From 3850e015e7e5369bf43c690ed4d0243852d3fd06 Mon Sep 17 00:00:00 2001 From: continuist Date: Sat, 13 Sep 2025 10:31:48 -0400 Subject: [PATCH] Try simplified CI workflow --- .forgejo/workflows/ci.yml | 397 +++++--------------------------------- 1 file changed, 47 insertions(+), 350 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 7d41bad..768aeca 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -1,4 +1,4 @@ -name: CI/CD Pipeline with Secure Ephemeral PiP +name: CI/CD Pipeline Simplified on: push: @@ -11,380 +11,77 @@ env: APP_NAME: ${{ secrets.APP_NAME }} IMAGE_TAG: ${{ github.sha }} RUN_ID: ${{ github.run_id }} - POSTGRES_USERNAME: ${{ secrets.PROD_DB_USERNAME }} - POSTGRES_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }} - POSTGRES_HOST: ${{ secrets.PROD_DB_HOST }} - POSTGRES_PORT: ${{ secrets.PROD_DB_PORT }} - POSTGRES_DATABASE_NAME: ${{ secrets.PROD_DB_DATABASE_NAME }} - PROD_BACKEND_HOST: ${{ secrets.PROD_BACKEND_HOST }} - PROD_BACKEND_PORT: ${{ secrets.PROD_BACKEND_PORT }} - PROD_FRONTEND_PORT: ${{ secrets.PROD_FRONTEND_PORT }} - # Required pinned digests (fail if missing) - RUST_IMG_DIGEST: ${{ secrets.RUST_IMG_DIGEST }} # e.g., docker.io/library/rust@sha256:... - NODE_IMG_DIGEST: ${{ secrets.NODE_IMG_DIGEST }} # e.g., docker.io/library/node@sha256:... - POSTGRES_IMG_DIGEST: ${{ secrets.POSTGRES_IMG_DIGEST }} # e.g., docker.io/library/postgres@sha256:... - PODMAN_CLIENT_IMG_DIGEST: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f + # Your other env vars... jobs: test-backend: runs-on: [ci] - env: - XDG_RUNTIME_DIR: /run/user/999 - CONTAINER_HOST: unix:///podman-host/podman.sock container: image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f - # options: >- - # -v /run/user/999/podman:/run/user/999/podman:rw - # -e XDG_RUNTIME_DIR=/run/user/999 steps: - uses: actions/checkout@v4 - - run: | - id - ls -l /podman-host - stat -c '%A %U:%G %n' /podman-host/podman.sock - test -S /podman-host/podman.sock - podman info --log-level=error >/dev/null - podman ps >/dev/null - node -v - podman --version - - name: Network/DNS sanity from job container + - name: Debug container environment run: | - getent hosts git.gcdo.org || true - curl -sS -o /dev/null -w 'status=%{http_code}\n' https://git.gcdo.org/api/healthz || true + echo "Current user: $(id)" + echo "Environment variables:" + env | sort + echo "Directory contents:" + ls -la / + ls -la /run/ || echo "No /run directory" + ls -la /run/user/ || echo "No /run/user directory" + echo "Testing Podman access:" + podman --version || echo "Podman not available" + which podman || echo "Podman not in PATH" + + - name: Verify Podman access + run: | + echo "Checking Podman socket..." + ls -la /podman-host/ + test -S /podman-host/podman.sock && echo "Socket exists" || echo "Socket missing" + podman --url unix:///podman-host/podman.sock info + podman --url unix:///podman-host/podman.sock ps - - name: Verify pinned digests provided + - name: Verify pinned digests run: | - for v in RUST_IMG_DIGEST NODE_IMG_DIGEST POSTGRES_IMG_DIGEST PODMAN_CLIENT_IMG_DIGEST; do + for v in RUST_IMG_DIGEST NODE_IMG_DIGEST POSTGRES_IMG_DIGEST; do [ -n "${!v}" ] || { echo "Missing $v"; exit 1; } echo "${!v}" | grep -Eq '^.