b83f9e95b6
Forgejo's auto GITHUB_TOKEN lacks package-write on the moby org, so the Kaniko push 401s (reqPackageAccess). Use the write:package PAT secrets for the registry auth (matching moby/uberbau_xyz and moby/claude-code); the git-context clone stays on the auto token.
112 lines
4.4 KiB
YAML
112 lines
4.4 KiB
YAML
name: Build & Publish
|
|
# Fork build pipeline for the "zo" forge (git.ziemlichoptimal.de/moby/brewlog).
|
|
# On every push to `dev` this checks the code, then builds the container and
|
|
# publishes it to this forge's own container registry. The moby homelab
|
|
# (git.ziemlichoptimal.de/moby/cluster-moby) deploys the resulting image via
|
|
# Flux GitOps — this pipeline does NOT deploy anything itself (the upstream
|
|
# Fly.io deploy step was removed).
|
|
on:
|
|
push:
|
|
branches: ["dev"]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# The registry push uses a PAT with `write:package` scope, supplied via the
|
|
# REGISTRY_USER / REGISTRY_TOKEN Actions secrets (same as moby/uberbau_xyz and
|
|
# moby/claude-code). Forgejo's auto GITHUB_TOKEN lacks org package-write, so a
|
|
# push authenticated with it 401s (reqPackageAccess). `contents: read` keeps the
|
|
# Kaniko git-context clone (over the auto token) working; `packages: write` is
|
|
# belt-and-suspenders on the auto token.
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
# This forge's built-in container registry, same host as the git server.
|
|
REGISTRY: git.ziemlichoptimal.de
|
|
IMAGE: git.ziemlichoptimal.de/moby/brewlog
|
|
|
|
jobs:
|
|
check:
|
|
name: Check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
# The repo's mise.toml pulls the whole dev toolchain (tailwind, cargo-watch,
|
|
# flyctl, shellcheck, ...), and mise resolves most of those via the GitHub
|
|
# API — which 401s on this runner (it has no github.com token), failing the
|
|
# entire install. CI only needs the pinned Rust toolchain, so install it
|
|
# directly via mise (rust resolves through rustup, no GitHub API).
|
|
- name: Install Rust toolchain
|
|
uses: https://github.com/jdx/mise-action@v2
|
|
with:
|
|
install_args: rust
|
|
|
|
- name: Cache Cargo artifacts
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: |
|
|
~/.cargo/registry/index/
|
|
~/.cargo/registry/cache/
|
|
~/.cargo/git/db/
|
|
target/
|
|
key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-check
|
|
restore-keys: |
|
|
cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}-
|
|
cargo-${{ runner.os }}-
|
|
|
|
# No sudo on the node:20-bookworm runner image (job runs as root). mold is
|
|
# required by .cargo/config.toml's linker flag (-fuse-ld=mold).
|
|
- name: Install system dependencies
|
|
run: apt-get update && apt-get install -y --no-install-recommends clang lld mold pkg-config
|
|
|
|
- name: Check formatting
|
|
run: cargo fmt -- --check
|
|
|
|
- name: Clippy
|
|
run: cargo clippy -- -D warnings
|
|
|
|
- name: Run tests
|
|
run: cargo test -- --show-output
|
|
|
|
build:
|
|
name: Build & Publish
|
|
runs-on: ubuntu-latest
|
|
needs: [check]
|
|
# Build the image DAEMONLESS with Kaniko — no Docker, no buildx, no
|
|
# privileged DinD. The job runs *inside* the Kaniko executor image, which
|
|
# builds the Dockerfile and pushes straight to the forge registry.
|
|
container:
|
|
image: gcr.io/kaniko-project/executor:v1.24.0-debug
|
|
defaults:
|
|
run:
|
|
# The kaniko -debug image is busybox-only (no bash).
|
|
shell: sh
|
|
steps:
|
|
- name: Build and push (Kaniko)
|
|
env:
|
|
# Registry push uses a PAT with write:package scope (Forgejo's auto
|
|
# GITHUB_TOKEN lacks org package-write -> 401 reqPackageAccess).
|
|
FORGE_USER: ${{ secrets.REGISTRY_USER }}
|
|
FORGE_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
# Kaniko clones the `--context` git URL over the auto token (read).
|
|
GIT_USERNAME: ${{ github.actor }}
|
|
GIT_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
set -eu
|
|
# Registry auth for the push (docker config.json format).
|
|
AUTH=$(printf '%s:%s' "$FORGE_USER" "$FORGE_TOKEN" | base64 | tr -d '\n')
|
|
mkdir -p /kaniko/.docker
|
|
printf '{"auths":{"%s":{"auth":"%s"}}}' "$REGISTRY" "$AUTH" > /kaniko/.docker/config.json
|
|
# Kaniko clones the context itself (this job has no node for JS actions
|
|
# like checkout). `dev` is the moving branch tag; the commit SHA is the
|
|
# immutable ref the moby Deployment pins by digest.
|
|
/kaniko/executor \
|
|
--context "git://${REGISTRY}/moby/brewlog.git#refs/heads/dev" \
|
|
--dockerfile Dockerfile \
|
|
--destination "${IMAGE}:${GITHUB_SHA}" \
|
|
--destination "${IMAGE}:dev"
|