Try simplified CI workflow
Some checks failed
CI/CD Pipeline Simplified / test-backend (push) Failing after 23s
Some checks failed
CI/CD Pipeline Simplified / test-backend (push) Failing after 23s
This commit is contained in:
parent
5866fcfd96
commit
3850e015e7
1 changed files with 47 additions and 350 deletions
|
|
@ -1,4 +1,4 @@
|
||||||
name: CI/CD Pipeline with Secure Ephemeral PiP
|
name: CI/CD Pipeline Simplified
|
||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
|
|
@ -11,380 +11,77 @@ env:
|
||||||
APP_NAME: ${{ secrets.APP_NAME }}
|
APP_NAME: ${{ secrets.APP_NAME }}
|
||||||
IMAGE_TAG: ${{ github.sha }}
|
IMAGE_TAG: ${{ github.sha }}
|
||||||
RUN_ID: ${{ github.run_id }}
|
RUN_ID: ${{ github.run_id }}
|
||||||
POSTGRES_USERNAME: ${{ secrets.PROD_DB_USERNAME }}
|
# Your other env vars...
|
||||||
POSTGRES_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
|
|
||||||
POSTGRES_HOST: ${{ secrets.PROD_DB_HOST }}
|
|
||||||
POSTGRES_PORT: ${{ secrets.PROD_DB_PORT }}
|
|
||||||
POSTGRES_DATABASE_NAME: ${{ secrets.PROD_DB_DATABASE_NAME }}
|
|
||||||
PROD_BACKEND_HOST: ${{ secrets.PROD_BACKEND_HOST }}
|
|
||||||
PROD_BACKEND_PORT: ${{ secrets.PROD_BACKEND_PORT }}
|
|
||||||
PROD_FRONTEND_PORT: ${{ secrets.PROD_FRONTEND_PORT }}
|
|
||||||
# Required pinned digests (fail if missing)
|
|
||||||
RUST_IMG_DIGEST: ${{ secrets.RUST_IMG_DIGEST }} # e.g., docker.io/library/rust@sha256:...
|
|
||||||
NODE_IMG_DIGEST: ${{ secrets.NODE_IMG_DIGEST }} # e.g., docker.io/library/node@sha256:...
|
|
||||||
POSTGRES_IMG_DIGEST: ${{ secrets.POSTGRES_IMG_DIGEST }} # e.g., docker.io/library/postgres@sha256:...
|
|
||||||
PODMAN_CLIENT_IMG_DIGEST: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f
|
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
test-backend:
|
test-backend:
|
||||||
runs-on: [ci]
|
runs-on: [ci]
|
||||||
env:
|
|
||||||
XDG_RUNTIME_DIR: /run/user/999
|
|
||||||
CONTAINER_HOST: unix:///podman-host/podman.sock
|
|
||||||
container:
|
container:
|
||||||
image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f
|
image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f
|
||||||
# options: >-
|
|
||||||
# -v /run/user/999/podman:/run/user/999/podman:rw
|
|
||||||
# -e XDG_RUNTIME_DIR=/run/user/999
|
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v4
|
- uses: actions/checkout@v4
|
||||||
- run: |
|
|
||||||
id
|
|
||||||
ls -l /podman-host
|
|
||||||
stat -c '%A %U:%G %n' /podman-host/podman.sock
|
|
||||||
test -S /podman-host/podman.sock
|
|
||||||
podman info --log-level=error >/dev/null
|
|
||||||
podman ps >/dev/null
|
|
||||||
node -v
|
|
||||||
podman --version
|
|
||||||
|
|
||||||
- name: Network/DNS sanity from job container
|
- name: Debug container environment
|
||||||
run: |
|
run: |
|
||||||
getent hosts git.gcdo.org || true
|
echo "Current user: $(id)"
|
||||||
curl -sS -o /dev/null -w 'status=%{http_code}\n' https://git.gcdo.org/api/healthz || true
|
echo "Environment variables:"
|
||||||
|
env | sort
|
||||||
|
echo "Directory contents:"
|
||||||
|
ls -la /
|
||||||
|
ls -la /run/ || echo "No /run directory"
|
||||||
|
ls -la /run/user/ || echo "No /run/user directory"
|
||||||
|
echo "Testing Podman access:"
|
||||||
|
podman --version || echo "Podman not available"
|
||||||
|
which podman || echo "Podman not in PATH"
|
||||||
|
|
||||||
- name: Verify pinned digests provided
|
- name: Verify Podman access
|
||||||
run: |
|
run: |
|
||||||
for v in RUST_IMG_DIGEST NODE_IMG_DIGEST POSTGRES_IMG_DIGEST PODMAN_CLIENT_IMG_DIGEST; do
|
echo "Checking Podman socket..."
