generated from mathias/template-go-web
172 lines
7.3 KiB
YAML
172 lines
7.3 KiB
YAML
name: CD
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
tags: ["v*"]
|
||
pull_request:
|
||
branches: [main]
|
||
|
||
env:
|
||
IMAGE: spatial-agent-app
|
||
|
||
jobs:
|
||
guard:
|
||
name: Detect unsubstituted template
|
||
runs-on: self-hosted
|
||
outputs:
|
||
is_template: ${{ steps.detect.outputs.is_template }}
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
- id: detect
|
||
# The detection lives in scripts/is-template.sh so it can be TESTED.
|
||
# It was inline here twice and wrong both times (#9, #10): the grep
|
||
# named a placeholder literally, and the scaffolder substitutes every
|
||
# file including this one, so in a generated repo the guard matched
|
||
# forever and check/build/deploy all skipped while the run went green.
|
||
#
|
||
# An inline shell block in a workflow cannot be run by a test, which is
|
||
# why the second fix repeated the first bug under a comment warning
|
||
# about it. scripts/tests/is-template_test.sh now substitutes the guard
|
||
# and asserts it still answers correctly.
|
||
run: |
|
||
echo "is_template=$(bash scripts/is-template.sh go.mod)" >> "$GITHUB_OUTPUT"
|
||
|
||
check:
|
||
name: Lint / Test / Vet
|
||
# Deliberately NOT gated on the guard (#12). build and deploy are, because
|
||
# they genuinely cannot work here -- placeholder module path, no image name,
|
||
# no namespace. But linting and testing the template is meaningful, and
|
||
# gating it meant this repo had no working gate at all: #8 sat here with CI
|
||
# green throughout, and was found by a child rather than by us.
|
||
#
|
||
# `task check` includes scripts/tests/generated-child_test.sh, which covers
|
||
# the entrypoint that ./... cannot see -- ungating without that would run a
|
||
# gate that still skips the package every child is built around.
|
||
needs: guard
|
||
runs-on: self-hosted
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- uses: actions/setup-go@v5
|
||
with:
|
||
go-version-file: go.mod
|
||
cache: false
|
||
|
||
- name: Install toolchain
|
||
run: |
|
||
go version
|
||
# Pin the GENERATOR to the same version as the templ LIBRARY in
|
||
# go.mod. Installing @latest let them drift: the generator emitted
|
||
# calls (templruntime.WriteString) that the pinned library did not
|
||
# have, which is template-go-web#8. Nothing caught it because the
|
||
# guard skipped `check` in this repo entirely (#12).
|
||
templ_version="$(go list -m -f '{{.Version}}' github.com/a-h/templ)"
|
||
echo "templ library is $templ_version — installing the matching generator"
|
||
go install "github.com/a-h/templ/cmd/templ@$templ_version"
|
||
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
|
||
| sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
|
||
|
||
- name: Run checks
|
||
run: task check
|
||
|
||
build:
|
||
name: Build & Import
|
||
needs: [guard, check]
|
||
if: needs.guard.outputs.is_template != 'true' && github.event_name != 'pull_request'
|
||
runs-on: self-hosted
|
||
outputs:
|
||
image-tag: ${{ steps.meta.outputs.sha-tag }}
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Derive image tags
|
||
id: meta
|
||
run: |
|
||
SHA=$(git rev-parse --short HEAD)
|
||
echo "sha-tag=${SHA}" >> "$GITHUB_OUTPUT"
