automation
8180595a8d
All checks were successful
build-and-deploy / build-deploy (push) Successful in 17s
74 lines
3.1 KiB
YAML
74 lines
3.1 KiB
YAML
name: build-and-deploy
|
|
|
|
# Build the image, push to Harbor, bump the deploy tag, push back → ArgoCD deploys.
|
|
# paths-ignore avoids an infinite loop: the tag-bump commit only touches deploy/.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- "deploy/**"
|
|
- "**.md"
|
|
|
|
env:
|
|
IMAGE: harbor.devroadmap.ru/homelab/devroadmap-demo
|
|
|
|
jobs:
|
|
build-deploy:
|
|
runs-on: k8s-arm64 # act_runner label → docker:27-cli, DinD at localhost:2375
|
|
# The job image (docker:27-cli) is Alpine: only /bin/sh (no bash). Default all
|
|
# run: steps to sh so act_runner doesn't try (and fail to find) bash.
|
|
defaults:
|
|
run:
|
|
shell: sh
|
|
env:
|
|
DOCKER_HOST: tcp://localhost:2375
|
|
steps:
|
|
# Manual git checkout instead of actions/checkout@v4: the job image
|
|
# (docker:27-cli, from the k8s-arm64 runner label) has no Node.js, so JS
|
|
# actions fail with "exec: node: not found". Plain git needs only what the
|
|
# image already has (git + docker) and avoids pulling a heavy act image.
|
|
# Pass secrets via env (NOT inline ${{ }}): a secret value pasted into the
|
|
# shell is re-parsed, so any $ in it expands. The Harbor robot user is
|
|
# robot$homelab+ci — inline it would become robot+ci ("$homelab" → empty).
|
|
- name: Checkout
|
|
env:
|
|
FJ_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
run: |
|
|
git clone -q -b "${GITHUB_REF_NAME:-main}" \
|
|
"http://ci:${FJ_TOKEN}@forgejo.forgejo.svc/${{ github.repository }}.git" .
|
|
|
|
- name: Short SHA
|
|
id: sha
|
|
# POSIX sh has no ${var::7} substring — use cut.
|
|
run: echo "value=$(printf '%s' "$GITHUB_SHA" | cut -c1-7)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Login to Harbor
|
|
env:
|
|
RU: ${{ secrets.HARBOR_ROBOT_USER }} # robot$homelab+ci — via env so $ isn't expanded
|
|
RP: ${{ secrets.HARBOR_ROBOT_PASSWORD }}
|
|
run: echo "$RP" | docker login harbor.devroadmap.ru -u "$RU" --password-stdin
|
|
|
|
- name: Build and push (native arm64)
|
|
run: |
|
|
docker build \
|
|
--build-arg GIT_SHA="${{ steps.sha.outputs.value }}" \
|
|
--build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
|
|
-t "$IMAGE:${{ steps.sha.outputs.value }}" \
|
|
-t "$IMAGE:latest" .
|
|
docker push "$IMAGE:${{ steps.sha.outputs.value }}"
|
|
docker push "$IMAGE:latest"
|
|
|
|
- name: Bump deploy tag (GitOps) and push back
|
|
env:
|
|
FJ_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
|
|
run: |
|
|
sed -i "s#newTag:.*#newTag: \"${{ steps.sha.outputs.value }}\"#" deploy/kustomization.yaml
|
|
git config user.name "forgejo-ci"
|
|
git config user.email "ci@git.devroadmap.ru"
|
|
git add deploy/kustomization.yaml
|
|
git commit -m "ci: deploy ${{ steps.sha.outputs.value }} [skip ci]" || { echo "no change"; exit 0; }
|
|
git push "http://ci:${FJ_TOKEN}@forgejo.forgejo.svc/${{ github.repository }}.git" HEAD:main
|
|
|
|
- name: Summary
|
|
run: |
|
|
echo "Built $IMAGE:${{ steps.sha.outputs.value }} → Harbor; deploy/ bumped → ArgoCD will sync." >> "$GITHUB_STEP_SUMMARY"
|