More CI workflow fixes #3

.forgejo/workflows/ci.yml

@@ -24,16 +24,13 @@ env:
   NODE_IMG_DIGEST: ${{ secrets.NODE_IMG_DIGEST }}         # e.g., docker.io/library/node@sha256:...
   POSTGRES_IMG_DIGEST: ${{ secrets.POSTGRES_IMG_DIGEST }} # e.g., docker.io/library/postgres@sha256:...
   PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }} # e.g., quay.io/podman/stable@sha256:...
+  PODMAN_SOCK: /run/user/999/podman/podman.sock
 
 jobs:
   test-backend:
     runs-on: [ci]
 
-    container:
+    container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
-      image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
-
-    env:
-      PODMAN_SOCK: /run/user/999/podman/podman.sock
 
     steps:
       - uses: actions/checkout@v4
@@ -58,7 +55,7 @@ jobs:
 
       - name: Setup ephemeral PiP container
         env:
-          PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
+          PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
           SOCKET_PATH: ${{ env.PODMAN_SOCK }}
         run: |
           chmod +x ./secure_pip_setup.sh
@@ -139,11 +136,7 @@ jobs:
     runs-on: [ci]
     needs: test-backend
 
-    container:
+    container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
-      image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
-
-    env:
-      PODMAN_SOCK: /run/user/999/podman/podman.sock
 
     steps:
       - uses: actions/checkout@v4
@@ -163,7 +156,7 @@ jobs:
 
       - name: Setup ephemeral PiP container
         env:
-          PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
+          PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
           SOCKET_PATH: ${{ env.PODMAN_SOCK }}
         run: |
           chmod +x ./secure_pip_setup.sh
@@ -201,11 +194,7 @@ jobs:
     runs-on: [ci]
     needs: test-frontend
 
-    container:
+    container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
-      image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
-
-    env:
-      PODMAN_SOCK: /run/user/999/podman/podman.sock
 
     steps:
       - uses: actions/checkout@v4
@@ -218,7 +207,7 @@ jobs:
 
       - name: Setup ephemeral PiP container
         env:
-          PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
+          PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
           SOCKET_PATH: ${{ env.PODMAN_SOCK }}
         run: |
           chmod +x ./secure_pip_setup.sh
@@ -272,11 +261,7 @@ jobs:
     runs-on: [ci]
     needs: test-frontend
 
-    container:
+    container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
-      image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
-
-    env:
-      PODMAN_SOCK: /run/user/999/podman/podman.sock
 
     steps:
       - uses: actions/checkout@v4
@@ -289,7 +274,7 @@ jobs:
 
       - name: Setup ephemeral PiP container
         env:
-          PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
+          PODMAN_CLIENT_IMG_DIGEST: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
           SOCKET_PATH: ${{ env.PODMAN_SOCK }}
         run: |
           chmod +x ./secure_pip_setup.sh
@@ -343,66 +328,34 @@ jobs:
     runs-on: [prod]
     needs: [build-backend, build-frontend]
     if: success()
-
+    container: ${{ secrets.PODMAN_CLIENT_IMG_DIGEST }}
-    container:
-      image: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
-
-    env:
-      PODMAN_SOCK: /run/user/999/podman/podman.sock
 
     steps:
       - uses: actions/checkout@v4
-      
-      - name: Deploy to production
-        env:
-          REGISTRY_HOST: ${{ env.REGISTRY }}
-          APP_NAME: ${{ env.APP_NAME }}
-          IMAGE_TAG: ${{ env.IMAGE_TAG }}
-          POSTGRES_USERNAME: ${{ env.POSTGRES_USERNAME }}
-          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }}
-          POSTGRES_HOST: ${{ env.POSTGRES_HOST }}
-          POSTGRES_PORT: ${{ env.POSTGRES_PORT }}
-          POSTGRES_DATABASE_NAME: ${{ env.POSTGRES_DATABASE_NAME }}
-          PROD_BACKEND_HOST: ${{ env.PROD_BACKEND_HOST }}
-          PROD_BACKEND_PORT: ${{ env.PROD_BACKEND_PORT }}
-          PROD_FRONTEND_PORT: ${{ env.PROD_FRONTEND_PORT }}
-        run: |
-          # Install envsubst if not available (gettext package)
-          command -v envsubst >/dev/null 2>&1 || { 
-            if command -v apt-get >/dev/null 2>&1; then
-              sudo apt-get update && sudo apt-get install -y gettext-base
-            elif command -v yum >/dev/null 2>&1; then
-              sudo yum install -y gettext
-            elif command -v apk >/dev/null 2>&1; then
-              sudo apk add gettext
-            fi
-          }
-          
-      - name: Resolve Podman user socket (prod)
-        run: |
-          SVC_USER="prod-service"
-          uid=$(id -u "$SVC_USER")
-          echo "PODMAN_SOCK=/run/user/${uid}/podman/podman.sock" >> "$GITHUB_ENV"
 
-      - name: Verify runner wiring to Podman
+      - name: Verify Podman in job container
         run: |
           podman --version
-          test -S "${PODMAN_SOCK}" || { echo "Missing socket ${PODMAN_SOCK}"; exit 1; }
+          podman info --log-level=error >/dev/null
-          # Optional: sanity poke of the service via PiP later
 
-      - name: Render prod spec
+      # Your prod-pod.yml uses ${REGISTRY_HOST}, but the workflow defines REGISTRY.
-        run: envsubst < deploy/prod-pod.yml > prod-pod-deploy.yml
+      # Export a one-off alias so templating resolves.
-
+      - name: Render prod spec (no envsubst)
-      - name: Apply with Podman (no registry login needed)
         env:
-          PODMAN_CLIENT_IMG_DIGEST: ${{ env.PODMAN_CLIENT_IMG_DIGEST }}
+          REGISTRY_HOST: ${{ env.REGISTRY }}
         run: |
-          cat prod-pod-deploy.yml | \
+          awk '{
-          podman run --rm -i \
+            while (match($0, /\$\{[A-Za-z_][A-Za-z0-9_]*\}/)) {
-            -v "${PODMAN_SOCK}:${PODMAN_SOCK}" \
+              k = substr($0, RSTART+2, RLENGTH-3);
-            -e "CONTAINER_HOST=unix://${PODMAN_SOCK}" \
+              v = ENVIRON[k];
-            "${PODMAN_CLIENT_IMG_DIGEST}" \
+              gsub("\\$\\{" k "\\}", v);
-            sh -lc 'cat >/tmp/spec.yml; podman play kube --replace /tmp/spec.yml'
+            }
-          
+            print
+          }' deploy/prod-pod.yml > prod-pod-deploy.yml
+
+      - name: Apply with Podman
+        run: podman play kube --replace prod-pod-deploy.yml
+
       - name: Clean up generated file
-        run: rm -f prod-pod-deploy.yml
+        if: always()
+        run: rm -f prod-pod-deploy.yml