fix(ci): deploy admin frontend on target node

Jenkinsfile

@@ -1,11 +1,10 @@
 pipeline {
-  agent any
+  agent {
+    label "${env.JOB_BASE_NAME?.endsWith('-dev') ? 'java-dev' : 'java-test'}"
+  }
 
   environment {
-    DEVELOPMENT_SSH_TARGET = 'deploy@172.31.198.8'
+    DEVELOPMENT_COMPOSE_FILE = 'docker-compose.development.yml'
-    DEVELOPMENT_SSH_KEY = '/var/jenkins_home/.ssh/dev_deploy'
-    DEVELOPMENT_SSH_KNOWN_HOSTS = '/var/jenkins_home/.ssh/known_hosts'
-    DEVELOPMENT_DEPLOY_DIR = '/opt/firstleg/frontend/admin-web'
   }
 
   options {
@@ -41,27 +40,14 @@ pipeline {
         sh '''
           set -eu
           image="admin-web-development:${SOURCE_TAG}"
-          ssh_args="-i ${DEVELOPMENT_SSH_KEY} -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=${DEVELOPMENT_SSH_KNOWN_HOSTS} -o ConnectTimeout=10"
 
           docker build \
             --build-arg VITE_CLIENT_WEB_URL=http://8.163.49.32:9002 \
             -t "$image" .
-          docker save "$image" | gzip -1 | ssh $ssh_args "$DEVELOPMENT_SSH_TARGET" 'gzip -dc | docker load'
+          export IMAGE_TAG="$SOURCE_TAG"
-
+          docker compose -f "$DEVELOPMENT_COMPOSE_FILE" up -d --remove-orphans --pull never
-          ssh $ssh_args "$DEVELOPMENT_SSH_TARGET" "install -d -m 750 '$DEVELOPMENT_DEPLOY_DIR'"
+          docker compose -f "$DEVELOPMENT_COMPOSE_FILE" ps
-          scp $ssh_args docker-compose.development.yml \
+          docker compose -f "$DEVELOPMENT_COMPOSE_FILE" exec -T admin-web wget -qO- http://127.0.0.1/healthz
-            "$DEVELOPMENT_SSH_TARGET:$DEVELOPMENT_DEPLOY_DIR/docker-compose.yml.tmp"
-          ssh $ssh_args "$DEVELOPMENT_SSH_TARGET" \
-            "mv -f '$DEVELOPMENT_DEPLOY_DIR/docker-compose.yml.tmp' '$DEVELOPMENT_DEPLOY_DIR/docker-compose.yml'"
-
-          ssh $ssh_args "$DEVELOPMENT_SSH_TARGET" sh -s -- "$DEVELOPMENT_DEPLOY_DIR" "$SOURCE_TAG" <<'REMOTE'
-          set -eu
-          cd "$1"
-          export IMAGE_TAG="$2"
-          docker compose -f docker-compose.yml up -d --remove-orphans --pull never
-          docker compose -f docker-compose.yml ps
-          docker compose -f docker-compose.yml exec -T admin-web wget -qO- http://127.0.0.1/healthz
-REMOTE
         '''
       }
     }
@@ -82,9 +68,7 @@ REMOTE
     failure {
       sh '''
         if [ "${IS_DEVELOPMENT:-false}" = "true" ]; then
-          ssh -i "$DEVELOPMENT_SSH_KEY" -o BatchMode=yes -o StrictHostKeyChecking=yes \
+          docker logs --tail=100 admin-web-development || true
-            -o UserKnownHostsFile="$DEVELOPMENT_SSH_KNOWN_HOSTS" \
-            "$DEVELOPMENT_SSH_TARGET" 'docker logs --tail=100 admin-web-development || true' || true
         else
           docker compose -f docker-compose.test.yml logs --tail=100 || true
         fi

src/deployment/nginxConfig.test.ts

@@ -5,6 +5,7 @@ import { describe, expect, it } from 'vitest'
 const config = readFileSync(resolve(process.cwd(), 'nginx/default.conf.template'), 'utf8')
 const testCompose = readFileSync(resolve(process.cwd(), 'docker-compose.test.yml'), 'utf8')
 const developmentCompose = readFileSync(resolve(process.cwd(), 'docker-compose.development.yml'), 'utf8')
+const jenkinsfile = readFileSync(resolve(process.cwd(), 'Jenkinsfile'), 'utf8')
 
 describe('admin nginx deployment config', () => {
   it('allows qualification uploads with multipart overhead through the API proxy', () => {
@@ -37,4 +38,12 @@ describe('admin nginx deployment config', () => {
     expect(testCompose).toContain('OVERSEAS_API_UPSTREAM: "http://host.docker.internal:9300"')
     expect(developmentCompose).toContain('OVERSEAS_API_UPSTREAM: "http://host.docker.internal:9300"')
   })
+
+  it('runs each deployment on its target node without controller-local SSH files', () => {
+    expect(jenkinsfile).toContain("env.JOB_BASE_NAME?.endsWith('-dev') ? 'java-dev' : 'java-test'")
+    expect(jenkinsfile).toContain('docker compose -f "$DEVELOPMENT_COMPOSE_FILE" up -d')
+    expect(jenkinsfile).not.toContain('/var/jenkins_home/.ssh')
+    expect(jenkinsfile).not.toContain('docker save')
+    expect(jenkinsfile).not.toMatch(/\bssh\b/)
+  })
 })