|
||||||
|
ls -la /podman-host/
|
||||||
|
test -S /podman-host/podman.sock && echo "Socket exists" || echo "Socket missing"
|
||||||
|
podman --url unix:///podman-host/podman.sock info
|
||||||
|
podman --url unix:///podman-host/podman.sock ps
|
||||||
|
|
||||||
|
- name: Verify pinned digests
|
||||||
|
run: |
|
||||||
|
for v in RUST_IMG_DIGEST NODE_IMG_DIGEST POSTGRES_IMG_DIGEST; do
|
||||||
[ -n "${!v}" ] || { echo "Missing $v"; exit 1; }
|
[ -n "${!v}" ] || { echo "Missing $v"; exit 1; }
|
||||||
echo "${!v}" | grep -Eq '^.+@sha256:[0-9a-f]{64}$' || { echo "$v must be a digest ref"; exit 1; }
|
echo "${!v}" | grep -Eq '^.+@sha256:[0-9a-f]{64}$' || { echo "$v must be a digest ref"; exit 1; }
|
||||||
done
|
done
|
||||||
|
|
||||||
- name: Setup ephemeral PiP container
|
- name: Create internal network
|
||||||
env:
|
run: podman --url unix:///podman-host/podman.sock network create --internal integ-${{ env.RUN_ID }}
|
||||||
SOCKET_PATH: /podman-host/podman.sock
|
|
||||||
|
- name: Start PostgreSQL
|
||||||
run: |
|
run: |
|
||||||
chmod +x ./secure_pip_setup.sh
|
podman --url unix:///podman-host/podman.sock run -d \
|
||||||
./secure_pip_setup.sh
|
--name test-postgres-${{ env.RUN_ID }} \
|
||||||
|
|
||||||
- name: Wait for PiP readiness
|
|
||||||
env:
|
|
||||||
PIP_NAME: ci-pip-${{ env.RUN_ID }}
|
|
||||||
run: |
|
|
||||||
chmod +x ./pip_ready.sh
|
|
||||||
./pip_ready.sh
|
|
||||||
|
|
||||||
- name: Verify Podman socket inside PiP
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'test -S /run/podman-host/podman.sock && echo OK'
|
|
||||||
|
|
||||||
- name: Network sanity from PiP
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'getent hosts git.gcdo.org && curl -sS -o /dev/null -w "status=%{http_code}\n" https://git.gcdo.org/api/healthz'
|
|
||||||
|
|
||||||
- name: Configure Git for token-based authentication
|
|
||||||
run: |
|
|
||||||
git config --global url."https://${{ secrets.REGISTRY_USERNAME }}:${{ secrets.REGISTRY_TOKEN }}@${{ env.REGISTRY }}".insteadOf "https://${{ env.REGISTRY }}"
|
|
||||||
|
|
||||||
- name: Create internal integration network
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} podman network create --internal integ-${{ env.RUN_ID }}
|
|
||||||
|
|
||||||
- name: Start PostgreSQL on internal network (digest-pinned)
|
|
||||||
run: |
|
|
||||||
podman exec ci-pip-${{ env.RUN_ID }} podman run -d \
|
|
||||||
--name test-postgres \
|
|
||||||
--network integ-${{ env.RUN_ID }} \
|
--network integ-${{ env.RUN_ID }} \
|
||||||
-e POSTGRES_PASSWORD=password \
|
-e POSTGRES_PASSWORD=password \
|
||||||
-e POSTGRES_USER=postgres \
|
-e POSTGRES_USER=postgres \
|
||||||
-e POSTGRES_DB=sharenet_test \
|
-e POSTGRES_DB=sharenet_test \
|
||||||
"${POSTGRES_IMG_DIGEST}"
|
"$POSTGRES_IMG_DIGEST"
|
||||||
|
|
||||||
- name: Wait for PostgreSQL to be ready
|
- name: Wait for PostgreSQL
|
||||||
run: |
|
run: |
|
||||||
podman exec ci-pip-${{ env.RUN_ID }} sh -lc '
|
timeout 60 bash -c '
|
||||||
i=0; until podman exec test-postgres pg_isready -h 127.0.0.1 -p 5432 -U postgres >/dev/null 2>&1; do
|
until podman --url unix:///podman-host/podman.sock exec test-postgres-${{ env.RUN_ID }} pg_isready -h 127.0.0.1 -p 5432 -U postgres; do
