|
||
fi
|
||
|
||
echo ""
|
||
echo "📋 目前 commit："
|
||
git log -1 --oneline
|
||
|
||
echo ""
|
||
echo "✅ 程式碼準備完成"
|
||
REMOTE_EOF
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 8: Docker Login
|
||
# 說明：在遠端主機登入 Docker Hub
|
||
# ========================================
|
||
- name: 🔐 Docker Hub 登入
|
||
run: |
|
||
echo "========================================"
|
||
echo "🔐 Docker Hub 登入"
|
||
echo "========================================"
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} \
|
||
"echo '${{ secrets.DOCKERHUB_TOKEN }}' | docker login -u '${{ secrets.DOCKERHUB_USERNAME }}' --password-stdin && echo '✅ Docker Hub 登入成功'"
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 9: 設定 Docker Buildx（Multi-Arch 必要）
|
||
# 說明：建立支援多架構的 buildx builder
|
||
# ========================================
|
||
- name: 🔧 設定 Docker Buildx
|
||
run: |
|
||
echo "========================================"
|
||
echo "🔧 設定 Docker Buildx（Multi-Arch 支援）"
|
||
echo "========================================"
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'REMOTE_EOF'
|
||
set -e
|
||
|
||
BUILDER_NAME="multiarch-builder-${{ github.run_id }}"
|
||
|
||
echo "📋 檢查現有 buildx builders..."
|
||
docker buildx ls
|
||
|
||
echo ""
|
||
echo "🔧 建立新的 multi-arch builder: ${BUILDER_NAME}"
|
||
docker buildx create --name "${BUILDER_NAME}" --driver docker-container --use --bootstrap
|
||
|
||
echo ""
|
||
echo "✅ Buildx builder 已就緒"
|
||
echo ""
|
||
echo "📋 目前 builder 狀態："
|
||
docker buildx inspect --bootstrap
|
||
|
||
echo ""
|
||
echo "🏗️ 支援的平台："
|
||
docker buildx inspect | grep -i platforms || true
|
||
REMOTE_EOF
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 10: Multi-Arch Docker Build & Push
|
||
# 說明：使用 buildx 同時建構 amd64 和 arm64 並推送
|
||
# ========================================
|
||
- name: 🔨 Multi-Arch Docker Build & Push
|
||
run: |
|
||
echo "========================================"
|
||
echo "🔨 開始 Multi-Arch Docker Build & Push"
|
||
echo "========================================"
|
||
echo "映像名稱: ${{ env.DOCKER_IMAGE_REPO }}:${{ github.event.inputs.image_tag }}"
|
||
echo "目標架構: linux/amd64, linux/arm64"
|
||
echo ""
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'REMOTE_EOF'
|
||
set -e
|
||
|
||
WORKDIR="${{ env.REMOTE_WORKDIR }}"
|
||
PROJECT="${{ env.PROJECT_NAME }}"
|
||
IMAGE="${{ env.DOCKER_IMAGE_REPO }}:${{ github.event.inputs.image_tag }}"
|
||
BUILDER_NAME="multiarch-builder-${{ github.run_id }}"
|
||
|
||
echo "📂 進入專案目錄..."
|
||
cd "${WORKDIR}/${PROJECT}"
|
||
pwd
|
||
|
||
echo ""
|
||
echo "🔨 執行 Multi-Arch Docker buildx..."
|
||
echo "映像標籤: ${IMAGE}"
|
||
echo "目標平台: linux/amd64, linux/arm64"
|
||
echo ""
|
||
|
||
# 確保使用正確的 builder
|
||
docker buildx use "${BUILDER_NAME}"
|
||
|
||
# Multi-arch build + push
|
||
docker buildx build \
|
||
--platform linux/amd64,linux/arm64 \
|
||
-t "${IMAGE}" \
|
||
--push \
|
||
--progress=plain \
|
||
.
|
||
|
||
echo ""
|
||
echo "✅ Multi-Arch Docker build & push 完成！"
|
||
echo ""
|
||
echo "📦 映像已推送至 Docker Hub："
|
||
echo " ${IMAGE}"
|
||
echo ""
|
||
echo "🏗️ 支援的架構："
|
||
echo " - linux/amd64"
|
||
echo " - linux/arm64"
|
||
REMOTE_EOF
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 11: 驗證 Docker Hub 映像
|
||
# 說明：確認映像已成功推送並檢查架構
|
||
# ========================================
|
||
- name: ✅ 驗證 Docker Hub 映像
|
||
run: |
|
||
echo "========================================"
|
||
echo "✅ 驗證 Docker Hub 映像"
|
||
echo "========================================"
|
||
echo "映像: ${{ env.DOCKER_IMAGE_REPO }}:${{ github.event.inputs.image_tag }}"
|
||
echo ""
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'REMOTE_EOF'
|
||
set -e
|
||
|
||
IMAGE="${{ env.DOCKER_IMAGE_REPO }}:${{ github.event.inputs.image_tag }}"
|
||
|
||
echo "📋 檢查映像 manifest（顯示支援的架構）..."
