generated from mathias/template-go-web
Initial commit
This commit is contained in:
@@ -0,0 +1,121 @@
|
||||
#!/usr/bin/env bash
|
||||
# Build an OCI image with buildctl and push it to the local registry.
|
||||
#
|
||||
# CANONICAL COPY: mathias/infra ci-templates/build-image.sh (infra#309).
|
||||
# Every repo carries a byte-identical copy at .gitea/build-image.sh, written by
|
||||
# `task ci:sync` and held in place by the drift gate. DO NOT EDIT THE COPIES --
|
||||
# edit here, re-sync, and the gate will tell you which repos still disagree.
|
||||
#
|
||||
# Why this exists: this step was hand-copied into a dozen repos, so migrating it
|
||||
# off rootless buildah (infra#241) meant eleven near-identical commits, eleven
|
||||
# verifications, and three separate rediscoveries of the same fix in the two
|
||||
# repo templates and the gitea-ci skill. The differences between the copies were
|
||||
# incidental -- a label here, a build-arg there -- never intentional. Those are
|
||||
# inputs now, not forks of the implementation.
|
||||
#
|
||||
# Why buildctl and not buildah: the gitea-runner pod runs with
|
||||
# `capabilities: drop [ALL]` and `allowPrivilegeEscalation: false`, which
|
||||
# unconditionally blocks the setuid-root exec that rootless buildah's uid/gid
|
||||
# remapping needs, and the pod has no OCI runtime at all. buildctl is a thin
|
||||
# client -- it hands the build to the host's buildkitd over a socket, so the
|
||||
# privileged layer work happens on the host and this pod's securityContext is
|
||||
# not in the picture. buildah is absent from the runner image as of baked-v14
|
||||
# and its absence is asserted at pod start (infra#308).
|
||||
#
|
||||
# Inputs, all via environment:
|
||||
#
|
||||
# IMAGE (required) image name, e.g. cobalt-dingo
|
||||
# REGISTRY default localhost:5000
|
||||
# SHA_TAG default `git rev-parse --short HEAD`
|
||||
# VERSION_TAG optional extra tag, e.g. v1.2.3 on a tag build
|
||||
# PUSH_LATEST default 1; set 0 to skip the :latest tag
|
||||
# CONTEXT default . -- build context directory
|
||||
# DOCKERFILE_DIR default $CONTEXT -- directory holding the Dockerfile
|
||||
# DOCKERFILE_NAME optional, when the file is not named `Dockerfile`
|
||||
# TARGET optional, multi-stage build target (--opt target=)
|
||||
# BUILD_ARGS optional, space-separated K=V pairs
|
||||
# BUILD_SECRETS optional, space-separated buildkit secret specs, each
|
||||
# `id=NAME,src=PATH`. Pass the SPEC only -- the caller
|
||||
# writes the secret to PATH itself. A secret VALUE must
|
||||
# never be passed here: it would land in this script's
|
||||
# argv and therefore in the CI log.
|
||||
# EXTRA_LABELS optional, space-separated K=V pairs
|
||||
# GIT_SHA optional, stamped as org.opencontainers.image.revision
|
||||
# IMAGE_SOURCE optional, stamped as org.opencontainers.image.source
|
||||
#
|
||||
# Note on shell style below: every conditional is a full `if` block, never
|
||||