|
||||||
i=$((i+1)); [ $i -gt 60 ] && { echo "pg not ready"; exit 1; }; sleep 1
|
sleep 1
|
||||||
done'
|
done
|
||||||
|
'
|
||||||
|
|
||||||
- name: Run backend unit tests
|
- name: Run backend tests
|
||||||
env:
|
|
||||||
WORKSPACE: ${{ github.workspace }}
|
|
||||||
run: |
|
run: |
|
||||||
podman exec -e WORKSPACE="${WORKSPACE}" ci-pip-${{ env.RUN_ID }} sh -lc '
|
podman --url unix:///podman-host/podman.sock run --rm \
|
||||||
podman run --rm \
|
-v "$PWD":/workspace \
|
||||||
-v "$WORKSPACE":/workspace \
|
-w /workspace \
|
||||||
-w /workspace \
|
--network integ-${{ env.RUN_ID }} \
|
||||||
"'"${RUST_IMG_DIGEST}"'" \
|
-e DATABASE_URL=postgres://postgres:password@test-postgres-${{ env.RUN_ID }}:5432/sharenet_test \
|
||||||
sh -c "cargo test --lib -- --test-threads=1"'
|
"$RUST_IMG_DIGEST" \
|
||||||
|
sh -c "cargo test --lib -- --test-threads=1"
|
||||||
|
|
||||||
- name: Run backend integration tests
|
- name: Cleanup
|
||||||
env:
|
|
||||||
WORKSPACE: ${{ github.workspace }}
|
|
||||||
run: |
|
|
||||||
podman exec -e WORKSPACE="${WORKSPACE}" ci-pip-${{ env.RUN_ID }} sh -lc '
|
|
||||||
podman run --rm \
|
|
||||||
--network integ-${{ env.RUN_ID }} \
|
|
||||||
-v "$WORKSPACE":/workspace \
|
|
||||||
-w /workspace \
|
|
||||||
-e DATABASE_URL=postgres://postgres:password@test-postgres:5432/sharenet_test \
|
|
||||||
"'"${RUST_IMG_DIGEST}"'" \
|
|
||||||
sh -c "cargo test --test '"'"'*'"'"' -- --test-threads=1"'
|
|
||||||
|
|
||||||
- name: Cleanup test resources
|
|
||||||
if: always()
|
if: always()
|
||||||
run: |
|
run: |
|
||||||
podman exec ci-pip-${{ env.RUN_ID }} podman rm -f test-postgres 2>/dev/null || true
|
podman --url unix:///podman-host/podman.sock rm -f test-postgres-${{ env.RUN_ID }} 2>/dev/null || true
|
||||||
podman exec ci-pip-${{ env.RUN_ID }} podman network rm integ-${{ env.RUN_ID }} 2>/dev/null || true
|
podman --url unix:///podman-host/podman.sock network rm integ-${{ env.RUN_ID }} 2>/dev/null || true
|
||||||
|
|
||||||
- name: Per-job cleanup (PiP container)
|
|
||||||
if: always()
|
|
||||||
run: podman rm -f ci-pip-${{ env.RUN_ID }} 2>/dev/null || true
|
|
||||||
|
|
||||||
test-frontend:
|
|
||||||
runs-on: [ci]
|
|
||||||
needs: test-backend
|
|
||||||
env:
|
|
||||||
XDG_RUNTIME_DIR: /run/user/999
|
|
||||||
CONTAINER_HOST: unix:///podman-host/podman.sock
|
|
||||||
container:
|
|
||||||
image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f
|
|
||||||
# options: >-
|
|
||||||
# -v /run/user/999/podman:/run/user/999/podman:rw
|
|
||||||
# -e XDG_RUNTIME_DIR=/run/user/999
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- run: |
|
|
||||||
ls -l /podman-host
|
|
||||||
test -S /podman-host/podman.sock
|
|
||||||
podman info --log-level=error >/dev/null
|
|
||||||
podman ps >/dev/null
|
|
||||||
node -v
|
|
||||||
podman --version
|
|
||||||
|
|
||||||
- name: Verify pinned digests provided
|
|
||||||
run: |
|
|
||||||
for v in NODE_IMG_DIGEST PODMAN_CLIENT_IMG_DIGEST; do
|
|
||||||
[ -n "${!v}" ] || { echo "Missing $v"; exit 1; }
|
|
||||||
echo "${!v}" | grep -Eq '^.+@sha256:[0-9a-f]{64}$' || { echo "$v must be a digest ref"; exit 1; }
|
|
||||||
done
|
|
||||||
|
|
||||||
- name: Setup ephemeral PiP container
|
|
||||||
env:
|
|
||||||
SOCKET_PATH: /podman-host/podman.sock
|
|
||||||
run: |
|
|
||||||
chmod +x ./secure_pip_setup.sh
|
|
||||||
./secure_pip_setup.sh
|
|
||||||
|
|
||||||
- name: Wait for PiP readiness
|
|
||||||
env:
|
|
||||||
PIP_NAME: ci-pip-${{ env.RUN_ID }}
|
|
||||||
run: |
|
|
||||||
chmod +x ./pip_ready.sh
|
|
||||||
./pip_ready.sh
|
|
||||||
|
|
||||||
- name: Verify Podman socket inside PiP
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'test -S /run/podman-host/podman.sock && echo OK'
|
|
||||||
|
|
||||||
- name: Network sanity from PiP
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'getent hosts git.gcdo.org && curl -sS -o /dev/null -w "status=%{http_code}\n" https://git.gcdo.org/api/healthz'
|
|
||||||
|
|
||||||
- name: Run frontend tests (digest-pinned)
|
|
||||||
env:
|
|
||||||
WORKSPACE: ${{ github.workspace }}
|
|
||||||
run: |
|
|
||||||
podman exec -e WORKSPACE="${WORKSPACE}" ci-pip-${{ env.RUN_ID }} sh -lc '
|
|
||||||
podman run --rm \
|
|
||||||
-v "$WORKSPACE":/workspace \
|
|
||||||
-w /workspace \
|
|
||||||
"'"${NODE_IMG_DIGEST}"'" \
|
|
||||||
sh -c "npm ci && npm run test"'
|
|
||||||
|
|
||||||
- name: Per-job cleanup (PiP container)
|
|
||||||
if: always()
|
|
||||||
run: podman rm -f ci-pip-${{ env.RUN_ID }} 2>/dev/null || true
|
|
||||||
|
|
||||||
build-backend:
|
|
||||||
runs-on: [ci]
|
|
||||||
needs: test-frontend
|
|
||||||
env:
|
|
||||||
XDG_RUNTIME_DIR: /run/user/999
|
|
||||||
CONTAINER_HOST: unix:///podman-host/podman.sock
|
|
||||||
container:
|
|
||||||
image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f
|
|
||||||
# options: >-
|
|
||||||
# -v /run/user/999/podman:/run/user/999/podman:rw
|
|
||||||
# -e XDG_RUNTIME_DIR=/run/user/999
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- run: |
|
|
||||||
ls -l /podman-host
|
|
||||||
test -S /podman-host/podman.sock
|
|
||||||
podman info --log-level=error >/dev/null
|
|
||||||
podman ps >/dev/null
|
|
||||||
node -v
|
|
||||||
podman --version
|
|
||||||
|
|
||||||
- name: Setup ephemeral PiP container
|
|
||||||
env:
|
|
||||||
SOCKET_PATH: /podman-host/podman.sock
|
|
||||||
run: |
|
|
||||||
chmod +x ./secure_pip_setup.sh
|
|
||||||
./secure_pip_setup.sh
|
|
||||||
|
|
||||||
- name: Wait for PiP readiness
|
|
||||||
env:
|
|
||||||
PIP_NAME: ci-pip-${{ env.RUN_ID }}
|
|
||||||
run: |
|
|
||||||
chmod +x ./pip_ready.sh
|
|
||||||
./pip_ready.sh
|
|
||||||
|
|
||||||
- name: Verify Podman socket inside PiP
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'test -S /run/podman-host/podman.sock && echo OK'
|
|
||||||
|
|
||||||
- name: Network sanity from PiP
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'getent hosts git.gcdo.org && curl -sS -o /dev/null -w "status=%{http_code}\n" https://git.gcdo.org/api/healthz'
|
|
||||||
|
|
||||||
- name: Login to Forgejo Container Registry securely
|
|
||||||
env:
|
|
||||||
REGISTRY_HOST: ${{ env.REGISTRY }}
|
|
||||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
||||||
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
||||||
run: |
|
|
||||||
podman exec -i ci-pip-${{ env.RUN_ID }} sh -lc \
|
|
||||||
