1ea007d330
The repo moved from the uberbau owner to moby on the zo forge. Update the image registry path and Kaniko git context accordingly.
109 lines
4.2 KiB
YAML
109 lines
4.2 KiB
YAML
name: Build & Publish
|
|
# Fork build pipeline for the "zo" forge (git.ziemlichoptimal.de/moby/brewlog).
|
|
# On every push to `dev` this checks the code, then builds the container and
|
|
# publishes it to this forge's own container registry. The moby homelab
|
|
# (git.ziemlichoptimal.de/moby/cluster-moby) deploys the resulting image via
|
|
# Flux GitOps — this pipeline does NOT deploy anything itself (the upstream
|
|
# Fly.io deploy step was removed).
|
|
on:
|
|
push:
|
|
branches: ["dev"]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# The auto GITHUB_TOKEN needs `packages: write` to push to the forge's container
|
|
# registry — without it Kaniko's push-permission check 401s (reqPackageAccess).
|
|
# `contents: read` keeps git clone (checkout / Kaniko git context) working.
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
# This forge's built-in container registry, same host as the git server.
|
|
REGISTRY: git.ziemlichoptimal.de
|
|
IMAGE: git.ziemlichoptimal.de/moby/brewlog
|
|
|
|
jobs:
|
|
check:
|
|
name: Check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# The repo's mise.toml pulls the whole dev toolchain (tailwind, cargo-watch,
|
|
# flyctl, shellcheck, ...), and mise resolves most of those via the GitHub
|
|
# API — which 401s on this runner (it has no github.com token), failing the
|
|
# entire install. CI only needs the pinned Rust toolchain, so install it
|
|
# directly via mise (rust resolves through rustup, no GitHub API).
|
|
- name: Install Rust toolchain
|
|
uses: https://github.com/jdx/mise-action@v2
|
|
with:
|
|
install_args: rust
|
|
|
|
- name: Cache Cargo artifacts
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry/index/
|
|
~/.cargo/registry/cache/
|
|
~/.cargo/git/db/
|
|
target/
|
|
key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-check
|
|
restore-keys: |
|
|
cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
|
|
cargo-${{ runner.os }}-
|
|
|
|
# No sudo on the node:20-bookworm runner image (job runs as root). mold is
|
|
# required by .cargo/config.toml's linker flag (-fuse-ld=mold).
|
|
- name: Install system dependencies
|
|
run: apt-get update && apt-get install -y --no-install-recommends clang lld mold pkg-config
|
|
|
|
- name: Check formatting
|
|
run: cargo fmt -- --check
|
|
|
|
- name: Clippy
|
|
run: cargo clippy -- -D warnings
|
|
|
|
- name: Run tests
|
|
run: cargo test -- --show-output
|
|
|
|
build:
|
|
name: Build & Publish
|
|
runs-on: ubuntu-latest
|
|
needs: [check]
|
|
# Build the image DAEMONLESS with Kaniko — no Docker, no buildx, no
|
|
# privileged DinD. The job runs *inside* the Kaniko executor image, which
|
|
# builds the Dockerfile and pushes straight to the forge registry.
|
|
container:
|
|
image: gcr.io/kaniko-project/executor:v1.24.0-debug
|
|
defaults:
|
|
run:
|
|
# The kaniko -debug image is busybox-only (no bash).
|
|
shell: sh
|
|
steps:
|
|
- name: Build and push (Kaniko)
|
|
env:
|
|
# Forgejo auto-provides GITHUB_TOKEN; it can push packages for this
|
|
# repo's owner (moby) and read this (private-context) git repo.
|
|
FORGE_USER: ${{ github.actor }}
|
|
FORGE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
# Kaniko reads these to clone the `--context` git URL.
|
|
GIT_USERNAME: ${{ github.actor }}
|
|
GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
# Registry auth for the push (docker config.json format).
|
|
AUTH=$(printf '%s:%s' "$FORGE_USER" "$FORGE_TOKEN" | base64 | tr -d '\n')
|
|
mkdir -p /kaniko/.docker
|
|
printf '{"auths":{"%s":{"auth":"%s"}}}' "$REGISTRY" "$AUTH" > /kaniko/.docker/config.json
|
|
# Kaniko clones the context itself (this job has no node for JS actions
|
|
# like checkout). `dev` is the moving branch tag; the commit SHA is the
|
|
# immutable ref the moby Deployment pins by digest.
|
|
/kaniko/executor \
|
|
--context "git://${REGISTRY}/moby/brewlog.git#refs/heads/dev" \
|
|
--dockerfile Dockerfile \
|
|
--destination "${IMAGE}:${GITHUB_SHA}" \
|
|
--destination "${IMAGE}:dev"
|