# `[ -n "$X" ] && cmd`. Under `set -e` the && form exits the script whenever the
|
||||
# test is false, which is a real bug this estate has already shipped once.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
if [ -z "${IMAGE:-}" ]; then
|
||||
echo "build-image: IMAGE is required" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
REGISTRY="${REGISTRY:-localhost:5000}"
|
||||
BUILDKIT_HOST="${BUILDKIT_HOST:-unix:///run/buildkit/buildkitd.sock}"
|
||||
CONTEXT="${CONTEXT:-.}"
|
||||
DOCKERFILE_DIR="${DOCKERFILE_DIR:-$CONTEXT}"
|
||||
PUSH_LATEST="${PUSH_LATEST:-1}"
|
||||
VERSION_TAG="${VERSION_TAG:-}"
|
||||
|
||||
if [ -z "${SHA_TAG:-}" ]; then
|
||||
SHA_TAG="$(git rev-parse --short HEAD)"
|
||||
fi
|
||||
|
||||
REF="${REGISTRY}/${IMAGE}:${SHA_TAG}"
|
||||
|
||||
TAR_FILE="$(mktemp)"
|
||||
trap 'rm -f "$TAR_FILE"' EXIT
|
||||
|
||||
args=(
|
||||
--frontend dockerfile.v0
|
||||
--local "context=${CONTEXT}"
|
||||
--local "dockerfile=${DOCKERFILE_DIR}"
|
||||
)
|
||||
|
||||
if [ -n "${DOCKERFILE_NAME:-}" ]; then
|
||||
args+=(--opt "filename=${DOCKERFILE_NAME}")
|
||||
fi
|
||||
if [ -n "${TARGET:-}" ]; then
|
||||
args+=(--opt "target=${TARGET}")
|
||||
fi
|
||||
for spec in ${BUILD_SECRETS:-}; do
|
||||
# Opaque id=NAME,src=PATH -- buildkit reads the file, nothing is echoed.
|
||||
args+=(--secret "${spec}")
|
||||
done
|
||||
if [ -n "${GIT_SHA:-}" ]; then
|
||||
args+=(--opt "label:org.opencontainers.image.revision=${GIT_SHA}")
|
||||
fi
|
||||
if [ -n "${IMAGE_SOURCE:-}" ]; then
|
||||
args+=(--opt "label:org.opencontainers.image.source=${IMAGE_SOURCE}")
|
||||
fi
|
||||
for kv in ${BUILD_ARGS:-}; do
|
||||
args+=(--opt "build-arg:${kv}")
|
||||
done
|
||||
for kv in ${EXTRA_LABELS:-}; do
|
||||
args+=(--opt "label:${kv}")
|
||||
done
|
||||
|
||||
echo "build-image: building ${REF}"
|
||||
buildctl --addr "$BUILDKIT_HOST" build "${args[@]}" --output "type=oci,dest=${TAR_FILE}"
|
||||
|
||||
# buildctl has no registry-push equivalent to `buildah push`, so skopeo copies
|
||||
# the OCI archive up -- once per tag, from the same archive, so every tag points
|
||||
# at bit-identical content.
|
||||
push_tag() {
|
||||
echo "build-image: pushing ${1}"
|
||||
skopeo copy --dest-tls-verify=false "oci-archive:${TAR_FILE}" "docker://${1}"
|
||||
}
|
||||
|
||||
push_tag "$REF"
|
||||
if [ "$PUSH_LATEST" = "1" ]; then
|
||||
push_tag "${REGISTRY}/${IMAGE}:latest"
|
||||
fi
|
||||
if [ -n "$VERSION_TAG" ]; then
|
||||
push_tag "${REGISTRY}/${IMAGE}:${VERSION_TAG}"
|
||||
fi
|
||||
|
||||
echo "✓ build-image: ${REF} pushed"
|
||||
@@ -0,0 +1,171 @@
|
||||
name: CD
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
tags: ["v*"]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
env:
|
||||
IMAGE: __PROJECT_NAME__
|
||||
|
||||
jobs:
|
||||
guard:
|
||||
name: Detect unsubstituted template
|
||||
runs-on: self-hosted
|
||||
outputs:
|
||||
is_template: ${{ steps.detect.outputs.is_template }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- id: detect
