homelab/devroadmap-demo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(ci): pass secrets via env (robot user contains $)
All checks were successful
build-and-deploy / build-deploy (push) Successful in 17s
Details

Browse source
This commit is contained in:
automation 2026-09-14 10:24:17 +03:00
parent bebac7b7aa
commit 8180595a8d
1 changed files with 13 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

18
.forgejo/workflows/ci.yml
View file

@ -27,10 +27,15 @@ jobs:
# (docker:27-cli, from the k8s-arm64 runner label) has no Node.js, so JS # (docker:27-cli, from the k8s-arm64 runner label) has no Node.js, so JS
# actions fail with "exec: node: not found". Plain git needs only what the # actions fail with "exec: node: not found". Plain git needs only what the
# image already has (git + docker) and avoids pulling a heavy act image. # image already has (git + docker) and avoids pulling a heavy act image.
# Pass secrets via env (NOT inline ${{ }}): a secret value pasted into the
# shell is re-parsed, so any $ in it expands. The Harbor robot user is
# robot$homelab+ci — inline it would become robot+ci ("$homelab" → empty).
- name: Checkout - name: Checkout
env:
FJ_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
run: | run: |
git clone -q -b "${GITHUB_REF_NAME:-main}" \ git clone -q -b "${GITHUB_REF_NAME:-main}" \
"http://ci:${{ secrets.FORGEJO_TOKEN }}@forgejo.forgejo.svc/${{ github.repository }}.git" . "http://ci:${FJ_TOKEN}@forgejo.forgejo.svc/${{ github.repository }}.git" .
- name: Short SHA - name: Short SHA
id: sha id: sha
@ -38,9 +43,10 @@ jobs:
run: echo "value=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)" >> "$GITHUB_OUTPUT" run: echo "value=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)" >> "$GITHUB_OUTPUT"
- name: Login to Harbor - name: Login to Harbor
run: | env:
echo "${{ secrets.HARBOR_ROBOT_PASSWORD }}" \ RU: ${{ secrets.HARBOR_ROBOT_USER }} # robot$homelab+ci — via env so $ isn't expanded
| docker login harbor.devroadmap.ru -u "${{ secrets.HARBOR_ROBOT_USER }}" --password-stdin RP: ${{ secrets.HARBOR_ROBOT_PASSWORD }}
run: echo "$RP" | docker login harbor.devroadmap.ru -u "$RU" --password-stdin
- name: Build and push (native arm64) - name: Build and push (native arm64)
run: | run: |
@ -53,13 +59,15 @@ jobs:
docker push "$IMAGE:latest" docker push "$IMAGE:latest"
- name: Bump deploy tag (GitOps) and push back - name: Bump deploy tag (GitOps) and push back
env:
FJ_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
run: | run: |
sed -i "s#newTag:.*#newTag: \"${{ steps.sha.outputs.value }}\"#" deploy/kustomization.yaml sed -i "s#newTag:.*#newTag: \"${{ steps.sha.outputs.value }}\"#" deploy/kustomization.yaml
git config user.name "forgejo-ci" git config user.name "forgejo-ci"
git config user.email "ci@git.devroadmap.ru" git config user.email "ci@git.devroadmap.ru"
git add deploy/kustomization.yaml git add deploy/kustomization.yaml
git commit -m "ci: deploy ${{ steps.sha.outputs.value }} [skip ci]" || { echo "no change"; exit 0; } git commit -m "ci: deploy ${{ steps.sha.outputs.value }} [skip ci]" || { echo "no change"; exit 0; }
git push "http://ci:${{ secrets.FORGEJO_TOKEN }}@forgejo.forgejo.svc/${{ github.repository }}.git" HEAD:main git push "http://ci:${FJ_TOKEN}@forgejo.forgejo.svc/${{ github.repository }}.git" HEAD:main
- name: Summary - name: Summary
run: | run: |