CI: build and deploy the web frontend when it changes#3
Merged
Conversation
The static frontend was previously deployed by hand and had drifted from main. Now a build-web job (gated by a paths filter on web/**) builds with Bun, ships the tarball to the deploy user's home via scp, and finitum-deploy --web publishes it: fixed tarball path only, index.html sanity check, atomic swap, previous build kept as backup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
finitum.app's frontend was deployed by hand (nginx serving a static build) and had silently drifted from
main-- CI only ever shipped the API image. This automates it:dorny/paths-filterdetectsweb/**changes (the workflow file itself is included, so pipeline changes force one republish to stay in sync).VITE_API_URLfrom the newWEB_API_URLrepo variable (already set; it's public info -- baked into the shipped bundle), packed as an artifact.sudo finitum-deploy --webafter the backend deploy.always()+ explicit result checks keep backend deploys working when build-web is skipped, while still blocking on a failed web build.finitum-deployscript gained the--webmode (already installed on the VPS): reads the tarball only from its fixed path (no attacker-chosen paths across the sudo boundary), refuses archives withoutindex.html, stages beside the web root and swaps atomically, keeping the previous build atfinitum.bakfor one-mvrollback.docs/deployment.mdupdated.Verification
--webpath was exercised on the VPS with a real build: published successfully, and finitum.app now serves the forwarding/OSS frontend (zero "Gmail Integration" occurrences;/guide200;/api/bankshealthy).--webwith no tarball staged exits 2 with a clear error.🤖 Generated with Claude Code