|
||||
# The detection lives in scripts/is-template.sh so it can be TESTED.
|
||||
# It was inline here twice and wrong both times (#9, #10): the grep
|
||||
# named a placeholder literally, and the scaffolder substitutes every
|
||||
# file including this one, so in a generated repo the guard matched
|
||||
# forever and check/build/deploy all skipped while the run went green.
|
||||
#
|
||||
# An inline shell block in a workflow cannot be run by a test, which is
|
||||
# why the second fix repeated the first bug under a comment warning
|
||||
# about it. scripts/tests/is-template_test.sh now substitutes the guard
|
||||
# and asserts it still answers correctly.
|
||||
run: |
|
||||
echo "is_template=$(bash scripts/is-template.sh go.mod)" >> "$GITHUB_OUTPUT"
|
||||
|
||||
check:
|
||||
name: Lint / Test / Vet
|
||||
# Deliberately NOT gated on the guard (#12). build and deploy are, because
|
||||
# they genuinely cannot work here -- placeholder module path, no image name,
|
||||
# no namespace. But linting and testing the template is meaningful, and
|
||||
# gating it meant this repo had no working gate at all: #8 sat here with CI
|
||||
# green throughout, and was found by a child rather than by us.
|
||||
#
|
||||
# `task check` includes scripts/tests/generated-child_test.sh, which covers
|
||||
# the entrypoint that ./... cannot see -- ungating without that would run a
|
||||
# gate that still skips the package every child is built around.
|
||||
needs: guard
|
||||
runs-on: self-hosted
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/setup-go@v5
|
||||
with:
|
||||
go-version-file: go.mod
|
||||
cache: false
|
||||
|
||||
- name: Install toolchain
|
||||
run: |
|
||||
go version
|
||||
# Pin the GENERATOR to the same version as the templ LIBRARY in
|
||||
# go.mod. Installing @latest let them drift: the generator emitted
|
||||
# calls (templruntime.WriteString) that the pinned library did not
|
||||
# have, which is template-go-web#8. Nothing caught it because the
|
||||
# guard skipped `check` in this repo entirely (#12).
|
||||
templ_version="$(go list -m -f '{{.Version}}' github.com/a-h/templ)"
|
||||
echo "templ library is $templ_version — installing the matching generator"
|
||||
go install "github.com/a-h/templ/cmd/templ@$templ_version"
|
||||
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
|
||||
| sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
|
||||
|
||||
- name: Run checks
|
||||
run: task check
|
||||
|
||||
build:
|
||||
name: Build & Import
|
||||
needs: [guard, check]
|
||||
if: needs.guard.outputs.is_template != 'true' && github.event_name != 'pull_request'
|
||||
runs-on: self-hosted
|
||||
outputs:
|
||||
image-tag: ${{ steps.meta.outputs.sha-tag }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Derive image tags
|
||||
id: meta
|
||||
run: |
|
||||
SHA=$(git rev-parse --short HEAD)
|
||||
echo "sha-tag=${SHA}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# infra#309: the implementation lives in .gitea/build-image.sh, a