|
||
echo ""
|
||
|
||
docker buildx imagetools inspect "${IMAGE}"
|
||
|
||
echo ""
|
||
echo "✅ 映像驗證完成"
|
||
REMOTE_EOF
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 12: 清理本次 Build 資源
|
||
# 說明：只清理本次 build 產生的 builder 和 cache
|
||
# ========================================
|
||
- name: 🧹 清理本次 Build 資源
|
||
if: always()
|
||
run: |
|
||
echo "========================================"
|
||
echo "🧹 清理本次 Build 資源"
|
||
echo "========================================"
|
||
echo "Builder 名稱: multiarch-builder-${{ github.run_id }}"
|
||
echo ""
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} << 'REMOTE_EOF'
|
||
set -e
|
||
|
||
BUILDER_NAME="multiarch-builder-${{ github.run_id }}"
|
||
|
||
echo "🗑️ 移除本次使用的 buildx builder..."
|
||
if docker buildx rm "${BUILDER_NAME}" 2>/dev/null; then
|
||
echo "✅ Builder ${BUILDER_NAME} 已移除"
|
||
else
|
||
echo "⚠️ Builder 可能已被移除或不存在"
|
||
fi
|
||
|
||
echo ""
|
||
echo "🗑️ 清理本次 build 產生的 cache..."
|
||
# 只清理 buildx 的 dangling cache，不影響其他 image
|
||
docker buildx prune -f --filter "until=1h" 2>/dev/null || true
|
||
echo "✅ Build cache 已清理"
|
||
|
||
echo ""
|
||
echo "📋 目前剩餘的 builders："
|
||
docker buildx ls
|
||
|
||
echo ""
|
||
echo "📦 目前剩餘的 convertx 相關映像："
|
||
docker images | grep convertx || echo "（無本地 convertx 相關映像，因使用 --push 直接推送）"
|
||
REMOTE_EOF
|
||
|
||
echo ""
|
||
echo "✅ 清理完成（僅清理本次 build 的資源）"
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 13: Docker Logout
|
||
# 說明：登出 Docker Hub
|
||
# ========================================
|
||
- name: 🔒 Docker Hub 登出
|
||
if: always()
|
||
run: |
|
||
echo "========================================"
|
||
echo "🔒 Docker Hub 登出"
|
||
echo "========================================"
|
||
|
||
tailscale ssh ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }} \
|
||
"docker logout && echo '✅ 已登出 Docker Hub'" || true
|
||
|
||
echo "========================================"
|
||
|
||
# ========================================
|
||
# Step 14: 顯示完成摘要
|
||
# 說明：顯示本次 build 的摘要資訊
|
||
# ========================================
|
||
- name: 📋 Build 完成摘要
|
||
run: |
|
||
echo "========================================"
|
||
echo "✅ Multi-Arch Docker Build & Push 完成！"
|
||
echo "========================================"
|
||
echo ""
|
||
echo "📦 映像資訊："
|
||
echo " - 映像名稱: ${{ env.DOCKER_IMAGE_REPO }}:${{ github.event.inputs.image_tag }}"
|
||
echo " - Docker Hub: https://hub.docker.com/r/${{ env.DOCKER_IMAGE_REPO }}/tags"
|
||
echo ""
|
||
echo "🏗️ 支援的架構："
|
||
echo " - linux/amd64"
|
||
echo " - linux/arm64"
|
||
echo ""
|
||
echo "🔧 Build 設定："
|
||
echo " - 遠端主機: ${{ secrets.SSH_HOST }}"
|
||
echo " - 工作目錄: ${{ env.REMOTE_WORKDIR }}"
|
||
echo " - 專案名稱: ${{ env.PROJECT_NAME }}"
|
||
echo ""
|
||
echo "📝 使用方式："
|
||
echo " docker pull ${{ env.DOCKER_IMAGE_REPO }}:${{ github.event.inputs.image_tag }}"
|
||
echo ""
|
||
echo "========================================"
|
||
echo "🎉 所有步驟已成功完成！"
|
||
echo "========================================"
|