mathias
7ee0684b81
Bare 'on:' is a YAML boolean (Norway problem) — parsed as the key True, not the string 'on'. Gitea's workflow loader then materialised 0 jobs and every run failed instantly. Quoting "on": fixes dispatch.
114 lines
4.0 KiB
YAML
114 lines
4.0 KiB
YAML
name: CI
|
|
|
|
"on":
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
IMAGE: tapir
|
|
|
|
jobs:
|
|
# ── 1. Quality gate ─────────────────────────────────────────────────────────
|
|
# NOTE: the acceptance suite is intentionally RED in the scaffold (the engine
|
|
# returns ErrNotImplemented). This job will fail until the first build task
|
|
# implements Engine.ProcessNewVideo. That is the expected TDD starting state.
|
|
check:
|
|
name: Lint / Test / Vet
|
|
runs-on: self-hosted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false
|
|
|
|
- name: Verify toolchain
|
|
run: |
|
|
go version
|
|
task --version
|
|
|
|
- name: Install golangci-lint
|
|
run: |
|
|
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
|
|
| sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
|
|
golangci-lint --version
|
|
|
|
- name: Run checks
|
|
run: task check
|
|
|
|
# ── 2. Build image ──────────────────────────────────────────────────────────
|
|
build:
|
|
name: Build & Import
|
|
needs: check
|
|
runs-on: self-hosted
|
|
if: github.event_name != 'pull_request'
|
|
outputs:
|
|
image-tag: ${{ steps.meta.outputs.sha-tag }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Derive image tags
|
|
id: meta
|
|
run: |
|
|
SHA=$(git rev-parse --short HEAD)
|
|
echo "sha-tag=${SHA}" >> "$GITHUB_OUTPUT"
|
|
REF="${{ github.ref }}"
|
|
if [[ "$REF" == refs/tags/v* ]]; then
|
|
echo "version-tag=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Build and push to local registry
|
|
run: |
|
|
REGISTRY="localhost:5000"
|
|
REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
|
|
buildah build \
|
|
--label "org.opencontainers.image.revision=${{ github.sha }}" \
|
|
--label "org.opencontainers.image.source=${{ github.repositoryUrl }}" \
|
|
-t ${REF} \
|
|
-t ${REGISTRY}/${{ env.IMAGE }}:latest \
|
|
.
|
|
buildah push --tls-verify=false ${REF}
|
|
buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
|
|
[[ -n "${{ steps.meta.outputs.version-tag }}" ]] && \
|
|
buildah push --tls-verify=false \
|
|
${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }} || true
|
|
echo "Image pushed to ${REF}"
|
|
|
|
- name: Smoke test
|
|
run: |
|
|
REGISTRY="localhost:5000"
|
|
REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
|
|
CNAME="smoke-${{ steps.meta.outputs.sha-tag }}"
|
|
sudo k3s ctr images pull --plain-http ${REF}
|
|
OUTPUT=$(timeout 5 sudo k3s ctr run --rm ${REF} ${CNAME} /tapir 2>&1 || true)
|
|
sudo k3s ctr containers delete ${CNAME} 2>/dev/null || true
|
|
echo "$OUTPUT" | grep -q "tapir" \
|
|
&& echo "Smoke test passed" \
|
|
|| echo "Smoke test inconclusive: $OUTPUT"
|
|
|
|
# ── 3. Mirror to GitHub (deploy intentionally omitted until manifests exist) ─
|
|
mirror:
|
|
name: Mirror to GitHub
|
|
needs: build
|
|
runs-on: self-hosted
|
|
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Push to GitHub
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo '${{ secrets.GH_DEPLOY_KEY }}' > ~/.ssh/id_rsa_gh_mirror
|
|
chmod 600 ~/.ssh/id_rsa_gh_mirror
|
|
ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
|
|
GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa_gh_mirror -o IdentitiesOnly=yes" \
|
|
git push git@github.com:mathiasb/tapir.git HEAD:main
|
|
rm ~/.ssh/id_rsa_gh_mirror
|
|
echo "Mirrored to GitHub"
|