fix: fail Gitea deploy when Docker image push does not succeed

Windows PowerShell ignored docker exit codes, so build-and-push looked green while :sha tags were never pushed and deploy pulled missing images.
2026-09-05 19:03:06 +03:30
parent 5cd3436d0c
commit 663eafa3e8
3 changed files with 66 additions and 37 deletions
--- a/.gitea/workflows/prod-tag-deploy.yml
+++ b/.gitea/workflows/prod-tag-deploy.yml
@@ -44,8 +44,6 @@ defaults:
 jobs:
  build-and-push:
    runs-on: windows
-    outputs:
-      image_tag: ${{ steps.meta.outputs.image_tag }}
    steps:
      - name: Checkout (this Gitea)
        run: |
@@ -75,6 +73,7 @@ jobs:
          }
          $env:GIT_TERMINAL_PROMPT = '0'
          git clone --depth 1 --branch $Branch $cloneUrl .
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Resolve image tag (v*.*.* only)
        id: meta
@@ -90,10 +89,7 @@ jobs:
            Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)"
            exit 1
          }
-          $utf8 = New-Object System.Text.UTF8Encoding $false
-          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8)
          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
-          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
          Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix"

      - name: Log in to container registry
@@ -103,13 +99,19 @@ jobs:
          ${{ secrets.REGISTRY_PASSWORD }}
          '@
          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Build and push backend (tag only, not :latest)
        run: |
          $ErrorActionPreference = 'Stop'
-          $tag = "${{ steps.meta.outputs.image_tag }}"
-          docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend
-          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          Write-Host "Building $prefix/dyolink-backend:$tag"
+          docker build -t "$prefix/dyolink-backend:$tag" ./backend
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          docker push "$prefix/dyolink-backend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Build and push frontend (nudentic.ir baked in)
        env:
@@ -117,19 +119,24 @@ jobs:
          NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
        run: |
          $ErrorActionPreference = 'Stop'
-          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
          $base = $env:PROD_PUBLIC_BASE_URL.Trim()
          if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
          $base = $base.TrimEnd('/')
+          Write-Host "Building $prefix/dyolink-frontend:$tag"
          docker build `
            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
            --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
            --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=production" `
-            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
+            -t "$prefix/dyolink-frontend:$tag" `
            ./frontend
-          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          docker push "$prefix/dyolink-frontend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

  deploy:
    needs: build-and-push
@@ -163,6 +170,7 @@ jobs:
          }
          $env:GIT_TERMINAL_PROMPT = '0'
          git clone --depth 1 --branch $Branch $cloneUrl .
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Write SSH key
        run: |
@@ -193,19 +201,25 @@ jobs:
          if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
          $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
          ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts $infra/nginx"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          scp.exe @ssh -P $port `
            infrastructure/docker-compose.prod.yml `
            "${user}@${hostName}:${infra}/docker-compose.prod.yml"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          scp.exe @ssh -P $port `
            infrastructure/scripts/prod-remote-deploy.sh `
            "${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          scp.exe @ssh -P $port `
            infrastructure/scripts/render-nginx-ssl.sh `
            "${user}@${hostName}:${infra}/scripts/render-nginx-ssl.sh"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          scp.exe @ssh -P $port `
            infrastructure/nginx/nginx.ssl.conf.template `
            "${user}@${hostName}:${infra}/nginx/nginx.ssl.conf.template"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh $infra/scripts/render-nginx-ssl.sh"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Login on Linux and deploy tag
        run: |
@@ -218,7 +232,8 @@ jobs:
          if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
          $regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim()
          if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' }
-          $tag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
          $pass = @'
          ${{ secrets.REGISTRY_PASSWORD }}
          '@
@@ -226,3 +241,4 @@ jobs:
          $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
          $remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag"
          $pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
--- a/.gitea/workflows/registry-build-deploy.yml
+++ b/.gitea/workflows/registry-build-deploy.yml
@@ -33,6 +33,7 @@
 # Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"]
 #
 # Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).
+# Windows PowerShell 5.1 does not fail a step when docker/git return non-zero — always check $LASTEXITCODE.

