feat: build trusted review evaluation loop #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: agentcode-production-deploy | |
| cancel-in-progress: false | |
| jobs: | |
| verify: | |
| name: Verify | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11.11.0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| cache-dependency-path: pnpm-lock.yaml | |
| - name: Restore Next.js cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: .next/cache | |
| key: ${{ runner.os }}-next-${{ hashFiles('package.json', 'pnpm-lock.yaml') }}-${{ hashFiles('src/**/*', 'challenges/**/*', 'scripts/challenges/**/*', 'prisma/**/*', 'task-worker/**/*', 'tests/**/*', 'next.config.*', 'tsconfig.json', 'vitest.config.ts') }} | |
| restore-keys: | | |
| ${{ runner.os }}-next-${{ hashFiles('package.json', 'pnpm-lock.yaml') }}- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Validate Prisma schema | |
| env: | |
| DATABASE_URL: postgresql://agentcode:agentcode@127.0.0.1:5432/agentcode?schema=public | |
| run: | | |
| pnpm exec prisma validate | |
| pnpm exec prisma generate | |
| - name: Validate challenge assets | |
| run: pnpm challenge:validate | |
| - name: Run evaluator fixtures | |
| run: pnpm challenge:fixtures | |
| - name: Test | |
| run: pnpm test | |
| - name: Typecheck | |
| run: pnpm typecheck | |
| - name: Lint | |
| run: pnpm lint | |
| - name: Build | |
| run: pnpm build | |
| deploy: | |
| name: Deploy | |
| runs-on: ubuntu-latest | |
| needs: verify | |
| steps: | |
| - name: Configure SSH | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mkdir -p ~/.ssh | |
| chmod 700 ~/.ssh | |
| printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key | |
| printf '%s\n' "${{ secrets.DEPLOY_KNOWN_HOSTS }}" > ~/.ssh/known_hosts | |
| chmod 600 ~/.ssh/deploy_key ~/.ssh/known_hosts | |
| - name: Run deployment | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| ssh \ | |
| -i ~/.ssh/deploy_key \ | |
| -o IdentitiesOnly=yes \ | |
| -o StrictHostKeyChecking=yes \ | |
| "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \ | |
| "sudo /usr/bin/bash -c 'set -a; source /etc/agentcode.env; set +a; exec sudo --preserve-env=DATABASE_URL -u agentcode /usr/bin/bash /opt/agentcode/scripts/deploy.sh'" |