+@sha256:[0-9a-f]{64}$' || { echo "$v must be a digest ref"; exit 1; } done - - name: Setup ephemeral PiP container - env: - SOCKET_PATH: /podman-host/podman.sock + - name: Create internal network + run: podman --url unix:///podman-host/podman.sock network create --internal integ-${{ env.RUN_ID }} + + - name: Start PostgreSQL run: | - chmod +x ./secure_pip_setup.sh - ./secure_pip_setup.sh - - - name: Wait for PiP readiness - env: - PIP_NAME: ci-pip-${{ env.RUN_ID }} - run: | - chmod +x ./pip_ready.sh - ./pip_ready.sh - - - name: Verify Podman socket inside PiP - run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'test -S /run/podman-host/podman.sock && echo OK' - - - name: Network sanity from PiP - run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'getent hosts git.gcdo.org && curl -sS -o /dev/null -w "status=%{http_code}\n" https://git.gcdo.org/api/healthz' - - - name: Configure Git for token-based authentication - run: | - git config --global url."https://${{ secrets.REGISTRY_USERNAME }}:${{ secrets.REGISTRY_TOKEN }}@${{ env.REGISTRY }}".insteadOf "https://${{ env.REGISTRY }}" - - - name: Create internal integration network - run: podman exec ci-pip-${{ env.RUN_ID }} podman network create --internal integ-${{ env.RUN_ID }} - - - name: Start PostgreSQL on internal network (digest-pinned) - run: | - podman exec ci-pip-${{ env.RUN_ID }} podman run -d \ - --name test-postgres \ + podman --url unix:///podman-host/podman.sock run -d \ + --name test-postgres-${{ env.RUN_ID }} \ --network integ-${{ env.RUN_ID }} \ -e POSTGRES_PASSWORD=password \ -e POSTGRES_USER=postgres \ -e POSTGRES_DB=sharenet_test \ - "${POSTGRES_IMG_DIGEST}" + "$POSTGRES_IMG_DIGEST" - - name: Wait for PostgreSQL to be ready + - name: Wait for PostgreSQL run: | - podman exec ci-pip-${{ env.RUN_ID }} sh -lc ' - i=0; until podman exec test-postgres pg_isready -h 127.0.0.1 -p 5432 -U postgres >/dev/null 2>&1; do - i=$((i+1)); [ $i -gt 60 ] && { echo "pg not ready"; exit 1; }; sleep 1 - done' + timeout 60 bash -c ' + until podman --url unix:///podman-host/podman.sock exec test-postgres-${{ env.RUN_ID }} pg_isready -h 127.0.0.1 -p 5432 -U postgres; do + sleep 1 + done + ' - - name: Run backend unit tests - env: - WORKSPACE: ${{ github.workspace }} + - name: Run backend tests run: | - podman exec -e WORKSPACE="${WORKSPACE}" ci-pip-${{ env.RUN_ID }} sh -lc ' - podman run --rm \ - -v "$WORKSPACE":/workspace \ - -w /workspace \ - "'"${RUST_IMG_DIGEST}"'" \ - sh -c "cargo test --lib -- --test-threads=1"' + podman --url unix:///podman-host/podman.sock run --rm \ + -v "$PWD":/workspace \ + -w /workspace \ + --network integ-${{ env.RUN_ID }} \ + -e DATABASE_URL=postgres://postgres:password@test-postgres-${{ env.RUN_ID }}:5432/sharenet_test \ + "$RUST_IMG_DIGEST" \ + sh -c "cargo test --lib -- --test-threads=1" - - name: Run backend integration tests - env: - WORKSPACE: ${{ github.workspace }} - run: | - podman exec -e WORKSPACE="${WORKSPACE}" ci-pip-${{ env.RUN_ID }} sh -lc ' - podman run --rm \ - --network integ-${{ env.RUN_ID }} \ - -v "$WORKSPACE":/workspace \ - -w /workspace \ - -e DATABASE_URL=postgres://postgres:password@test-postgres:5432/sharenet_test \ - "'"${RUST_IMG_DIGEST}"'" \ - sh -c "cargo test --test '"'"'*'"'"' -- --test-threads=1"' - - - name: Cleanup test resources + - name: Cleanup if: always() run: | - podman exec ci-pip-${{ env.RUN_ID }} podman rm -f test-postgres 2>/dev/null || true - podman exec ci-pip-${{ env.RUN_ID }} podman network rm integ-${{ env.RUN_ID }} 2>/dev/null || true - - - name: Per-job cleanup (PiP container) - if: always() - run: podman rm -f ci-pip-${{ env.RUN_ID }} 2>/dev/null || true - - test-frontend: - runs-on: [ci] - needs: test-backend - env: - XDG_RUNTIME_DIR: /run/user/999 - CONTAINER_HOST: unix:///podman-host/podman.sock - container: - image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f - # options: >- - # -v /run/user/999/podman:/run/user/999/podman:rw - # -e XDG_RUNTIME_DIR=/run/user/999 - steps: - - uses: actions/checkout@v4 - - run: | - ls -l /podman-host - test -S /podman-host/podman.sock - podman info --log-level=error >/dev/null - podman ps >/dev/null - node -v - podman --version - - - name: Verify pinned digests provided - run: | - for v in NODE_IMG_DIGEST PODMAN_CLIENT_IMG_DIGEST; do - [ -n "${!v}" ] || { echo "Missing $v"; exit 1; } - echo "${!v}" | grep -Eq '^.