|
||
|
||
# infra#309: the implementation lives in .gitea/build-image.sh, a
|
||
# byte-identical copy of mathias/infra's ci-templates/build-image.sh.
|
||
# Do not edit it here -- edit the canonical file, run `task ci:sync`,
|
||
# and infra's drift gate will name any repo still carrying an old copy.
|
||
#
|
||
# This matters more in a template than anywhere else: every repo
|
||
# generated from here inherits its CI, so a template that carries the
|
||
# build LOGIC manufactures a new copy of every bug in it. That is
|
||
# precisely how rootless buildah (infra#241) reached a dozen repos, and
|
||
# why the fix then had to be rediscovered here weeks later. A template
|
||
# that carries a CALL manufactures nothing.
|
||
#
|
||
# NEW REPOS: add yourself to mathias/infra's ci-templates/adopters.txt so
|
||
# the gate keeps this copy current. Until you do, the copy is unmanaged
|
||
# and will silently fall behind.
|
||
#
|
||
# `bash <script>` rather than executing it directly: files written via
|
||
# the Gitea API land 0644, and CI that depends on a file mode is a trap.
|
||
- name: Build and push to local registry
|
||
env:
|
||
SHA_TAG: ${{ steps.meta.outputs.sha-tag }}
|
||
GIT_SHA: ${{ github.sha }}
|
||
run: bash .gitea/build-image.sh
|
||
|
||
deploy:
|
||
name: Deploy via GitOps
|
||
needs: [guard, build]
|
||
if: needs.guard.outputs.is_template != 'true' && github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||
runs-on: self-hosted
|
||
steps:
|
||
- name: Update image tag in infra repo
|
||
env:
|
||
IMAGE_TAG: ${{ needs.build.outputs.image-tag }}
|
||
DEPLOY_KEY: ${{ secrets.INFRA_DEPLOY_KEY }}
|
||
run: |
|
||
set -euo pipefail
|
||
# infra#311: fail on an empty tag BEFORE patching anything. The
|
||
# grep verification further down CANNOT catch it -- with IMAGE_TAG
|
||
# empty its pattern matches the very corruption it exists to reject.
|
||
# The result is `image: <repo>:` in the manifest, which is invalid
|
||
# YAML, so Flux fails the ENTIRE apps Kustomization and every app
|
||
# stops reconciling, not just this one. That happened on 2026-08-25.
|
||
[ -n "${IMAGE_TAG:-}" ] || { echo "IMAGE_TAG is empty - refusing to patch"; exit 1; }
|
||
mkdir -p ~/.ssh
|
||
echo "$DEPLOY_KEY" > ~/.ssh/id_infra
|
||
chmod 600 ~/.ssh/id_infra
|
||
ssh-keyscan -p 30022 10.0.1.20 >> ~/.ssh/known_hosts 2>/dev/null
|
||
export GIT_SSH_COMMAND="ssh -i ~/.ssh/id_infra -o IdentitiesOnly=yes"
|
||
rm -rf /tmp/infra
|
||
git clone -b main ssh://git@10.0.1.20:30022/mathias/infra.git /tmp/infra
|
||
cd /tmp/infra
|
||
DEPLOYMENT="k3s/apps/spatial-agent-app/deployment.yaml"
|
||
sed -i "s|image: localhost:5000/spatial-agent-app:.*|image: localhost:5000/spatial-agent-app:${IMAGE_TAG}|" "$DEPLOYMENT"
|
||
grep -q "localhost:5000/spatial-agent-app:${IMAGE_TAG}" "$DEPLOYMENT" \
|
||
|| { echo "✗ image tag patch failed"; exit 1; }
|
||
if git diff --quiet "$DEPLOYMENT"; then
|
||
echo "ℹ image tag unchanged — skipping push"
|
||
else
|
||
git -c user.name="spatial-agent-app CI" \
|
||
-c user.email="ci@spatial-agent-app.local" \
|
||
commit -m "chore(deploy): spatial-agent-app → ${IMAGE_TAG}" "$DEPLOYMENT"
|
||
git push origin main
|
||
echo "✓ pushed to infra repo"
|
||
fi
|
||
shred -u ~/.ssh/id_infra
|
||
|
||
- name: Trigger Flux reconcile
|
||
run: |
|
||
kubectl -n flux-system annotate gitrepository flux-system \
|
||
reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
|
||
kubectl -n flux-system annotate kustomization apps \
|
||
reconcile.fluxcd.io/requestedAt="$(date +%s)" --overwrite
|
||
|
||
- name: Verify rollout
|
||
run: |
|
||
kubectl rollout status deployment/spatial-agent-app \
|
||
--namespace spatial-agent-app \
|
||
--timeout=120s \
|
||
|| {
|
||
kubectl get pods -n spatial-agent-app -o wide
|
||
kubectl get events -n spatial-agent-app --sort-by='.lastTimestamp' | tail -20
|
||
exit 1
|
||
}
|