'podman login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin' <<<"${REGISTRY_TOKEN}"
|
|
||||||
|
|
||||||
- name: Build backend image
|
|
||||||
env:
|
|
||||||
REGISTRY: ${{ env.REGISTRY }}
|
|
||||||
APP_NAME: ${{ env.APP_NAME }}
|
|
||||||
IMAGE_TAG: ${{ env.IMAGE_TAG }}
|
|
||||||
run: |
|
|
||||||
podman exec ci-pip-${{ env.RUN_ID }} sh -lc \
|
|
||||||
'cd /workspace/backend && podman build -t "$REGISTRY/$APP_NAME/backend:$IMAGE_TAG" .'
|
|
||||||
|
|
||||||
- name: Push backend image
|
|
||||||
env:
|
|
||||||
REGISTRY: ${{ env.REGISTRY }}
|
|
||||||
APP_NAME: ${{ env.APP_NAME }}
|
|
||||||
IMAGE_TAG: ${{ env.IMAGE_TAG }}
|
|
||||||
run: |
|
|
||||||
podman exec ci-pip-${{ env.RUN_ID }} sh -lc \
|
|
||||||
'podman push "$REGISTRY/$APP_NAME/backend:$IMAGE_TAG"'
|
|
||||||
|
|
||||||
- name: Per-job cleanup (PiP container)
|
|
||||||
if: always()
|
|
||||||
run: podman rm -f ci-pip-${{ env.RUN_ID }} 2>/dev/null || true
|
|
||||||
|
|
||||||
build-frontend:
|
|
||||||
runs-on: [ci]
|
|
||||||
needs: test-frontend
|
|
||||||
env:
|
|
||||||
XDG_RUNTIME_DIR: /run/user/999
|
|
||||||
CONTAINER_HOST: unix:///podman-host/podman.sock
|
|
||||||
container:
|
|
||||||
image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f
|
|
||||||
# options: >-
|
|
||||||
# -v /run/user/999/podman:/run/user/999/podman:rw
|
|
||||||
# -e XDG_RUNTIME_DIR=/run/user/999
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- run: |
|
|
||||||
ls -l /podman-host
|
|
||||||
test -S /podman-host/podman.sock
|
|
||||||
podman info --log-level=error >/dev/null
|
|
||||||
podman ps >/dev/null
|
|
||||||
node -v
|
|
||||||
podman --version
|
|
||||||
|
|
||||||
- name: Setup ephemeral PiP container
|
|
||||||
env:
|
|
||||||
SOCKET_PATH: /podman-host/podman.sock
|
|
||||||
run: |
|
|
||||||
chmod +x ./secure_pip_setup.sh
|
|
||||||
./secure_pip_setup.sh
|
|
||||||
|
|
||||||
- name: Wait for PiP readiness
|
|
||||||
env:
|
|
||||||
PIP_NAME: ci-pip-${{ env.RUN_ID }}
|
|
||||||
run: |
|
|
||||||
chmod +x ./pip_ready.sh
|
|
||||||
./pip_ready.sh
|
|
||||||
|
|
||||||
- name: Verify Podman socket inside PiP
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'test -S /run/podman-host/podman.sock && echo OK'
|
|
||||||
|
|
||||||
- name: Network sanity from PiP
|
|
||||||
run: podman exec ci-pip-${{ env.RUN_ID }} sh -lc 'getent hosts git.gcdo.org && curl -sS -o /dev/null -w "status=%{http_code}\n" https://git.gcdo.org/api/healthz'
|
|
||||||
|
|
||||||
- name: Login to Forgejo Container Registry securely
|
|
||||||
env:
|
|
||||||
REGISTRY_HOST: ${{ env.REGISTRY }}
|
|
||||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
||||||
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
||||||
run: |
|
|
||||||
podman exec -i ci-pip-${{ env.RUN_ID }} sh -lc \
|
|
||||||
'podman login "$REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin' <<<"${REGISTRY_TOKEN}"
|
|
||||||
|
|
||||||
- name: Build frontend image
|
|
||||||
env:
|
|
||||||
REGISTRY: ${{ env.REGISTRY }}
|
|
||||||
APP_NAME: ${{ env.APP_NAME }}
|
|
||||||
IMAGE_TAG: ${{ env.IMAGE_TAG }}
|
|
||||||
run: |
|
|
||||||
podman exec ci-pip-${{ env.RUN_ID }} sh -lc \
|
|
||||||
'cd /workspace/frontend && podman build -t "$REGISTRY/$APP_NAME/frontend:$IMAGE_TAG" .'
