- Custom Deployment
- Encrypted Secrets in Build Environment
- Limiting Deployments From Specific Branches
Travis CI - Test and Deploy with Confidence. DEPLOY. D E P L O Y.
Travis CI can be used as a publicly hosted deployment system with inbuilt support for deployments to various providers. There are well documented guides about doing the same. But once in a while, one might end up using some service that’s not supported by Travis CI or even a specific feature that’s not supported, although there’s support for the provider.
Travis CI provides ways of run scripts, from the code repo, which can be used
as deployment scripts. Script execution commands can be added to any of the
depending on the requirements. For a deployment script,
after_success is a
good place to run them.
# .travis.yml ... after_success: - ./scripts/deploy.sh ...
The exit code of
after_scriptand subsequent stages do not affect the build result. However, if one of these stages times out, the build is marked as a failure.
Encrypted Secrets in Build Environment
When doing custom deployments, the secrets must be stored in environment variables in encrypted form. Encrypted env vars look like this in .travis.yml file:
# .travis.yml env: global: - APP_NAME="foo" - secure: "N79ZQG6jUTP5o0YSc1dTtb02PV+1j6sjM/DlvtCEcdaiPiEH" - secure: "L08rVW1wuAz5P4j3yiAJkxG0Dog5cr8YSPzCCnguDrBy7Ok5"
Even the variable names are not shown. To create encrypted variables, use
cli. Refer their Encryption Key Guide.
Sometimes, there’s need to encrypt certain files. They have another guide for that, Encrypting Files Guide. Encrypting files generate a new file with encrypted content. The decryption key is saved in travis, under the specific repo.
The encrypted keys and files can only be decrypted when there’s a build by the owner of the repo. So, a build of a PR by a contributor, would fail at decryption stage because travis has no key associated with that user.
Also refer Travis CI: Best Practices in Securing Your Data.
Limiting Deployments From Specific Branches
Deployments require secrets. Deployments triggered by PR from contributors would fail due to no decryption key. Hence, it’s safe. Other’s can’t deploy. But in addition to that, the build script can be made a little smarter and exit when certain conditions are met.
Deployment is generally not intended when:
- it’s a PR
- not master branch or any specific production branch
For such scenarios, some conditions in the deployment script could be used.
if [ "$TRAVIS_BRANCH" != "$DEPLOY_BRANCH" ]; then echo "Travis should only deploy from the DEPLOY_BRANCH ($DEPLOY_BRANCH) branch" exit 0 else if [ "$TRAVIS_PULL_REQUEST" != "false" ]; then echo "Travis should not deploy from pull requests" exit 0 else # actually deploy ..... ..... fi fi
This would ensure that deployments are not triggered when a new branch is built and when a PR is sent. Preventing accidental deployments from branches by the repo owner.
This site has CI/CD setup on travis and deploys to github pages at every commit
source branch. Refer
files for working examples. They are inspired by work of
rcoedo and a sort of
by haruair. 🦉