 name: Registry — build, push, deploy

@@ -48,8 +49,6 @@ defaults:
 jobs:
  build-and-push:
    runs-on: windows
-    outputs:
-      image_tag: ${{ steps.meta.outputs.image_tag }}
    steps:
      - name: Checkout (clone from this Gitea — no gitea.com)
        run: |
@@ -74,16 +73,7 @@ jobs:
          }
          $env:GIT_TERMINAL_PROMPT = '0'
          git clone --depth 1 --branch $Branch $cloneUrl .
-
-      - name: Image tag and registry prefix
-        id: meta
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $short = (git rev-parse --short HEAD).Trim()
-          $utf8 = New-Object System.Text.UTF8Encoding $false
-          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
-          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
-          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Log in to container registry
        run: |
@@ -92,17 +82,27 @@ jobs:
          ${{ secrets.REGISTRY_PASSWORD }}
          '@
          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Build and push backend
        run: |
          $ErrorActionPreference = 'Stop'
-          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $tag = "${{ github.sha }}".Substring(0, 7)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          if ([string]::IsNullOrWhiteSpace($tag) -or [string]::IsNullOrWhiteSpace($prefix)) {
+            Write-Host "Missing github.sha, REGISTRY_HOST, or REGISTRY_OWNER"
+            exit 1
+          }
+          Write-Host "Building $prefix/dyolink-backend:$tag"
          docker build `
-            -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
-            -t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
+            -t "$prefix/dyolink-backend:$tag" `
+            -t "$prefix/dyolink-backend:latest" `
            ./backend
-          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
-          docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          docker push "$prefix/dyolink-backend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          docker push "$prefix/dyolink-backend:latest"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Build and push frontend
        env:
@@ -110,19 +110,24 @@ jobs:
          NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
        run: |
          $ErrorActionPreference = 'Stop'
-          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $tag = "${{ github.sha }}".Substring(0, 7)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
          $base = $env:PUBLIC_BASE_URL
+          Write-Host "Building $prefix/dyolink-frontend:$tag"
          docker build `
            --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
            --build-arg "NEXT_PUBLIC_APP_URL=$base" `
            --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
            --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
            --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=staging" `
-            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
-            -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
+            -t "$prefix/dyolink-frontend:$tag" `
+            -t "$prefix/dyolink-frontend:latest" `
            ./frontend
-          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
-          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          docker push "$prefix/dyolink-frontend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          docker push "$prefix/dyolink-frontend:latest"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

  deploy:
    needs: build-and-push
@@ -151,6 +156,7 @@ jobs:
          }
          $env:GIT_TERMINAL_PROMPT = '0'
          git clone --depth 1 --branch $Branch $cloneUrl .
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Write deploy.registry.env and validate secrets path
        run: |
@@ -173,16 +179,19 @@ jobs:
          if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' }
          $localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim()
          if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' }
-          $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $imageTag = "${{ github.sha }}".Substring(0, 7)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          Write-Host "IMAGE_TAG=$imageTag REGISTRY_PREFIX=$prefix"
          $lines = @(
-            "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
+            "REGISTRY_PREFIX=$prefix",
            "IMAGE_TAG=$imageTag",
            "STAGING_HTTP_PORT=$stagingPort",
            "STAGING_LOCAL_PORT=$localPort",
            "DEPLOY_SECRETS_DIR=$SD"
          )
          Set-Location infrastructure
-          $lines | Set-Content -Path deploy.registry.env -Encoding utf8
+          $utf8 = New-Object System.Text.UTF8Encoding $false
+          [System.IO.File]::WriteAllText((Join-Path (Get-Location) 'deploy.registry.env'), ($lines -join "`n") + "`n", $utf8)

      - name: Log in to container registry (for pull)
        run: |
@@ -191,10 +200,13 @@ jobs:
          ${{ secrets.REGISTRY_PASSWORD }}
          '@
          $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

      - name: Pull and start stack
        run: |
          $ErrorActionPreference = 'Stop'
          Set-Location infrastructure
          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }