|
|
|
@@ -1,6 +1,6 @@
|
|
|
|
|
---
|
|
|
|
|
name: gitea-ci
|
|
|
|
|
description: End-to-end Gitea CI/CD setup with self-hosted act_runner, quality gate pipeline, buildah image build, k3s deploy, and GitHub mirror. Covers act_runner-specific gotchas that are not documented anywhere.
|
|
|
|
|
description: End-to-end Gitea CI/CD setup with self-hosted act_runner, quality gate pipeline, shared buildctl image-build script, k3s deploy, and GitHub mirror. Covers act_runner-specific gotchas that are not documented anywhere.
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Gitea CI/CD Pipeline Setup
|
|
|
|
@@ -31,7 +31,7 @@ Before writing any YAML, collect the following. Use AskUserQuestion for anything
|
|
|
|
|
| Container registry | Ask or check existing config | `localhost:5000` on koala, or external |
|
|
|
|
|
| k3s namespace | k8s/ manifests or ask | Deploy target |
|
|
|
|
|
| GitHub mirror repo | Ask | Target for the mirror job |
|
|
|
|
|
| Image name | Ask or derive from repo name | Used in buildah + k3s steps |
|
|
|
|
|
| Image name | Ask or derive from repo name | Used in buildctl + k3s steps |
|
|
|
|
|
|
|
|
|
|
Check the project's `CLAUDE.md` for infra notes first — often this answers most questions without needing to ask.
|
|
|
|
|
|
|
|
|
@@ -133,35 +133,46 @@ jobs:
|
|
|
|
|
echo "version-tag=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
# infra#309: do NOT paste a build implementation here. The estate has
|
|
|
|
|
# exactly one, mathias/infra's ci-templates/build-image.sh, and each
|
|
|
|
|
# repo carries a byte-identical copy at .gitea/build-image.sh that a
|
|
|
|
|
# drift gate keeps current.
|
|
|
|
|
#
|
|
|
|
|
# Copying the implementation is what made the buildah->buildctl
|
|
|
|
|
# migration (infra#241) an eleven-repo sprint, and what left this very
|
|
|
|
|
# skill handing out the broken version for weeks after the app repos
|
|
|
|
|
# were fixed. Per-repo differences are INPUTS, not edits to the copy.
|
|
|
|
|
#
|
|
|
|
|
# To adopt in a new repo:
|
|
|
|
|
# 1. add the repo to mathias/infra ci-templates/adopters.txt
|
|
|
|
|
# 2. run `task ci:sync` in mathias/infra -- it writes the copy
|
|
|
|
|
# 3. commit .gitea/build-image.sh in your repo
|
|
|
|
|
# 4. call it as below
|
|
|
|
|
#
|
|
|
|
|
# Skipping step 1 leaves the copy unmanaged: it works today and falls
|
|
|
|
|
# silently behind the next time the canonical file changes.
|
|
|
|
|
#
|
|
|
|
|
# Inputs: IMAGE (required, usually the workflow-level env), SHA_TAG,
|
|
|
|
|
# VERSION_TAG, GIT_SHA, IMAGE_SOURCE, BUILD_ARGS, EXTRA_LABELS,
|
|
|
|
|
# CONTEXT, DOCKERFILE_DIR, DOCKERFILE_NAME, PUSH_LATEST. Read the
|
|
|
|
|
# canonical file's header for the full list.
|
|
|
|
|
#
|
|
|
|
|
# `bash <script>`, not a direct exec: a file written through the Gitea
|
|
|
|
|
# API lands 0644, and CI that depends on a file mode is a trap.
|
|
|
|
|
- name: Build and push to local registry
|
|
|
|
|
run: |
|
|
|
|
|
REGISTRY="localhost:5000"
|
|
|
|
|
REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
|
|
|
|
|
buildah build \
|
|
|
|
|
--label "org.opencontainers.image.revision=${{ github.sha }}" \
|
|
|
|
|
--label "org.opencontainers.image.source=${{ github.repositoryUrl }}" \
|
|
|
|
|
-t ${REF} \
|
|
|
|
|
-t ${REGISTRY}/${{ env.IMAGE }}:latest \
|
|
|
|
|
.
|
|
|
|
|
buildah push --tls-verify=false ${REF}
|
|
|
|
|
buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
|
|
|
|
|
[[ -n "${{ steps.meta.outputs.version-tag }}" ]] && \
|
|
|
|
|
buildah push --tls-verify=false \
|
|
|
|
|
${REF} \
|
|
|
|
|
${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }} || true
|
|
|
|
|
echo "✓ Image pushed to ${REF}"
|
|
|
|
|
env:
|
|
|
|
|
SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
|
|
|
|
|
VERSION_TAG: ${{ steps.meta.outputs.version-tag }}
|
|
|
|
|
GIT_SHA: ${{ github.sha }}
|
|
|
|
|
IMAGE_SOURCE: ${{ github.repositoryUrl }}
|
|
|
|
|
run: bash .gitea/build-image.sh
|
|
|
|
|
|
|
|
|
|
- name: Smoke test
|
|
|
|
|
run: |
|
|
|
|
|
REGISTRY="localhost:5000"
|
|
|
|
|
REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
|
|
|
|
|
CNAME="smoke-${{ steps.meta.outputs.sha-tag }}"
|
|
|
|
|
sudo k3s ctr images pull --plain-http ${REF}
|
|
|
|
|
OUTPUT=$(timeout 5 sudo k3s ctr run --rm ${REF} ${CNAME} /<binary-name> 2>&1 || true)
|
|
|
|
|
sudo k3s ctr containers delete ${CNAME} 2>/dev/null || true
|
|
|
|
|
echo "$OUTPUT" | grep -q "<project-name>" \
|
|
|
|
|
&& echo "✓ Smoke test passed" \
|
|
|
|
|
|| echo "⚠ Smoke test inconclusive: $OUTPUT"
|
|
|
|
|
# No smoke test step. The one this skill used to recommend ran
|
|
|
|
|
# `sudo k3s ctr run` against the host's containerd -- that worked when
|
|
|
|
|
# the runner was the Arch host, and is impossible now that it is a pod:
|
|
|
|
|
# no sudo, no ctr, no containerd socket (`sudo: command not found`).
|
|
|
|
|
# The deploy job's `Verify rollout` + `Confirm pod running new image`
|
|
|
|
|
# below assert the same property against the real workload.
|
|
|
|
|
|
|
|
|
|
# ── 3. Deploy to k3s ────────────────────────────────────────────────────────
|
|
|
|
|
deploy:
|
|
|
|
|
mathias
mathiasandClaude Opus 5