mathias
eb24a24b9c
Mirror to github.com was failing with 'unsupported in libcrypto' on every run (OpenSSL 3.6 / OpenSSH 10 dropped support for the existing key format). Removed rather than leave it polluting the CI signal. Re-add when the deploy key is rotated to ed25519.
94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
name: CI
|
|
|
|
"on":
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
IMAGE: tapir
|
|
|
|
jobs:
|
|
# ── 1. Quality gate ─────────────────────────────────────────────────────────
|
|
# NOTE: the acceptance suite is intentionally RED in the scaffold (the engine
|
|
# returns ErrNotImplemented). This job will fail until the first build task
|
|
# implements Engine.ProcessNewVideo. That is the expected TDD starting state.
|
|
check:
|
|
name: Lint / Test / Vet
|
|
runs-on: self-hosted
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: false
|
|
|
|
- name: Verify toolchain
|
|
run: |
|
|
go version
|
|
task --version
|
|
|
|
- name: Install golangci-lint
|
|
run: |
|
|
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
|
|
| sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
|
|
golangci-lint --version
|
|
|
|
- name: Run checks
|
|
run: task check
|
|
|
|
# ── 2. Build image ──────────────────────────────────────────────────────────
|
|
build:
|
|
name: Build & Import
|
|
needs: check
|
|
runs-on: self-hosted
|
|
if: github.event_name != 'pull_request'
|
|
outputs:
|
|
image-tag: ${{ steps.meta.outputs.sha-tag }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Derive image tags
|
|
id: meta
|
|
run: |
|
|
SHA=$(git rev-parse --short HEAD)
|
|
echo "sha-tag=${SHA}" >> "$GITHUB_OUTPUT"
|
|
REF="${{ github.ref }}"
|
|
if [[ "$REF" == refs/tags/v* ]]; then
|
|
echo "version-tag=${REF#refs/tags/}" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Build and push to local registry
|
|
run: |
|
|
REGISTRY="localhost:5000"
|
|
REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
|
|
buildah build \
|
|
--label "org.opencontainers.image.revision=${{ github.sha }}" \
|
|
--label "org.opencontainers.image.source=${{ github.repositoryUrl }}" \
|
|
-t ${REF} \
|
|
-t ${REGISTRY}/${{ env.IMAGE }}:latest \
|
|
.
|
|
buildah push --tls-verify=false ${REF}
|
|
buildah push --tls-verify=false ${REGISTRY}/${{ env.IMAGE }}:latest
|
|
[[ -n "${{ steps.meta.outputs.version-tag }}" ]] && \
|
|
buildah push --tls-verify=false \
|
|
${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.version-tag }} || true
|
|
echo "Image pushed to ${REF}"
|
|
|
|
- name: Smoke test
|
|
run: |
|
|
REGISTRY="localhost:5000"
|
|
REF="${REGISTRY}/${{ env.IMAGE }}:${{ steps.meta.outputs.sha-tag }}"
|
|
CNAME="smoke-${{ steps.meta.outputs.sha-tag }}"
|
|
sudo k3s ctr images pull --plain-http ${REF}
|
|
OUTPUT=$(timeout 5 sudo k3s ctr run --rm ${REF} ${CNAME} /tapir 2>&1 || true)
|
|
sudo k3s ctr containers delete ${CNAME} 2>/dev/null || true
|
|
echo "$OUTPUT" | grep -q "tapir" \
|
|
&& echo "Smoke test passed" \
|
|
|| echo "Smoke test inconclusive: $OUTPUT"
|
|
|
|
# ── 3. Mirror to GitHub — skipped for now (SSH key rotation pending) ─
|