67 lines
2.4 KiB
YAML
67 lines
2.4 KiB
YAML
---
|
|
name: backup
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "32 00 * * 0"
|
|
|
|
jobs:
|
|
backup:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GH_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
RESTIC_PASSWORD: ${{ secrets.RESTIC_PASSWORD }}
|
|
RESTIC_REPOSITORY_URL: ${{ secrets.RESTIC_REPOSITORY }}
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
steps:
|
|
# - uses: actions/checkout@v4
|
|
- name: Install requirements
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get -y install restic
|
|
- name: Trigger backup export
|
|
run: |
|
|
ID=$(gh api --method POST /user/migrations \
|
|
--raw-field "repositories[]=$REPO" \
|
|
--field lock_repositories=false \
|
|
--field exclude_git_data=true --jq '.id')
|
|
# define some ENV vars needed below
|
|
echo "EXPORT_ID=$ID" >>$GITHUB_ENV
|
|
echo "REPO_NAME=${{ github.event.repository.name }}" >> $GITHUB_ENV
|
|
- name: Wait until backup is finished
|
|
run: |
|
|
while true; do
|
|
STATE=$(gh api --method GET "/user/migrations/$EXPORT_ID" --jq '.state')
|
|
[[ $STATE == "exported" ]] && break
|
|
sleep 10
|
|
done
|
|
- name: Download backup
|
|
run: |
|
|
ARCHIVE_URL=$(gh api --method GET "/user/migrations/$EXPORT_ID" --jq '.archive_url')
|
|
curl -L -H "Accept: application/vnd.github+json" \
|
|
-H "Authorization: Bearer $GH_TOKEN" \
|
|
-H "X-GitHub-Api-Version: 2022-11-28" \
|
|
-o "archive.tgz" "$ARCHIVE_URL"
|
|
- name: Sanity check
|
|
run: |
|
|
TITLE_LATEST_PR=$(gh api \
|
|
-H "Accept: application/vnd.github+json" \
|
|
-H "Authorization: Bearer $GH_TOKEN" \
|
|
-H "X-GitHub-Api-Version: 2022-11-28" repos/$REPO/pulls --jq '.[0].title')
|
|
zgrep -a -B3 "$TITLE_LATEST_PR" archive.tgz || {
|
|
echo "Latest PR title not found in archive.tgz"
|
|
exit 1
|
|
}
|
|
- name: Save backup (restic)
|
|
run: |
|
|
export RESTIC_REPOSITORY=$RESTIC_REPOSITORY_URL/$REPO_NAME
|
|
# init repository if necessary
|
|
if ! restic cat config >/dev/null 2>&1; then
|
|
restic init
|
|
fi
|
|
restic backup --host gh-runner --stdin --stdin-filename archive.tgz <./archive.tgz
|
|
restic forget --prune --keep-within 6m
|
|
restic check
|