|
|
||||||
|
|
||||||
- name: Push frontend image
|
|
||||||
env:
|
|
||||||
REGISTRY: ${{ env.REGISTRY }}
|
|
||||||
APP_NAME: ${{ env.APP_NAME }}
|
|
||||||
IMAGE_TAG: ${{ env.IMAGE_TAG }}
|
|
||||||
run: |
|
|
||||||
podman exec ci-pip-${{ env.RUN_ID }} sh -lc \
|
|
||||||
'podman push "$REGISTRY/$APP_NAME/frontend:$IMAGE_TAG"'
|
|
||||||
|
|
||||||
- name: Per-job cleanup (PiP container)
|
|
||||||
if: always()
|
|
||||||
run: podman rm -f ci-pip-${{ env.RUN_ID }} 2>/dev/null || true
|
|
||||||
|
|
||||||
deploy-prod:
|
|
||||||
runs-on: [prod]
|
|
||||||
needs: [build-backend, build-frontend]
|
|
||||||
if: success()
|
|
||||||
env:
|
|
||||||
XDG_RUNTIME_DIR: /run/user/999
|
|
||||||
CONTAINER_HOST: unix:///podman-host/podman.sock
|
|
||||||
container:
|
|
||||||
image: git.gcdo.org/devteam/sharenet/ci-node-podman@sha256:eb0d942bd9a8cc69c63eb9ccf3877703898d676d0268cf379defdcda7e55f37f
|
|
||||||
# options: >-
|
|
||||||
# -v /run/user/999/podman:/run/user/999/podman:rw
|
|
||||||
# -e XDG_RUNTIME_DIR=/run/user/999
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- run: |
|
|
||||||
ls -l /podman-host
|
|
||||||
test -S /podman-host/podman.sock
|
|
||||||
podman info --log-level=error >/dev/null
|
|
||||||
podman ps >/dev/null
|
|
||||||
node -v
|
|
||||||
podman --version
|
|
||||||
|
|
||||||
# Your prod-pod.yml uses ${REGISTRY_HOST}, but the workflow defines REGISTRY.
|
|
||||||
# Export a one-off alias so templating resolves.
|
|
||||||
- name: Render prod spec (no envsubst)
|
|
||||||
env:
|
|
||||||
REGISTRY_HOST: ${{ env.REGISTRY }}
|
|
||||||
run: |
|
|
||||||
awk '{
|
|
||||||
while (match($0, /\$\{[A-Za-z_][A-Za-z0-9_]*\}/)) {
|
|
||||||
k = substr($0, RSTART+2, RLENGTH-3);
|
|
||||||
v = ENVIRON[k];
|
|
||||||
gsub("\\$\\{" k "\\}", v);
|
|
||||||
}
|
|
||||||
print
|
|
||||||
}' deploy/prod-pod.yml > prod-pod-deploy.yml
|
|
||||||
|
|
||||||
- name: Apply with Podman
|
|
||||||
run: podman play kube --replace prod-pod-deploy.yml
|
|
||||||
|
|
||||||
- name: Clean up generated file
|
|
||||||
if: always()
|
|
||||||
run: rm -f prod-pod-deploy.yml
|
|
||||||
Loading…
Add table
Reference in a new issue