|
||||
# byte-identical copy of mathias/infra's ci-templates/build-image.sh.
|
||||
# Do not edit it here -- edit the canonical file, run `task ci:sync`,
|
||||
# and infra's drift gate will name any repo still carrying an old copy.
|
||||
#
|
||||
# This matters more in a template than anywhere else: every repo
|
||||
# generated from here inherits its CI, so a template that carries the
|
||||
# build LOGIC manufactures a new copy of every bug in it. That is
|
||||
# precisely how rootless buildah (infra#241) reached a dozen repos, and
|
||||
# why the fix then had to be rediscovered here weeks later. A template
|
||||
# that carries a CALL manufactures nothing.
|
||||
#
|
||||
# NEW REPOS: add yourself to mathias/infra's ci-templates/adopters.txt so
|
||||
# the gate keeps this copy current. Until you do, the copy is unmanaged
|
||||
# and will silently fall behind.
|
||||
#
|
||||
# `bash <script>` rather than executing it directly: files written via
|
||||
# the Gitea API land 0644, and CI that depends on a file mode is a trap.
|
||||
- name: Build and push to local registry
|
||||
env:
|
||||
SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
|
||||
GIT_SHA: ${{ github.sha }}
|
||||
run: bash .gitea/build-image.sh
|
||||
|
||||
deploy:
|
||||
name: Deploy via GitOps
|
||||
needs: [guard, build]
|
||||
if: needs.guard.outputs.is_template != 'true' && github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||||
runs-on: self-hosted
|
||||
steps:
|
||||
- name: Update image tag in infra repo
|
||||
env:
|
||||
IMAGE_TAG: ${{ needs.build.outputs.image-tag }}
|
||||
DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
# infra#311: fail on an empty tag BEFORE patching anything. The
|
||||
# grep verification further down CANNOT catch it -- with IMAGE_TAG
|
||||
# empty its pattern matches the very corruption it exists to reject.
|
||||
# The result is `image: <repo>:` in the manifest, which is invalid
|
||||
# YAML, so Flux fails the ENTIRE apps Kustomization and every app
|
||||
# stops reconciling, not just this one. That happened on 2026-08-25.
|
||||
[ -n "${IMAGE_TAG:-}" ] || { echo "IMAGE_TAG is empty - refusing to patch"; exit 1; }
|
||||
mkdir -p ~/.ssh
|
||||
echo "$DEPLOY_KEY" > ~/.ssh/id_infra
|
||||
chmod 600 ~/.ssh/id_infra
|
||||
ssh-keyscan -p 30022 10.0.1.20 >> ~/.ssh/known_hosts 2>/dev/null
|
||||
export GIT_SSH_COMMAND="ssh -i ~/.ssh/id_infra -o IdentitiesOnly=yes"
|
||||
rm -rf /tmp/infra
|
||||
git clone -b main ssh://git@10.0.1.20:30022/mathias/infra.git /tmp/infra
|
||||
cd /tmp/infra
|
||||
DEPLOYMENT="k3s/apps/__PROJECT_NAME__/deployment.yaml"
|
||||
sed -i "s|image: localhost:5000/__PROJECT_NAME__:.*|image: localhost:5000/__PROJECT_NAME__:${IMAGE_TAG}|" "$DEPLOYMENT"
|
||||
grep -q "localhost:5000/__PROJECT_NAME__:${IMAGE_TAG}" "$DEPLOYMENT" \
|
||||
|| { echo "✗ image tag patch failed"; exit 1; }
|
||||
if git diff --quiet "$DEPLOYMENT"; then
|
||||
echo "ℹ image tag unchanged — skipping push"
|
||||
else
|
||||
git -c user.name="__PROJECT_NAME__ CI" \
|
||||
-c user.email="ci@__PROJECT_NAME__.local" \
|
||||
commit -m "chore(deploy): __PROJECT_NAME__ → ${IMAGE_TAG}" "$DEPLOYMENT"
|
||||
git push origin main
|
||||
echo "✓ pushed to infra repo"
|
||||
fi
|
||||
shred -u ~/.ssh/id_infra
|
||||
|
||||
- name: Trigger Flux reconcile
|
||||
run: |
|
||||
kubectl -n flux-system annotate gitrepository flux-system \
|
||||
reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
|
||||
kubectl -n flux-system annotate kustomization apps \
|
||||
reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
|
||||
|
||||
- name: Verify rollout
|
||||
run: |
|
||||
kubectl rollout status deployment/__PROJECT_NAME__ \
|
||||
--namespace __PROJECT_NAME__ \
|
||||
--timeout=120s \
|
||||
|| {
|
||||
kubectl get pods -n __PROJECT_NAME__ -o wide
|
||||
kubectl get events -n __PROJECT_NAME__ --sort-by='.lastTimestamp' | tail -20
|
||||
exit 1
|
||||
}
|
||||
Reference in New Issue
Block a user