From 64524010a02fd7a41a10ea79beb956d435993173 Mon Sep 17 00:00:00 2001 From: continuist Date: Wed, 10 Sep 2025 00:34:19 -0400 Subject: [PATCH] More CI workflow fixes #3 --- .forgejo/workflows/ci.yml | 107 +++++++++++--------------------------- 1 file changed, 30 insertions(+), 77 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 1dc2a47..fc959d8 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -24,16 +24,13 @@ env: NODE_IMG_DIGEST: ${{ secrets.NODE_IMG_DIGEST }} # e.g., docker.io/library/node@sha256:... POSTGRES_IMG_DIGEST: ${{ secrets.POSTGRES_IMG_DIGEST }} # e.g., docker.io/library/postgres@sha256:... PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} # e.g., quay.io/podman/stable@sha256:... + PODMAN_SOCK: /run/user/999/podman/podman.sock jobs: test-backend: runs-on: [ci] - container: - image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} - - env: - PODMAN_SOCK: /run/user/999/podman/podman.sock + container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} steps: - uses: actions/checkout@v4 @@ -58,7 +55,7 @@ jobs: - name: Setup ephemeral PiP container env: - PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} + PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} SOCKET_PATH: ${{ env.PODMAN_SOCK }} run: | chmod +x ./secure_pip_setup.sh @@ -139,11 +136,7 @@ jobs: runs-on: [ci] needs: test-backend - container: - image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} - - env: - PODMAN_SOCK: /run/user/999/podman/podman.sock + container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} steps: - uses: actions/checkout@v4 @@ -163,7 +156,7 @@ jobs: - name: Setup ephemeral PiP container env: - PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} + PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} SOCKET_PATH: ${{ env.PODMAN_SOCK }} run: | chmod +x ./secure_pip_setup.sh @@ -201,11 +194,7 @@ jobs: runs-on: [ci] needs: test-frontend - container: - image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} - - env: - PODMAN_SOCK: /run/user/999/podman/podman.sock + container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} steps: - uses: actions/checkout@v4 @@ -218,7 +207,7 @@ jobs: - name: Setup ephemeral PiP container env: - PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} + PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} SOCKET_PATH: ${{ env.PODMAN_SOCK }} run: | chmod +x ./secure_pip_setup.sh @@ -272,11 +261,7 @@ jobs: runs-on: [ci] needs: test-frontend - container: - image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} - - env: - PODMAN_SOCK: /run/user/999/podman/podman.sock + container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} steps: - uses: actions/checkout@v4 @@ -289,7 +274,7 @@ jobs: - name: Setup ephemeral PiP container env: - PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} + PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} SOCKET_PATH: ${{ env.PODMAN_SOCK }} run: | chmod +x ./secure_pip_setup.sh @@ -343,66 +328,34 @@ jobs: runs-on: [prod] needs: [build-backend, build-frontend] if: success() - - container: - image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} - - env: - PODMAN_SOCK: /run/user/999/podman/podman.sock + container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} steps: - uses: actions/checkout@v4 - - - name: Deploy to production - env: - REGISTRY_HOST: ${{ env.REGISTRY }} - APP_NAME: ${{ env.APP_NAME }} - IMAGE_TAG: ${{ env.IMAGE_TAG }} - POSTGRES_USERNAME: ${{ env.POSTGRES_USERNAME }} - POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }} - POSTGRES_HOST: ${{ env.POSTGRES_HOST }} - POSTGRES_PORT: ${{ env.POSTGRES_PORT }} - POSTGRES_DATABASE_NAME: ${{ env.POSTGRES_DATABASE_NAME }} - PROD_BACKEND_HOST: ${{ env.PROD_BACKEND_HOST }} - PROD_BACKEND_PORT: ${{ env.PROD_BACKEND_PORT }} - PROD_FRONTEND_PORT: ${{ env.PROD_FRONTEND_PORT }} - run: | - # Install envsubst if not available (gettext package) - command -v envsubst >/dev/null 2>&1 || { - if command -v apt-get >/dev/null 2>&1; then - sudo apt-get update && sudo apt-get install -y gettext-base - elif command -v yum >/dev/null 2>&1; then - sudo yum install -y gettext - elif command -v apk >/dev/null 2>&1; then - sudo apk add gettext - fi - } - - - name: Resolve Podman user socket (prod) - run: | - SVC_USER="prod-service" - uid=$(id -u "$SVC_USER") - echo "PODMAN_SOCK=/run/user/${uid}/podman/podman.sock" >> "$GITHUB_ENV" - - name: Verify runner wiring to Podman + - name: Verify Podman in job container run: | podman --version - test -S "${PODMAN_SOCK}" || { echo "Missing socket ${PODMAN_SOCK}"; exit 1; } - # Optional: sanity poke of the service via PiP later + podman info --log-level=error >/dev/null - - name: Render prod spec - run: envsubst < deploy/prod-pod.yml > prod-pod-deploy.yml - - - name: Apply with Podman (no registry login needed) + # Your prod-pod.yml uses ${REGISTRY_HOST}, but the workflow defines REGISTRY. + # Export a one-off alias so templating resolves. + - name: Render prod spec (no envsubst) env: - PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }} + REGISTRY_HOST: ${{ env.REGISTRY }} run: | - cat prod-pod-deploy.yml | \ - podman run --rm -i \ - -v "${PODMAN_SOCK}:${PODMAN_SOCK}" \ - -e "CONTAINER_HOST=unix://${PODMAN_SOCK}" \ - "${PODMAN_CLIENT_IMG_DIGEST}" \ - sh -lc 'cat >/tmp/spec.yml; podman play kube --replace /tmp/spec.yml' - + awk '{ + while (match($0, /\$\{[A-Za-z_][A-Za-z0-9_]*\}/)) { + k = substr($0, RSTART+2, RLENGTH-3); + v = ENVIRON[k]; + gsub("\\$\\{" k "\\}", v); + } + print + }' deploy/prod-pod.yml > prod-pod-deploy.yml + + - name: Apply with Podman + run: podman play kube --replace prod-pod-deploy.yml + - name: Clean up generated file - run: rm -f prod-pod-deploy.yml \ No newline at end of file + if: always() + run: rm -f prod-pod-deploy.yml