+@sha256:[0-9a-f]{64}$' || { echo "$v must be a digest ref"; exit 1; } - done - - - name: Setup ephemeral PiP container - env: - SOCKET_PATH: /podman-host/podman.sock - run: | - chmod +x ./secure_pip_setup.sh - ./secure_pip_setup.sh - - - name: Wait for PiP readiness - env: - PIP_NAME: ci-pip-${{ env.RUN_ID }} - run: | - chmod +x ./pip_ready.sh - ./pip_ready.sh - - - name: Verify Podman socket inside PiP - run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'test -S /run/podman-host/podman.sock && echo OK' - - - name: Network sanity from PiP - run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'getent hosts git.gcdo.org && curl -sS -o /dev/null -w "status=%{http_code}\n" https://git.gcdo.org/api/healthz' - - - name: Run frontend tests (digest-pinned) - env: - WORKSPACE: ${{ github.workspace }} - run: | - podman exec -e WORKSPACE="${WORKSPACE}" ci-pip-${{ env.RUN_ID }} sh -lc ' - podman run --rm \ - -v "$WORKSPACE":/workspace \ - -w /workspace \ - "'"${NODE_IMG_DIGEST}"'" \ - sh -c "npm ci && npm run test"' - - - name: Per-job cleanup (PiP container) - if: always() - run: podman rm -f ci-pip-${{ env.RUN_ID }} 2>/dev/null || true - - build-backend: - runs-on: [ci] - needs: test-frontend - env: - XDG_RUNTIME_DIR: /run/user/999 - CONTAINER_HOST: unix:///podman-host/podman.sock - container: - image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f - # options: >- - # -v /run/user/999/podman:/run/user/999/podman:rw - # -e XDG_RUNTIME_DIR=/run/user/999 - steps: - - uses: actions/checkout@v4 - - run: | - ls -l /podman-host - test -S /podman-host/podman.sock - podman info --log-level=error >/dev/null - podman ps >/dev/null - node -v - podman --version - - - name: Setup ephemeral PiP container - env: - SOCKET_PATH: /podman-host/podman.sock - run: | - chmod +x ./secure_pip_setup.sh - ./secure_pip_setup.sh - - - name: Wait for PiP readiness - env: - PIP_NAME: ci-pip-${{ env.RUN_ID }} - run: | - chmod +x ./pip_ready.sh - ./pip_ready.sh - - - name: Verify Podman socket inside PiP - run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'test -S /run/podman-host/podman.sock && echo OK' - - - name: Network sanity from PiP - run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'getent hosts git.gcdo.org && curl -sS -o /dev/null -w "status=%{http_code}\n" https://git.gcdo.org/api/healthz' - - - name: Login to Forgejo Container Registry securely - env: - REGISTRY_HOST: ${{ env.REGISTRY }} - REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} - REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} - run: | - podman exec -i ci-pip-${{ env.RUN_ID }} sh -lc \ - 'podman login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin' <<<"${REGISTRY_TOKEN}" - - - name: Build backend image - env: - REGISTRY: ${{ env.REGISTRY }} - APP_NAME: ${{ env.APP_NAME }} - IMAGE_TAG: ${{ env.IMAGE_TAG }} - run: | - podman exec ci-pip-${{ env.RUN_ID }} sh -lc \ - 'cd /workspace/backend && podman build -t "$REGISTRY/$APP_NAME/backend:$IMAGE_TAG" .' - - - name: Push backend image - env: - REGISTRY: ${{ env.REGISTRY }} - APP_NAME: ${{ env.APP_NAME }} - IMAGE_TAG: ${{ env.IMAGE_TAG }} - run: | - podman exec ci-pip-${{ env.RUN_ID }} sh -lc \ - 'podman push "$REGISTRY/$APP_NAME/backend:$IMAGE_TAG"' - - - name: Per-job cleanup (PiP container) - if: always() - run: podman rm -f ci-pip-${{ env.RUN_ID }} 2>/dev/null || true - - build-frontend: - runs-on: [ci] - needs: test-frontend - env: - XDG_RUNTIME_DIR: /run/user/999 - CONTAINER_HOST: unix:///podman-host/podman.sock - container: - image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f - # options: >- - # -v /run/user/999/podman:/run/user/999/podman:rw - # -e XDG_RUNTIME_DIR=/run/user/999 - steps: - - uses: actions/checkout@v4 - - run: | - ls -l /podman-host - test -S /podman-host/podman.sock - podman info --log-level=error >/dev/null - podman ps >/dev/null - node -v - podman --version - - - name: Setup ephemeral PiP container - env: - SOCKET_PATH: /podman-host/podman.sock - run: | - chmod +x ./secure_pip_setup.sh - ./secure_pip_setup.sh - - - name: Wait for PiP readiness - env: - PIP_NAME: ci-pip-${{ env.RUN_ID }} - run: | - chmod +x ./pip_ready.sh - ./pip_ready.sh - - - name: Verify Podman socket inside PiP - run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'test -S /run/podman-host/podman.sock && echo OK' - - - name: Network sanity from PiP - run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'getent hosts git.gcdo.org && curl -sS -o /dev/null -w "status=%{http_code}\n" https://git.gcdo.org/api/healthz' - - - name: Login to Forgejo Container Registry securely - env: - REGISTRY_HOST: ${{ env.REGISTRY }} - REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} - REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} - run: | - podman exec -i ci-pip-${{ env.RUN_ID }} sh -lc \ - 'podman login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin' <<<"${REGISTRY_TOKEN}" - - - name: Build frontend image - env: - REGISTRY: ${{ env.REGISTRY }} - APP_NAME: ${{ env.APP_NAME }} - IMAGE_TAG: ${{ env.IMAGE_TAG }} - run: | - podman exec ci-pip-${{ env.RUN_ID }} sh -lc \ - 'cd /workspace/frontend && podman build -t "$REGISTRY/$APP_NAME/frontend:$IMAGE_TAG" .' - - - name: Push frontend image - env: - REGISTRY: ${{ env.REGISTRY }} - APP_NAME: ${{ env.APP_NAME }} - IMAGE_TAG: ${{ env.IMAGE_TAG }} - run: | - podman exec ci-pip-${{ env.RUN_ID }} sh -lc \ - 'podman push "$REGISTRY/$APP_NAME/frontend:$IMAGE_TAG"' - - - name: Per-job cleanup (PiP container) - if: always() - run: podman rm -f ci-pip-${{ env.RUN_ID }} 2>/dev/null || true - - deploy-prod: - runs-on: [prod] - needs: [build-backend, build-frontend] - if: success() - env: - XDG_RUNTIME_DIR: /run/user/999 - CONTAINER_HOST: unix:///podman-host/podman.sock - container: - image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f - # options: >- - # -v /run/user/999/podman:/run/user/999/podman:rw - # -e XDG_RUNTIME_DIR=/run/user/999 - steps: - - uses: actions/checkout@v4 - - run: | - ls -l /podman-host - test -S /podman-host/podman.sock - podman info --log-level=error >/dev/null - podman ps >/dev/null - node -v - podman --version - - # Your prod-pod.yml uses ${REGISTRY_HOST}, but the workflow defines REGISTRY. - # Export a one-off alias so templating resolves. - - name: Render prod spec (no envsubst) - env: - REGISTRY_HOST: ${{ env.REGISTRY }} - run: | - awk '{ - while (match($0, /\$\{[A-Za-z_][A-Za-z0-9_]*\}/)) { - k = substr($0, RSTART+2, RLENGTH-3); - v = ENVIRON[k]; - gsub("\\$\\{" k "\\}", v); - } - print - }' deploy/prod-pod.yml > prod-pod-deploy.yml - - - name: Apply with Podman - run: podman play kube --replace prod-pod-deploy.yml - - - name: Clean up generated file - if: always() - run: rm -f prod-pod-deploy.yml + podman --url unix:///podman-host/podman.sock rm -f test-postgres-${{ env.RUN_ID }} 2>/dev/null || true + podman --url unix:///podman-host/podman.sock network rm integ-${{ env.RUN_ID }} 2>/dev/null || true \ No newline at end of file